Support zstd-compressed package archives: CRAN's current macOS binaries fail with "unknown archive type" #485

Request

Please recognize zstd-compressed tarballs in detect_package_archive_type().
CRAN's macOS builder has started compressing .tgz binaries with zstd, and pkgdepends rejects those archives before extraction, so pak cannot install affected packages on macOS at all.

I searched the pkgdepends and pak issues, pull requests and commit history for zstd, unknown archive type, and macOS binary compression, and found no existing report or pending fix.

Discovery context

A package's GitHub Actions matrix started failing on 2026-09-20 in the macOS job, during dependency installation, while the commit under test changed only documentation. Linux and Windows passed on the same commit, and the same macOS job had passed on the previous commit the day before:

✔ Got knitr 1.52 (aarch64-apple-darwin23) (992.43 kB)
Error:
! error in pak subprocess
Caused by error in `make_install_process(filename, lib = lib, metadata = metadata)`:
! Cannot extract
'/var/folders/.../bin/macosx/sonoma-arm64/contrib/4.6/knitr_1.52.tgz',
unknown archive type.

Full log: https://github.com/RGenomicsETL/CanardAbsurd/actions/runs/35490731798/job/106025966856

The reported 992.43 kB did not match the 1,077,421 bytes the same file has on Posit Package Manager, which first looked like a truncated download.

Clearing the runner caches and re-running three times reproduced it exactly, and fetching CRAN's copy directly showed the difference is the compression format, not a corrupt transfer.

Reproduction

This needs no macOS runner; the detection is pure R. On Linux, R 4.6.0,
pkgdepends 0.9.1:

url <- "https://cloud.r-project.org/bin/macosx/sonoma-arm64/contrib/4.6/knitr_1.52.tgz"
download.file(url, f <- tempfile(fileext = ".tgz"), mode = "wb")

readBin(f, "raw", 4)
#> [1] 28 b5 2f fd                      # zstd magic

untar(f, list = TRUE)[1:3]
#> [1] "knitr/" "knitr/CITATION" "knitr/misc/"    # base R reads it

pkgdepends:::detect_package_archive_type(f)
#> [1] "unknown"

untar() lists the archive with both tar = "internal" and the external tar,
so R itself handles these files.

What CRAN now serves

Sampled from bin/macosx/sonoma-arm64/contrib/4.6/ on cloud.r-project.org:

Recently built packages are zstd and older ones are still gzip, so this should
spread as CRAN rebuilds. Posit Package Manager still publishes gzip builds of
the same versions (knitr_1.52.tgz is 1,077,421 bytes there), which is why the
failure depends on which repository a runner resolves.

Where it fails

detect_package_archive_type() in R/install-tar.R tests only gzip, zip,
bzip2 and xz magic bytes and returns "unknown" otherwise. R/install-binary.R
then throws install_input_error rather than extracting.

Suggested direction

Detecting the zstd magic 28 b5 2f fd looks sufficient for the tar path: the
compression-flag helper already returns no flag for types it does not name, and
macOS tar is bsdtar/libarchive, which detects compression itself. GNU tar
would need --zstd, and a build of tar without zstd support would still fail,
so the error may be worth keeping for that case. I have not written or tested a
patch.

Workaround, for anyone hitting this in CI

r-lib/actions/setup-r routes macOS through Posit Package Manager only for a
fixed list of repository owners unless use-public-rspm: always is set. Setting
it restores gzip binaries and made our matrix green again. That depends on Posit
Package Manager keeping gzip, so it is a stopgap rather than a fix.

Environment

• Failure: GitHub Actions macos-latest (macOS Tahoe 26.6.2), aarch64-apple-darwin23,
  R 4.6.1 (2026-06-24), pak 0.11.1 via r-lib/actions/setup-r-dependencies.
• Reproduction above: Linux x86_64, R 4.6.0 (2026-04-24), pkgdepends 0.9.1.

Limits

I have not established when CRAN changed compression or which builder made the
change, and I sampled five packages rather than surveying the repository.
Windows binaries are .zip and source installs are unaffected. I have not
checked whether other consumers of these archives, such as renv or
install.packages() with a custom method, are affected.

Prepared with Claude Opus 5 in Claude Code.