When downloading multiple photos as zip, extracted photos files have no read or write permissions

[Qhilm]

The bug

When I download a single photo, no issue.

When selecting multiple photos and downloading, Immich will make a zip file out of it and download it. When unpacking/extracting the zip files, all files in the zip have no read or write permissions somehow.

I tested this with Firefox 124.0.2 and Chrome 123 on macOS 14.4.1, as well as Firefox 124 on Ubuntu 22.04.

The OS that Immich Server is running on

macOS 14.4.1, Ubuntu 22.04

Version of Immich Server

v1.101.0

Version of Immich Mobile App

v1.101

Platform with the issue

• [ ] Server
• [X] Web
• [ ] Mobile

Your docker-compose.yml content

version: '3.8'

#
# WARNING: Make sure to use the docker-compose.yml of the current release:
#
# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
#
# The compose file on main may not be compatible with the latest release.
#

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    command: ['start.sh', 'immich']
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - stack.env
    ports:
      - 2283:3001
    depends_on:
      - redis
      - database
    restart: always

  immich-microservices:
    container_name: immich_microservices
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/hardware-transcoding
    #   file: hwaccel.transcoding.yml
    #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
    command: ['start.sh', 'microservices']
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - stack.env
    depends_on:
      - redis
      - database
    restart: always

  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration
    #   file: hwaccel.ml.yml
    #   service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    volumes:
      - model-cache:/cache
    env_file:
      - stack.env
    restart: always

  redis:
    container_name: immich_redis
    image: registry.hub.docker.com/library/redis:6.2-alpine@sha256:51d6c56749a4243096327e3fb964a48ed92254357108449cb6e23999c37773c5
    restart: always

  database:
    container_name: immich_postgres
    image: registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
    volumes:
      - pgdata:/var/lib/postgresql/data
    restart: always

volumes:
  pgdata:
  model-cache:

Your .env content

UPLOAD_LOCATION=/volume1/Photos/
IMMICH_VERSION=release
DB_PASSWORD=postgres
DB_HOSTNAME=immich_postgres
DB_USERNAME=postgres
DB_DATABASE_NAME=immich
REDIS_HOSTNAME=immich_redis

Reproduction steps

1. Select multiple photos in web interface
2. Click the three dots and click "download"
3. Extract the downloaded zip file
4. permissions of extracted files are "----------" / 000 (no permissions)

Relevant log output

No response

Additional information

No response

[mmomjian]

I am unable to replicate this on Debian. Can you please post the exact commands you used and the permissions of the user as well as the directory you are extracting into? I was under the impression that ZIP files did not store permissions.

Can you also try with a different ZIP file that didn't come from Immich?

[Qhilm]

I will recheck on Ubuntu, I might have mixed up something there, the issue might only exist on macOS.

On macOS, I simply double click the .zip file and it creates a folder with the same name (minus the extension). The folder itself has correct permissions (read and write for my user) but the files inside the folder do not.

I also tried unziping from the cli using unzip immich-20240414_195237.zip and it does not create a folder, puts both files directly in the same path, but it's exactly the same issue, both files have zero permissions.

Finally, I installed another decompression utility, Keka. And low and behold, the issue does not happen.

Hence, it seems it specific to the macOS uncompression utility (or unzip on macOS) and the immich archive. macOS is bundling unzip 6.0, in case that helps.

I do not have this issue with other zip files as far as I know.

[mmomjian]

This seems like a Mac OS problem then? I just opened an Immich ZIP using 7-zip and I see this:

[Qhilm]

I retested on Ubuntu 22.04, I confirm it's exactly the same issue. After extracting the files, they have zero permissions. No read permissions, no write permissions.

I also tested using unzip on the CLI, same results, files are extracted, owner is my user, but there are no permissions, neither for user, group or everyone: ls output shows "----------" for permissions.

[alextran1502]

Perhaps something is off with your storage permission at UPLOAD_LOCATION

This is the permission after I download the file from a local immich instance hosted on MacOS and has the UPLOAD_LOCATION point to the local storage on the mac