Working draft

F14 pax-size-disagrees

A pax size that disagrees with the header's, so that a reader of the header's misses a member.

Tolerate(draft) A strict parser may reject this archive. If it accepts it, it must extract the tree below.

Category
framing
Default policy
accepts pax.size-disagrees: the pax size frames the member, as POSIX says: it is how sizes over 8 GiB are written
Files
F14-pax-size-disagrees.tar test archive, 3,072 bytes sha256 b175fc7f7d9961acf5b9b4d2d02e802fb4ec363ced3487cb7194798021854640
F14-pax-size-disagrees.jsonexpected result
F14-pax-size-disagrees.txtannotated blocks
F14-pax-size-disagrees.pygenerator script

The case

The size field in the header of a is 512, and its pax extended header has size=0. POSIX says that the pax size overrides the header's: it is how sizes over 8 GiB, which do not fit in the header's size field, are written, and archivers write various sizes in the header then. An implementation that takes the pax size, as it must, reads the next block as the header of another file, smuggled; an implementation that takes the header's size, or does not know pax, reads that block as the data of a. An implementation that takes the header's size is the bug of CVE-2025-62518 (astral-tokio-tar before 0.5.6, and tokio-tar). A strict parser may reject a header whose size field has room for the size but gives another, but must not extract a with 512 bytes.

The tree to extract:

pathkindcontents
afile0 bytes, sha256 e3b0c442
smuggledfile0 bytes, sha256 e3b0c442

Decision point: which of two sizes frames the member.

Seen in: none of the scanned tarballs.

The archive

Every block of 512 bytes, to scale, with its offset. Hover over a field for its bytes.

F14-pax-size-disagrees: every block of the archive0x000000header: pax extended header, size=0, for aname [0,100): "PaxHeader" + 91 NULnamemode [100,108): "0000644" + NUL, 644 (octal)uid [108,116): "0000000" + NUL, 0gid [116,124): "0000000" + NUL, 0size [124,136): "00000000011" + NUL, 9mtime [136,148): "00000000000" + NUL, 0chksum [148,156): "011071\0 ", 4665: the unsigned sum of the header, this field as spacestypeflag [156,157): "x", pax extended headerlinkname [157,257): 100 NULlinknamemagic [257,263): "ustar" + NULversion [263,265): "00"uname [265,297): 32 NULunamegname [297,329): 32 NULgnamedevmajor [329,337): "0000000" + NUL, 0devminor [337,345): "0000000" + NUL, 0prefix [345,500): 155 NULprefixpad [500,512): 12 NULname "PaxHeader" + 91 NUL0x000200data: pax records9 bytes of pax records, then 503 NUL; "9 size=0\n""9 size=0\n"0x000400header: regular file, size 512name [0,100): "a" + 99 NULnamemode [100,108): "0000644" + NUL, 644 (octal)uid [108,116): "0000000" + NUL, 0gid [116,124): "0000000" + NUL, 0size [124,136): "00000001000" + NUL, 512mtime [136,148): "00000000000" + NUL, 0chksum [148,156): "007337\0 ", 3807: the unsigned sum of the header, this field as spacestypeflag [156,157): "0", regular filelinkname [157,257): 100 NULlinknamemagic [257,263): "ustar" + NULversion [263,265): "00"uname [265,297): 32 NULunamegname [297,329): 32 NULgnamedevmajor [329,337): "0000000" + NUL, 0devminor [337,345): "0000000" + NUL, 0prefix [345,500): 155 NULprefixpad [500,512): 12 NULname "a" + 99 NUL0x000600header: regular file, the data of a, to an implementation that takes the header's sizename [0,100): "smuggled" + 92 NULnamemode [100,108): "0000644" + NUL, 644 (octal)uid [108,116): "0000000" + NUL, 0gid [116,124): "0000000" + NUL, 0size [124,136): "00000000000" + NUL, 0mtime [136,148): "00000000000" + NUL, 0chksum [148,156): "010725\0 ", 4565: the unsigned sum of the header, this field as spacestypeflag [156,157): "0", regular filelinkname [157,257): 100 NULlinknamemagic [257,263): "ustar" + NULversion [263,265): "00"uname [265,297): 32 NULunamegname [297,329): 32 NULgnamedevmajor [329,337): "0000000" + NUL, 0devminor [337,345): "0000000" + NUL, 0prefix [345,500): 155 NULprefixpad [500,512): 12 NULname "smuggled" + 92 NUL0x0008002 zero blocks: the end-of-archive markerbytes 0 to 512 of 1024: 512 NUL0x000a002 zero blocks, continuedbytes 512 to 1024 of 1024: 512 NUL0x000c00end of fileNULprintable ASCIIspacecontrol character, such as a newlinebyte over 0x7fwritten by the case itself
Every block, as text 
F14-pax-size-disagrees: tolerated: a strict parser may reject it; if it accepts it, it must extract its tree, and the default policy accepts it

A pax `size` that disagrees with the header's, so that a reader of the header's misses a member.

The size field in the header of `a` is 512, and its pax extended header has `size=0`. POSIX says
that the pax size overrides the header's: it is how sizes over 8 GiB, which do not fit in the
header's size field, are written, and archivers write various sizes in the header then. An
implementation that takes the pax size, as it must, reads the next block as the header of another
file, `smuggled`; an implementation that takes the header's size, or does not know pax, reads that
block as the data of `a`. An implementation that takes the header's size is the bug of
CVE-2025-62518 (astral-tokio-tar before 0.5.6, and tokio-tar). A strict parser may reject a header
whose size field has room for the size but gives another, but must not extract `a` with 512 bytes.

Decision point: which of two sizes frames the member.
Seen in: none of the scanned tarballs.

0x000000  header: pax extended header, size=0, for a
          name     [  0,100)  "PaxHeader" + 91 NUL
          mode     [100,108)  "0000644" + NUL  644 (octal)
          uid      [108,116)  "0000000" + NUL  0
          gid      [116,124)  "0000000" + NUL  0
          size     [124,136)  "00000000011" + NUL  9
          mtime    [136,148)  "00000000000" + NUL  0
          chksum   [148,156)  "011071\0 "  4665: the unsigned sum of the header, this field as spaces
          typeflag [156,157)  "x"  pax extended header
          linkname [157,257)  100 NUL
          magic    [257,263)  "ustar" + NUL
          version  [263,265)  "00"
          uname    [265,297)  32 NUL
          gname    [297,329)  32 NUL
          devmajor [329,337)  "0000000" + NUL  0
          devminor [337,345)  "0000000" + NUL  0
          prefix   [345,500)  155 NUL
          pad      [500,512)  12 NUL
0x000200  data: pax records
          9 bytes of pax records, then 503 NUL
          "9 size=0\n"
0x000400  header: regular file, size 512
          name     [  0,100)  "a" + 99 NUL
          mode     [100,108)  "0000644" + NUL  644 (octal)
          uid      [108,116)  "0000000" + NUL  0
          gid      [116,124)  "0000000" + NUL  0
          size     [124,136)  "00000001000" + NUL  512
          mtime    [136,148)  "00000000000" + NUL  0
          chksum   [148,156)  "007337\0 "  3807: the unsigned sum of the header, this field as spaces
          typeflag [156,157)  "0"  regular file
          linkname [157,257)  100 NUL
          magic    [257,263)  "ustar" + NUL
          version  [263,265)  "00"
          uname    [265,297)  32 NUL
          gname    [297,329)  32 NUL
          devmajor [329,337)  "0000000" + NUL  0
          devminor [337,345)  "0000000" + NUL  0
          prefix   [345,500)  155 NUL
          pad      [500,512)  12 NUL
0x000600  header: regular file, the data of a, to an implementation that takes the header's size
          name     [  0,100)  "smuggled" + 92 NUL
          mode     [100,108)  "0000644" + NUL  644 (octal)
          uid      [108,116)  "0000000" + NUL  0
          gid      [116,124)  "0000000" + NUL  0
          size     [124,136)  "00000000000" + NUL  0
          mtime    [136,148)  "00000000000" + NUL  0
          chksum   [148,156)  "010725\0 "  4565: the unsigned sum of the header, this field as spaces
          typeflag [156,157)  "0"  regular file
          linkname [157,257)  100 NUL
          magic    [257,263)  "ustar" + NUL
          version  [263,265)  "00"
          uname    [265,297)  32 NUL
          gname    [297,329)  32 NUL
          devmajor [329,337)  "0000000" + NUL  0
          devminor [337,345)  "0000000" + NUL  0
          prefix   [345,500)  155 NUL
          pad      [500,512)  12 NUL
0x000800  2 zero blocks: the end-of-archive marker
0x000c00  end of file
Every byte, as a hex dump

As xxd writes it: xxd -r makes the archive of it.

00000000: 5061 7848 6561 6465 7200 0000 0000 0000  PaxHeader.......
00000010: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000060: 0000 0000 3030 3030 3634 3400 3030 3030  ....0000644.0000
00000070: 3030 3000 3030 3030 3030 3000 3030 3030  000.0000000.0000
00000080: 3030 3030 3031 3100 3030 3030 3030 3030  0000011.00000000
00000090: 3030 3000 3031 3130 3731 0020 7800 0000  000.011071. x...
000000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000100: 0075 7374 6172 0030 3000 0000 0000 0000  .ustar.00.......
00000110: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000120: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000130: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000140: 0000 0000 0000 0000 0030 3030 3030 3030  .........0000000
00000150: 0030 3030 3030 3030 0000 0000 0000 0000  .0000000........
00000160: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000170: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000180: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000190: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000200: 3920 7369 7a65 3d30 0a00 0000 0000 0000  9 size=0........
00000210: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000220: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000230: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000240: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000250: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000260: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000270: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000280: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000290: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000300: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000310: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000320: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000330: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000340: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000350: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000360: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000370: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000380: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000390: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000400: 6100 0000 0000 0000 0000 0000 0000 0000  a...............
00000410: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000420: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000430: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000440: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000450: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000460: 0000 0000 3030 3030 3634 3400 3030 3030  ....0000644.0000
00000470: 3030 3000 3030 3030 3030 3000 3030 3030  000.0000000.0000
00000480: 3030 3031 3030 3000 3030 3030 3030 3030  0001000.00000000
00000490: 3030 3000 3030 3733 3337 0020 3000 0000  000.007337. 0...
000004a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000500: 0075 7374 6172 0030 3000 0000 0000 0000  .ustar.00.......
00000510: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000520: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000530: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000540: 0000 0000 0000 0000 0030 3030 3030 3030  .........0000000
00000550: 0030 3030 3030 3030 0000 0000 0000 0000  .0000000........
00000560: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000570: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000580: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000590: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000600: 736d 7567 676c 6564 0000 0000 0000 0000  smuggled........
00000610: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000620: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000630: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000640: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000650: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000660: 0000 0000 3030 3030 3634 3400 3030 3030  ....0000644.0000
00000670: 3030 3000 3030 3030 3030 3000 3030 3030  000.0000000.0000
00000680: 3030 3030 3030 3000 3030 3030 3030 3030  0000000.00000000
00000690: 3030 3000 3031 3037 3235 0020 3000 0000  000.010725. 0...
000006a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000700: 0075 7374 6172 0030 3000 0000 0000 0000  .ustar.00.......
00000710: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000720: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000730: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000740: 0000 0000 0000 0000 0030 3030 3030 3030  .........0000000
00000750: 0030 3030 3030 3030 0000 0000 0000 0000  .0000000........
00000760: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000770: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000780: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000790: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000800: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000810: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000820: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000830: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000840: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000850: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000860: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000870: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000880: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000890: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000900: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000910: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000920: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000930: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000940: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000950: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000960: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000970: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000980: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000990: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a00: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a10: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a20: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a30: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a40: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a50: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a60: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a70: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a80: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a90: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000aa0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ab0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ac0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ad0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ae0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000af0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b00: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b10: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b20: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b30: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b40: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b50: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b60: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b70: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b80: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b90: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ba0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000bb0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000bc0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000bd0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000be0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000bf0: 0000 0000 0000 0000 0000 0000 0000 0000  ................

What implementations make of it

implementationversionoutcomewhat it makes of it
GNU tartar (GNU tar) 1.35➕ acceptsthe tree of the case
bsdtarbsdtar 3.8.10 - libarchive 3.8.10➕ acceptsthe tree of the case
BusyBox tarBusyBox v1.38.0, defconfig❌ another tree, or rejectstree A: a (512 B, 917dba8e)
7-Zip7-Zip (z) 26.05 (x64)➕ acceptsthe tree of the case
Python tarfile, filter=data, as in pipCPython 3.15.2➕ acceptsthe tree of the case
Python tarfile, filter=tarCPython 3.15.2➕ acceptsthe tree of the case
Python tarfile, filter=fully_trustedCPython 3.15.2➕ acceptsthe tree of the case
node-tartar 7.5.22➕ acceptsthe tree of the case
node-tar, stricttar 7.5.22➕ acceptsthe tree of the case
tar-fstar-fs 3.1.3, on tar-stream 3.2.2➕ acceptsthe tree of the case
Java Commons CompressCommons Compress 1.28.0, Expander, on Java 27.0.1.0.2➕ acceptsthe tree of the case
.NET System.Formats.TarSystem.Formats.Tar of .NET 10.0.14, ExtractToDirectory➕ acceptsthe tree of the case
PHP PharData, as in ComposerPharData of PHP 8.5.12, as Composer's TarDownloader calls it❌ another tree, or rejectstree A: a (512 B, 917dba8e)
Go containerd archive.Applycontainerd v2.4.2, archive.Apply, of go1.27.3➕ acceptsthe tree of the case
Rust tartar 0.4.46, unpack➕ acceptsthe tree of the case
Rust astral-tokio-tarastral-tokio-tar 0.7.0, unpack➕ acceptsthe tree of the case
Rust tar-codec, as in uvtar-codec 0.0.15, with the policies of uv 0.13➕ acceptsthe tree of the case
RubyGemsRubyGems 4.0.20 of Ruby 4.0.9, extract_tar_gz❌ another tree, or rejectstree A: a (512 B, 917dba8e)
R untar, internalutils::untar of R 4.6.1, tar = "internal"➕ acceptsthe tree of the case
Perl Archive::TarArchive::Tar 3.12 of Perl v5.44.0❌ another tree, or rejectstree A: a (512 B, 917dba8e)
Haskell tartar 0.7.2.0, extract, of GHC 9.14❌ another tree, or rejectstree A: a (512 B, 917dba8e)
Julia Tar.jlTar 1.10.0 of Julia 1.13.3➕ acceptsthe tree of the case
live-bootstrap untarmescc-tools-extra a151c245e512, as live-bootstrap pins it, built with cc❌ another tree, or rejectstree B: PaxHeader (9 B, 33638443), a (512 B, 917dba8e)
live-bootstrap untar, --non-strictmescc-tools-extra a151c245e512, as live-bootstrap pins it, built with cc❌ another tree, or rejectstree B: PaxHeader (9 B, 33638443), a (512 B, 917dba8e)

Prevalence in release tarballs

Release tarballs of Spack, nixpkgs, Guix and live-bootstrap, and samples of PyPI, crates.io and RubyGems with pax.size-disagrees.

ecosystemtarballswith itshare
Spack37,5530none
nixpkgs18,9900none
Guix10,1680none
PyPI10,0000none
crates.io5,0000none
RubyGems5,0000none
live-bootstrap1710none
total (distinct)82,5860none