Owncloud creates zip file that cannot be opened by file-roller and is probably corrupted

[Scindix]

Steps to reproduce

1. Upload a few files (or optionally a folder containing files)
2. Download multiple files at once by selecting them (or by downloading a folder) on the website
3. Try to open the zip file with gnome file roller/check the file integrity with "unzip -T archive.zip"

Expected behaviour

There shouldn't be an error with the integrity check and file-roller should be able to open that file.

Actual behaviour

file-roller prompts: "An error ocurred while loading the archive". I can open it with other tools such as unzip.

$ unzip download.zip 
Archive:  download.zip
 extracting: file1                   
 extracting: file2                   
$ cat file1
test
$ cat file2
test2

However testing the file reveals a flaw in the archive.

$ unzip -T download.zip
note:  didn't find end-of-central-dir signature at end of central dir.

I'm not sure if file-roller is failing because of this note and even if it does it should be less sensitve and still be able to open the file. Thus I already filed a bug to gnome: https://bugzilla.gnome.org/show_bug.cgi?id=769083 But it seems that owncloud is creating "mildly corrupted" archives. And some Zip programs may fail because of this.
I'm not sure since when this happens. But it must have been one of the latest updates. (something between 8.2 and 9.0 I would guess)

Server configuration

I'm filling this out for the sake of completeness. But my described behaviour can also be observed at demo.owncloud.org
So it doesn't have to do with my specific server configuration.
Operating system:
Debian Jessie 8.5
Web server:
Apache/2.4.20
Database:
MySQL Ver 14.14
PHP version:
PHP 5.6.22-0+deb8u1
ownCloud version: (see ownCloud admin page)
9.0.4
Updated from an older ownCloud or fresh install:
updated (initially from 8.0.x)
Where did you install ownCloud from:
manual installation
Signing status (ownCloud 9.0 and above):
There seems to be an issue with the key of the tasks app that I couldn't fix yet. But this is unrelated to this issue.
UPDATE: danimo from owncloud central told me that a new key for the Tasks App is on the way. So just ignore this section.

Technical information
=====================
The following list covers which files have failed the integrity check. Please read
the previous linked documentation to learn more about the errors and how to fix
them.
Results
=======
- tasks
    - EXCEPTION
        - OC\IntegrityCheck\Exceptions\InvalidSignatureException
        - Certificate has been revoked.
Raw output
==========
Array
(
    [tasks] => Array
        (
            [EXCEPTION] => Array
                (
                    [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
                    [message] => Certificate has been revoked.
                )
        )
)

List of activated apps:

Enabled:
  - activity: 2.2.1
  - calendar: true
  - comments: 0.2
  - contacts: true
  - dav: 0.1.6
  - documents: 0.12.0
  - encryption: 1.2.0
  - federatedfilesharing: 0.1.0
  - federation: 0.0.4
  - files: 1.4.4
  - files_external: 0.5.2
  - files_pdfviewer: 0.8.1
  - files_sharing: 0.9.1
  - files_texteditor: 2.1
  - files_trashbin: 0.8.0
  - files_versions: 1.2.0
  - files_videoplayer: 0.9.8
  - firstrunwizard: 1.1
  - gallery: 14.5.0
  - galleryplus: 15.1.1
  - libreonline: 0.1
  - mail: 0.5.2
  - music: 0.3.11
  - notes: 2.0.1
  - notifications: 0.2.3
  - provisioning_api: 0.4.1
  - systemtags: 0.2
  - tasks: 0.9.1
  - templateeditor: 0.1
  - updatenotification: 0.1.0
Disabled:
  - external
  - files_antivirus
  - news
  - ownnote
  - richdocuments
  - shorten
  - user_external
  - user_ldap

The content of config/config.php:

{
    "system": {
        "instanceid": "occ8j09o01vk",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            ***some domains***
        ],
        "asset-pipeline.enabled": true,
        "datadirectory": "\/var\/www\/html\/owncloud\/data",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "overwrite.cli.url": "\/owncloud",
        "dbtype": "mysql",
        "version": "9.0.4.1",
        "dbname": "owncloud",
        "dbhost": "localhost",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "loglevel": 2,
        "maintenance": false,
        "theme": "example",
        "singleuser": false,
        "trashbin_retention_obligation": "auto",
        "mail_smtpmode": "sendmail",
        "mail_from_address": "no-reply",
        "mail_domain": "arrakiz.org",
        "preview_libreoffice_path": "\/usr\/bin\/libreoffice",
        "updater.secret": "***REMOVED SENSITIVE VALUE***"
    }
}

Are you using external storage, if yes which one: Google Drive and Dropbox (but unrelated to this issue)

Are you using encryption: yes

Are you using an external user-backend, if yes which one: no

Client configuration

Browser:
Firefox 47.0.1
Operating system:
Arch Linux (up to date)

Logs

Web server error log

No relevant error

ownCloud log (data/owncloud.log)

Not a single entry regarding this issue ;)

[DeepDiver1975]

Works for me using Gnome 3.20.2 - this is the Music folder from demo.owncloud.org

[Scindix]

I'm getting this after downloading and opening the music folder.
I also tested it on a second PC and got the same error. Probably something strange is going on. I'll investigate if there isn't something messed up with my system and come back here afterwards.

[Awebb]

7-Zip on Windows reports a broken header, but extracts the Archive.

[ChristophWurst]

I experienced this multiple times now when sharing photos with friends – they cannot open the downloaded ZIP file. I'd vote for re-opening this as the problem apparently still exists. cc @DeepDiver1975

[DeepDiver1975]

Drop zip support then? 😇

[Scindix]

@DeepDiver1975 I found out the reason why it works for you but not for me.
file-roller uses the 'unzip' command to unzip files unless 'p7zip' is installed. Then it uses the '7z' command. p7zip is able to extract the archive just like unzip, but it prompts the aforementioned header error which causes file-roller to fail completely. Install p7zip and you will experience the same issue that I did.

Drop zip support then? 😇

Why? Just correct the bug that causes the corrupt header.
Where's the code that generates the zip files? I'm not really into the source code of ownCloud. But maybe I can help anyway.

Here's the output of p7zip btw.:

$ 7z x download.zip 

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,8 CPUs Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz (206A7),ASM,AES-NI)

Scanning the drive for archives:
1 file, 449 bytes (1 KiB)

Extracting archive: download.zip

ERRORS:
Headers Error

--
Path = download.zip
Type = zip
ERRORS:
Headers Error
Physical Size = 449
64-bit = +



Archives with Errors: 1

Open Errors: 1

[DeepDiver1975]

Why? Just correct the bug that causes the corrupt header.

What one tool reports as broken header has it's reason in the tool not fully implement the zip specs.

So it's not a bug but an missing implementation on the tools side.
Unfortunately more tools seem not to fully implement the specs.

The code we use for generating the zips is here https://github.com/McNetic/PHPZipStreamer

[Awebb]

How do you guys treat upstream bugs? Mark this one somehow and you open the upstream report, or should the original reporter do it?

[DeepDiver1975]

How do you guys treat upstream bugs?

there are no fixed rules - feel free to open the bug upstream - thanks a lot!

[Scindix]

So it's not a bug but an missing implementation on the tools side.

@DeepDiver1975 Ah ok. Sorry then.

[dansou901]

This is still not fixed I assume? Have got another problem here, android clients (like ES File Explorer) aren't able to open the zip files. With file-roller it works for me til now (don't have 7zip installed).

[Awebb]

Since nobody has bothered filing a bug report upstream or neglected to post the link here, nothing happened. I was just in to aid Scindix with additional information, I don't use Owncloud myself.