File Roller shouldn't be preinstalled on Silverblue (35+) as the functionality is provided by Nautilus. I will actually drop the File Roller Flatpak from Silverblue (on new installations for F36+) with https://pagure.io/pungi-fedora/pull-request/1062

Thanks for looking at this.
So with Files(nautilus) might actually provide even worse user experience. Not only it's unable to open or extract single file, it will start the extract automatically to the same folder after double clicking.

I will create feature request on nautilus repo but not having file-roller on F36 might confuse quite a few people.

adding @oholy and @feborges for awareness

Looks like nautilus is not planning on implementing these extra features and it's not opened for debate https://discourse.gnome.org/t/opening-an-archive-as-a-folder-in-nautilus/3135/2 .

I'm currently layering file-roller for these features (including ability to open rar files) as I would often find myself in a situation where I would download large zip and after browsing it without extracting I decide to only extract single file or no files at all. Nautilus just makes that experience a bit messy as it will not even warn you about extraction, it will just start extracting to the same path where zip is located.

@tpopela should it not be considered a security risk when Gnome Files will just extract files from archive to your current directory when you double click on archive downloaded to your HOME directory ?

If there is anything malicious in the archive it has a potential to just dump binaries to your dotfiles and user will never know anything happened.

I personally don't see it as a security risk, but my opinion is irrelevant here. You will have to ask upstream or wait for @oholy (as one of the main upstream maintainers) or @csoriano (as an ex upstream maintainer) to reply here.

The archive is extracted to a new folder whose name is derived from the archive name. So the archive would have to have a name e.g. ".local.zip". But the folder name has to be unique, so the archive with such a name won't be extracted to ".local" if it already exists, but to ".local (1)" instead. I would say that crucial folders like ".local" always exist. The extraction begins after a user clicks on that archive and also, the folder with the extracted archive is selected when done and/or notification is shown, so a user should really know that something happened, or is happening. I don't see this as a security issue, but ok, perhaps some notification could be shown for archives with a leading dot or the destination folder could be always without the dot... please file an upstream issue if you are interested in it.

I see. Thanks for clarification.
I just realised it will not dump files to existing folders so only things like archives called bin.zip or .ssh.zip would be a risk if those folders are not created ( which are not by default in most systems).

I'll have a look at creating issue in upstream to create a warning on extraction, especially for anything with the dot at the beginning of the archive as user will not be aware of any extraction if they don't choose to see hidden files and folders in nautilus.

If I am not mistaken, a newly created hidden file is shown regardless of the visibility of the hidden files. But to start the extraction of the hidden archive you have to toggle the visibility of the hidden files anyway, or what is the way you start the extraction?

For example bin.zip downloaded from the web using browser to HOME and clicking open from the browser will dump anything on $HOME/bin/ which is in default path on F35 and there is no warning about things being extracted ( it all happens in the background) . I guess this is not a big security risk after all because not many people would download to HOME and run things this way.

• correction.
  When ran directly from browser there is a small notification saying "Home is ready"

If Nautilus is not running, it opens with a selected folder with the content of the extracted archive or shows a notification in case the extraction is not yet done. The "Home is ready" notification is shown as Nautilus is already running. But I suppose the same would happen with File Roller if it would be already opened and set as the default application for archives. I am not saying it is ideal, but it is how gnome-shell works currently.

I wonder what browser are you using? It seems that Firefox doesn't allow to download something which begins with a dot, respective removes the dot even if it is explicitly specified in the File Chooser dialog. This makes me think that it is probably a good idea to automatically remove the dot from the destination folder in case of extraction...

Ok, Chrome allows it, but only if it is explicitly specified and in that case, the hidden file is not really selected in Nautilus if hidden files are not shown...

Yes you're right. I guess it's not that big of an issue.
IMO it would be better if double clicking would just extract it to some random tmp location and open that location after extraction or open simple extraction dialog but that's just my opinion and it's obviously up to the upstream to look into that.

Thanks for checking it out.