Force rctx.{download_and,}extract to create user-readable files

[fmeum]

Archives in the wild do sometimes contain non-readable files, but other tools work around this and thus mask their brokenness.

Context: https://bazelbuild.slack.com/archives/CDCMRLS23/p1770213515354229

In the wild example: https://pypi.org/project/ag-ui-adk/#ag_ui_adk-0.4.2-py3-none-any.whl

[fmeum]

@bazel-io fork 9.1.0

[fmeum]

@bazel-io fork 8.6.0

[gemini-code-assist]

Code Review

This pull request correctly ensures that files extracted from archives are at least user-readable by adding the 0400 permission bit. The changes are consistently applied across ar, tar, and zip decompressors. The accompanying tests are thorough and validate the new behavior for each archive type. I've included one suggestion to refactor the new tests to reduce code duplication and improve maintainability.

[Copilot]

Pull request overview

This PR ensures that files extracted from archives (tar, zip, and ar) are always user-readable, even if the archive contains files with no read permissions. This addresses a real-world issue where some archives contain non-readable files, but other tools work around this and mask the problem.

Changes:

• Modified three decompressor implementations to force user-readable permissions (0400 bit) on extracted files
• Added integration tests for tar.gz, zip, and ar archives with non-readable files

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
src/main/java/com/google/devtools/build/lib/bazel/repository/decompressor/ZipDecompressor.java	Added bitwise OR with 0400 to ensure extracted files have user-read permission
src/main/java/com/google/devtools/build/lib/bazel/repository/decompressor/CompressedTarFunction.java	Added bitwise OR with 0400 to ensure extracted tar files have user-read permission
src/main/java/com/google/devtools/build/lib/bazel/repository/decompressor/ArFunction.java	Added bitwise OR with 0400 to ensure extracted ar files have user-read permission
src/test/shell/bazel/starlark_repository_test.sh	Added three test functions that verify files with 0o000 permissions can be read after extraction

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[aignas]

Related:

• (pipstar) Wheel install fails when wheel has bogus permissions bazel-contrib/rules_python#3554
• fix(pip): add read permissions when extracting wheels bazel-contrib/rules_python#3555
• Evaluate the best extraction method for repository rules bazel-contrib/rules_python#3562

[fmeum]

@bazel-io fork 9.0.1