fix: remove ~48 transitive dependencies from asset packaging (#1654)

Whenever the CDK Toolkit packages file assets — Lambda function code, S3
file assets and the like — it builds a ZIP archive. That work was
previously done by `archiver`, a dependency that brings roughly fifty
transitive packages along with it into every install of the CDK CLI and
`@aws-cdk/toolkit-lib`. This pull request replaces it with `yazl`, a
focused, write-only ZIP library, which brings the footprint for this
functionality down to just two packages (`yazl` and `buffer-crc32`).

The reason for the change is customer experience. A smaller dependency
graph means a faster `npm install` and a lighter footprint on disk and
in CI for everyone who installs the CLI or builds on the toolkit
library. It also shrinks the set of third-party code that has to be
audited and patched when security advisories are published, which is a
recurring cost for our users. Because the CDK only ever *creates*
archives and never parses untrusted ones, a write-only library is all we
need, so this also drops a large amount of reader and format-handling
code that was never exercised in our use case.

Asset packaging gets a little faster as a side effect. Both libraries
hand compression to Node's native zlib, and in local benchmarks across
representative asset trees `yazl` produced archives 8–11% faster than
`archiver` at comparable memory use. The existing streaming behaviour is
kept, so large assets are still written to disk without buffering the
whole archive in memory.

The change is otherwise invisible to users. Archives stay byte-for-byte
deterministic — entry timestamps remain pinned to the 1980 epoch, so
identical content continues to produce an identical hash — Unix file
modes such as the executable bit are still preserved, and symbolic links
are still followed. The existing unit tests for the zip tool pass
unchanged.

A full benchmark and security report is attached as a separate comment
on this PR.

### Checklist
- [ ] This change contains a major version upgrade for a dependency and
I confirm all breaking changes are addressed
  - Release notes for the new version:

---
By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license

---------

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: mrgrain

.projenrc.ts

@@ -716,8 +716,8 @@ const tools = defineTools({
   parent: repo,
   tools: {
     zip: {
-      deps: ['archiver@^7.0.1', 'fast-glob@^3.3.3'],
-      devDeps: ['@types/archiver', 'jszip'],
+      deps: ['yazl@^3.3.1', 'fast-glob@^3.3.3'],
+      devDeps: ['@types/yazl', 'jszip'],
     },
   },
 });
@@ -1223,7 +1223,7 @@ const cli = configureProject(
     devDeps: [
       yargsGen,
       cliPluginContract,
-      '@types/archiver',
+      '@types/yazl',
       '@types/fs-extra@^11',
       '@types/mockery',
       '@types/picomatch',
@@ -1252,7 +1252,7 @@ const cli = configureProject(
       // Already bundled by the CLI: depend on the private tools package
       // directly (the bundler inlines it and dedupes its transitive deps).
       tools,
-      'archiver',
+      'yazl',
       sdkDep('@aws-sdk/client-appsync'),
       sdkDep('@aws-sdk/client-bedrock-agentcore-control'),
       sdkDep('@aws-sdk/client-cloudformation'),

packages/@aws-cdk/cdk-assets-lib/.projen/deps.json

@@ -1,12 +1,14 @@
 import { createWriteStream, promises as fs } from 'fs';
 import * as path from 'path';
-import { Writable } from 'stream';
 import type { Options } from 'fast-glob';
 import { globSync } from 'fast-glob';
+import { ZipFile } from 'yazl';
 
-// namespace object imports won't work in the bundle for function exports
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const archiver = require('archiver');
+/**
+ * Fixed epoch used for every entry so that equal content yields an equal
+ * zip (deterministic output, stable content hash).
+ */
+const EPOCH = new Date('1980-01-01T00:00:00.000Z');
 
 /**
  * Receives informational messages (e.g. retries on EPERM on Windows).
@@ -49,21 +51,15 @@ export function zipString(fileName: string, rawString: string): Promise<Buffer>
   return new Promise((resolve, reject) => {
     const buffers: Buffer[] = [];
 
-    const converter = new Writable();
-    converter._write = (chunk: Buffer, _: string, callback: () => void) => {
-      buffers.push(chunk);
-      process.nextTick(callback);
-    };
-    converter.on('finish', () => resolve(Buffer.concat(buffers)));
+    const zip = new ZipFile();
+    zip.outputStream.on('data', (chunk: Buffer) => buffers.push(chunk));
+    zip.outputStream.on('error', reject);
+    zip.outputStream.on('end', () => resolve(Buffer.concat(buffers)));
 
-    const archive = archiver('zip');
-    archive.on('error', reject);
-    archive.pipe(converter);
-    archive.append(rawString, {
-      name: fileName,
-      date: new Date('1980-01-01T00:00:00.000Z'),
+    zip.addBuffer(Buffer.from(rawString), fileName, {
+      mtime: EPOCH, // reset date to get the same hash for the same content
     });
-    void archive.finalize();
+    zip.end();
   });
 }
 
@@ -80,33 +76,29 @@ function writeZipFile(directory: string, outputFile: string): Promise<void> {
     };
     const files = globSync('**', globOptions); // The output here is already sorted
 
-    const output = createWriteStream(outputFile);
-
-    const archive = archiver('zip');
-    archive.on('warning', fail);
-    archive.on('error', fail);
+    const zip = new ZipFile();
+    zip.outputStream.on('error', fail);
 
-    // archive has been finalized and the output file descriptor has closed, resolve promise
-    // this has to be done before calling `finalize` since the events may fire immediately after.
-    // see https://www.npmjs.com/package/archiver
+    const output = createWriteStream(outputFile);
+    output.on('error', fail);
+    // resolve once the output file descriptor has closed
     output.once('close', ok);
 
-    archive.pipe(output);
+    zip.outputStream.pipe(output);
 
     // Append files serially to ensure file order
     for (const file of files) {
       const fullPath = path.resolve(directory, file);
       // There are exactly 2 promises
       // eslint-disable-next-line @cdklabs/promiseall-no-unbounded-parallelism
       const [data, stat] = await Promise.all([fs.readFile(fullPath), fs.stat(fullPath)]);
-      archive.append(data, {
-        name: file,
-        date: new Date('1980-01-01T00:00:00.000Z'), // reset dates to get the same hash for the same content
+      zip.addBuffer(data, file, {
+        mtime: EPOCH, // reset dates to get the same hash for the same content
         mode: stat.mode,
       });
     }
 
-    await archive.finalize();
+    zip.end();
   });
 }