feat: replace SharpCompress with LibArchive.Net

[jas88]

Summary

• Replaces SharpCompress dependency with LibArchive.Net for TAR archive reading in UpdateFetcher
• Resolves breaking API changes that caused PR Bump SharpCompress from 0.39.0 to 0.47.0 #121 (SharpCompress 0.47.0 update) to fail CI
• LibArchive.Net wraps native libarchive, providing broader format support with bundled native binaries for all platforms

Test plan

• Build succeeds with zero warnings
• All existing tests pass
• CI passes on ubuntu-latest

High-level PR Summary

This PR replaces the SharpCompress library with LibArchive.Net to resolve breaking API changes that caused issues when updating SharpCompress to version 0.47.0. The change primarily affects the UpdateFetcher class, where TAR archive reading logic has been refactored to use the new library's API. LibArchive.Net provides broader format support through native libarchive bindings with bundled binaries for all platforms.

⏱️ Estimated Review Time: 5-15 minutes

💡 Review Order Suggestion

Order	File Path
1	PACSify/PACSify.csproj
2	PACSify/UpdateFetcher.cs

---

Summary by cubic

Switch archive handling to LibArchive.Net in UpdateFetcher to fix CI failures from SharpCompress API changes, improve format support across platforms, and prevent path traversal in archive entries.

• Dependencies

  • Remove SharpCompress; add LibArchive.Net 0.3.0 (bundled native libarchive).
  • Keep Microsoft.Extensions.* packages at 10.0.3.

• Refactors

  • Replace ReaderFactory/OpenEntryStream with LibArchiveReader and foreach entry iteration.
  • Use Path.GetFileName(entry.Name) and entry.Stream for .docker processing, file writes, and Windows replace logic to avoid path traversal.

^{Written for commit 6949f60. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="PACSify/UpdateFetcher.cs">

<violation number="1" location="PACSify/UpdateFetcher.cs:75">
P0: Archive entry paths are used directly for file writes/replacements, which enables path traversal (e.g., `../`) from a crafted TAR and can overwrite arbitrary files.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[recurseml]

Review by RecurseML

🔍 Review performed on e1f44a0..ca2565e

Severity	Location	Issue	Delete
	PACSify/UpdateFetcher.cs:46	Null reference exception

✅ Files analyzed, no issues (1)

• PACSify/PACSify.csproj

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="PACSify/UpdateFetcher.cs">

<violation number="1" location="PACSify/UpdateFetcher.cs:46">
P2: Using `Path.GetFileName(entry.Name)` flattens archive paths and can cause filename collisions/overwrites when different directories contain the same file name.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}