# Alternative to 7zip when installing packages

**URL:** <https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141>\
**Category:** General Usage\
**Tags:** pkg\
**Created:** [March 4, 2024, 4:56pm UTC](https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141 "2024-03-04T16:56:32Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![jarroyoe](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/jarroyoe/32/42482_2.png) [@jarroyoe](https://discourse.julialang.org/u/jarroyoe)\
**Post date:** [March 4, 2024, 4:56pm UTC](https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141/1 "2024-03-04T16:56:32Z")

</div>

I just started a job where 7zip is blocked as a potential security threat (I talked to IT about it and unblocking it is basically a nonnegotiable), which basically renders installing most packages impossible.

Is there an alternative to decompress packages without using 7zip, or manually installing packages by decompressing them myself using an authorized software (Peazip)?

Edit: My `versioninfo()`

```julia
Julia Version 1.10.1
Commit 7790d6f064 (2024-02-13 20:41 UTC)
Build Info:
Official https://julialang.org/ release
Platform Info:
OS: Windows (x86_64-w64-mingw32)
CPU: 20 × 13th Gen Intel(R) Core(TM) i7-13800H
WORD_SIZE: 64
LIBM: libopenlibm
LLVM: libLLVM-15.0.7 (ORCJIT, goldmont)
Threads: 1 default, 0 interactive, 1 GC (on 20 virtual cores)     

```

---

<div class="post-metadata">

**Author:** ![GunnarFarneback](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/gunnarfarneback/32/1827_2.png) [@GunnarFarneback](https://discourse.julialang.org/u/GunnarFarneback)\
**Post date:** [March 4, 2024, 6:39pm UTC](https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141/2 "2024-03-04T18:39:27Z")

</div>

Any supported way seems unlikely but if Peazip happens to be sufficiently argument compatible with 7zip you can probably get away with monkeypatching

```julia
using Pkg
Pkg.PlatformEngines.find7z() = "/path/to/peazip"

```

Otherwise you can try to point it to a script which rewrites the arguments and then calls Peazip, provided that your security standards allow calling scripts you write yourself.

---

<div class="post-metadata">

**Author:** ![jarroyoe](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/jarroyoe/32/42482_2.png) [@jarroyoe](https://discourse.julialang.org/u/jarroyoe)\
**Post date:** [March 4, 2024, 7:01pm UTC](https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141/3 "2024-03-04T19:01:24Z")

</div>

That seems to not be working. I am running Pkg on debug, and I still get that Julia attempts to use 7zip:

```julia
Error: IOError: could not spawn setenv(`'path\to\Julia\Julia-1.10.1\libexec\julia\7z.exe' ...)

```

When you mention script, do you mean a Julia script? A bash script?

---

<div class="post-metadata">

**Author:** ![GunnarFarneback](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/gunnarfarneback/32/1827_2.png) [@GunnarFarneback](https://discourse.julialang.org/u/GunnarFarneback)\
**Post date:** [March 4, 2024, 7:30pm UTC](https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141/4 "2024-03-04T19:30:08Z")

</div>

Right, Pkg is in the sysimage, it was optimistic to think that would work.

You could try to intercept `'path\to\Julia\Julia-1.10.1\libexec\julia\7z.exe'` instead, putting your own script there. But I have no idea how the 7z blocking works.

> When you mention script, do you mean a Julia script? A bash script?

Whatever gets the job done.

---

<div class="post-metadata">

**Author:** ![mkitti](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/mkitti/32/12459_2.png) [@mkitti](https://discourse.julialang.org/u/mkitti)\
**Post date:** [March 4, 2024, 7:30pm UTC](https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141/5 "2024-03-04T19:30:44Z")

</div>

Could you provide the output of `versioninfo()` or provide information about your oprtating system environment?

---

<div class="post-metadata">

**Author:** ![jarroyoe](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/jarroyoe/32/42482_2.png) [@jarroyoe](https://discourse.julialang.org/u/jarroyoe)\
**Post date:** [March 4, 2024, 7:34pm UTC](https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141/6 "2024-03-04T19:34:57Z")

</div>

I have added my `versioninfo()` to the original post. I’m basically running Windows 10, so any console commands would use the Powershell scripting.

---

<div class="post-metadata">

**Author:** ![StefanKarpinski](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/stefankarpinski/32/24_2.png) [@StefanKarpinski](https://discourse.julialang.org/u/StefanKarpinski)\
**Post date:** [March 4, 2024, 8:20pm UTC](https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141/7 "2024-03-04T20:20:40Z")

</div>

This is the first time we’ve gotten this issue, so this is very much not configurable. We could make it configurable, but unfortunately that’s not going to help you until Julia 1.12 at this earliest, which won’t be until some time this fall. In the mean time, since Pkg very much hard codes calls to `7z`, you’ll have to find the `7z` binary in your Julia install and replace it with a little shell script that simulates a limited amount of the command-line behavior of `7z` using other tools. That’s not too bad because it’s only called two ways:

- `7z x $tarball_path -so`: extract gzip data from `tarball_path` to stdout, similar to `gzcat`
- `7z a -si -tgzip -mx9 $tarball_path`: take uncompressed tarball data on stdin and gzip it to `tarball_path`

And I’m pretty sure the second way isn’t called in typical Pkg usage. There’s one more usage, but I think it’s only called when precompiling Pkg itself, which probably won’t happen on your local system. Should be fairly easy to cook up a shell script that looks at the way it’s called and emulates those two behaviors using `gzip`. Why don’t we use `gzip`? Mostly historical reasons that are no longer relevant. I’ll probably get around to replacing it with `gzip` soonish.

---

<div class="post-metadata">

**Author:** ![Paul\_Soderlind](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/paul_soderlind/32/1753_2.png) [@Paul\_Soderlind](https://discourse.julialang.org/u/Paul_Soderlind)\
**Post date:** [March 4, 2024, 8:26pm UTC](https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141/8 "2024-03-04T20:26:31Z")

</div>

I had a similar issue, but managed to get IT to allow anything that was installed in the Julia folder and below. (Another 7zip is still blocked, but I clearly don’t need it anymore.)

---

<div class="post-metadata">

**Author:** ![StefanKarpinski](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/stefankarpinski/32/24_2.png) [@StefanKarpinski](https://discourse.julialang.org/u/StefanKarpinski)\
**Post date:** [March 4, 2024, 8:29pm UTC](https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141/9 "2024-03-04T20:29:49Z")

</div>

Seems like z7 is particularly problematic and we should put the effort in to get rid of it. Especially now that we really only use it in a way that gzip is a strictly better replacement for. GitHub issue filed: [replace 7z with gzip · Issue #3824 · JuliaLang/Pkg.jl · GitHub](https://github.com/JuliaLang/Pkg.jl/issues/3824).

---

<div class="post-metadata">

**Author:** ![jarroyoe](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/jarroyoe/32/42482_2.png) [@jarroyoe](https://discourse.julialang.org/u/jarroyoe)\
**Post date:** [March 4, 2024, 9:08pm UTC](https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141/10 "2024-03-04T21:08:44Z")

</div>

Thank you for the update and raising the issue on Github! So, my understanding from your post is to replace 7z.exe with a shell script named 7z.exe that contains those instructions but using `gzip` (or `tar` on Windows) functions?

---

<div class="post-metadata">

**Author:** ![StefanKarpinski](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/stefankarpinski/32/24_2.png) [@StefanKarpinski](https://discourse.julialang.org/u/StefanKarpinski)\
**Post date:** [March 4, 2024, 9:13pm UTC](https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141/11 "2024-03-04T21:13:05Z")

</div>

It needs to be a shell script which, when called like that, invokes `gzip` to accomplish the appropriate behavior.

---

<div class="post-metadata">

**Author:** ![PetrKryslUCSD](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/petrkryslucsd/32/215825_2.png) [@PetrKryslUCSD](https://discourse.julialang.org/u/PetrKryslUCSD)\
**Post date:** [March 4, 2024, 9:27pm UTC](https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141/12 "2024-03-04T21:27:03Z")

</div>

Thank you for mentioning peazip. I was not aware of it. It looks really useful!

---

<div class="post-metadata">

**Author:** ![jarroyoe](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/jarroyoe/32/42482_2.png) [@jarroyoe](https://discourse.julialang.org/u/jarroyoe)\
**Post date:** [March 4, 2024, 9:29pm UTC](https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141/13 "2024-03-04T21:29:44Z")

</div>

Would it still need to be called `7zip.exe` on Windows though? IT seems to block any instance of `7zip.exe` regardless of identity.

---

<div class="post-metadata">

**Author:** ![giordano](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/giordano/32/2166_2.png) [@giordano](https://discourse.julialang.org/u/giordano)\
**Post date:** [March 4, 2024, 11:22pm UTC](https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141/14 "2024-03-04T23:22:01Z")

</div>

🤦‍♂️

That’s very silly. We ship a recent fully patched version of the [new p7zip project](https://github.com/p7zip-project/p7zip), that’s not the [abandoned and CVE-riddled project by the same name](https://sourceforge.net/projects/p7zip/), it doesn’t make sense to block a file just on its name.

---

<div class="post-metadata">

**Author:** ![benlorenz](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/benlorenz/32/207503_2.png) [@benlorenz](https://discourse.julialang.org/u/benlorenz)\
**Post date:** [March 5, 2024, 4:41pm UTC](https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141/15 "2024-03-05T16:41:56Z")

</div>

That is not entirely correct, for Windows `p7zip_jll` just contains repackaged 7-zip binaries: [Yggdrasil/P/p7zip/build\_tarballs.jl at 9631b76a35021f8fff10341fdf942cb7d796e7c8 · JuliaPackaging/Yggdrasil · GitHub](https://github.com/JuliaPackaging/Yggdrasil/blob/9631b76a35021f8fff10341fdf942cb7d796e7c8/P/p7zip/build_tarballs.jl#L11)  
So the blocking might still be hash-based.

---

<div class="post-metadata">

**Author:** ![Palli](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/palli/32/3380_2.png) [@Palli](https://discourse.julialang.org/u/Palli)\
**Post date:** [March 9, 2024, 6:14pm UTC](https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141/16 "2024-03-09T18:14:55Z")

</div>

Could and should Julia rather use (Windows API, see in EDIT below or) the pure-Julia solution (at least on Windows, and maybe just for Pkg):

[https://docs.juliahub.com/General/Inflate/stable/](https://docs.juliahub.com/General/Inflate/stable/)

> [@StefanKarpinski](#):
>
> This is the first time we’ve gotten this issue, so this is very much not configurable. We could make it configurable, but […] it’s only called two ways:
> 
> - `7z x $tarball_path -so`: extract gzip data from `tarball_path` to stdout, similar to `gzcat`
> - `7z a -si -tgzip -mx9 $tarball_path`: take uncompressed tarball data on stdin and gzip it to `tarball_path`

I don’t think we should work around insane security policies, but since it’s a known, problem, I at least asking if this would work.

I guess the risk is that Julia itself would start to be blocked by some admins, if it provides a way around 7zip or other similar issues (for those exploiting)…

EDIT:  
Windows itself will never be blocked, and it provides an API, should be safe to use…:

> **[Compression API - Win32 apps](https://learn.microsoft.com/en-us/windows/win32/cmpapi/-compression-portal)**
>
> Compression API

---

<div class="post-metadata">

**Author:** ![mkitti](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/mkitti/32/12459_2.png) [@mkitti](https://discourse.julialang.org/u/mkitti)\
**Post date:** [March 9, 2024, 6:43pm UTC](https://discourse.julialang.org/t/alternative-to-7zip-when-installing-packages/111141/17 "2024-03-09T18:43:45Z")

</div>

Note that recent versions of Windows have `tar` and `curl` with `gzip` support.

> **[Tar and Curl Come to Windows!](https://learn.microsoft.com/en-us/virtualization/community/team-blog/2017/20171219-tar-and-curl-come-to-windows)**
>
> Learn about curl and bsdtar, two new command-line tools that are now supported in Windows.