Working draft

F32 checksum-leading-space

A checksum padded with spaces rather than zeros, as Perl's Archive::Tar writes it.

Tolerate(draft) A strict parser may reject this archive. If it accepts it, it must extract the tree below.

Category
framing
Default policy
accepts number.chksum.leading-space: octal padded with spaces, not zeros, which implementations read alike
Files
F32-checksum-leading-space.tar test archive, 2,048 bytes sha256 5bee83e4eabec288a7f5b153b5256d93b8ffac6f971d6c39764534251a33df57
F32-checksum-leading-space.jsonexpected result
F32-checksum-leading-space.txtannotated blocks
F32-checksum-leading-space.pygenerator script

The case

F01 pads numeric fields with spaces but writes the checksum as usual. Real tarballs that pad with spaces pad the checksum too: Archive::Tar writes it as %6o\0 , which is a space, five octal digits, a NUL and a space for the sums of real headers (" 13312\0 "), and the size as spaces, the digits and a NUL. The sum is the same as that of any other header, so an implementation that accepts the archive must extract a, also one that checks the checksum before the other fields.

The tree to extract:

pathkindcontents
afile13 bytes, sha256 184294b2

Decision point: whether the checksum field may start with a space.

Seen in: 819 release tarballs, 674 of them from CPAN, such as Starman 0.4015, and PyPDF2 1.26.0, which Spack fetches from PyPI: every tarball whose numeric fields are padded with spaces, the same as F01.

The archive

Every block of 512 bytes, to scale, with its offset. Hover over a field for its bytes.

F32-checksum-leading-space: every block of the archive0x000000header: regular file, the size and the checksum padded with spacesname [0,100): "a" + 99 NULnamemode [100,108): "0000644" + NUL, 644 (octal)uid [108,116): "0000000" + NUL, 0gid [116,124): "0000000" + NUL, 0size [124,136): " 15" + NULmtime [136,148): "00000000000" + NUL, 0chksum [148,156): " 10672\0 ", 4538: the unsigned sum, padded with spaces, as Perl's Archive::Tar writes ittypeflag [156,157): "0", regular filelinkname [157,257): 100 NULlinknamemagic [257,263): "ustar" + NULversion [263,265): "00"uname [265,297): "perl" + 28 NULunamegname [297,329): "perl" + 28 NULgnamedevmajor [329,337): "0000000" + NUL, 0devminor [337,345): "0000000" + NUL, 0prefix [345,500): 155 NULprefixpad [500,512): 12 NULname "a" + 99 NULsize " 15" + NULchksum " 10672\0 "uname "perl" + 28 NULgname "perl" + 28 NUL0x000200data13 bytes, then 499 NUL to the end of the block; "Archive::Tar\n""Archive::Tar\n"0x0004002 zero blocks: the end-of-archive markerbytes 0 to 512 of 1024: 512 NUL0x0006002 zero blocks, continuedbytes 512 to 1024 of 1024: 512 NUL0x000800end of fileNULprintable ASCIIspacecontrol character, such as a newlinebyte over 0x7fwritten by the case itself
Every block, as text 
F32-checksum-leading-space: tolerated: a strict parser may reject it; if it accepts it, it must extract its tree, and the default policy accepts it

A checksum padded with spaces rather than zeros, as Perl's `Archive::Tar` writes it.

F01 pads numeric fields with spaces but writes the checksum as usual. Real tarballs that pad with
spaces pad the checksum too: `Archive::Tar` writes it as `%6o\0 `, which is a space, five octal
digits, a NUL and a space for the sums of real headers (`" 13312\0 "`), and the size as spaces,
the digits and a NUL. The sum is the same as that of any other header, so an implementation that
accepts the archive must extract `a`, also one that checks the checksum before the other fields.

Decision point: whether the checksum field may start with a space.
Seen in: 819 release tarballs, 674 of them from CPAN, such as Starman 0.4015, and PyPDF2 1.26.0,
which Spack fetches from PyPI: every tarball whose numeric fields are padded with spaces, the same
as F01.

0x000000  header: regular file, the size and the checksum padded with spaces
          name     [  0,100)  "a" + 99 NUL
          mode     [100,108)  "0000644" + NUL  644 (octal)
          uid      [108,116)  "0000000" + NUL  0
          gid      [116,124)  "0000000" + NUL  0
          size     [124,136)  "         15" + NUL
          mtime    [136,148)  "00000000000" + NUL  0
          chksum   [148,156)  " 10672\0 "  4538: the unsigned sum, padded with spaces, as Perl's Archive::Tar writes it
          typeflag [156,157)  "0"  regular file
          linkname [157,257)  100 NUL
          magic    [257,263)  "ustar" + NUL
          version  [263,265)  "00"
          uname    [265,297)  "perl" + 28 NUL
          gname    [297,329)  "perl" + 28 NUL
          devmajor [329,337)  "0000000" + NUL  0
          devminor [337,345)  "0000000" + NUL  0
          prefix   [345,500)  155 NUL
          pad      [500,512)  12 NUL
0x000200  data
          13 bytes, then 499 NUL to the end of the block
          "Archive::Tar\n"
0x000400  2 zero blocks: the end-of-archive marker
0x000800  end of file
Every byte, as a hex dump

As xxd writes it: xxd -r makes the archive of it.

00000000: 6100 0000 0000 0000 0000 0000 0000 0000  a...............
00000010: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000060: 0000 0000 3030 3030 3634 3400 3030 3030  ....0000644.0000
00000070: 3030 3000 3030 3030 3030 3000 2020 2020  000.0000000.    
00000080: 2020 2020 2031 3500 3030 3030 3030 3030       15.00000000
00000090: 3030 3000 2031 3036 3732 0020 3000 0000  000. 10672. 0...
000000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000100: 0075 7374 6172 0030 3070 6572 6c00 0000  .ustar.00perl...
00000110: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000120: 0000 0000 0000 0000 0070 6572 6c00 0000  .........perl...
00000130: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000140: 0000 0000 0000 0000 0030 3030 3030 3030  .........0000000
00000150: 0030 3030 3030 3030 0000 0000 0000 0000  .0000000........
00000160: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000170: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000180: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000190: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000200: 4172 6368 6976 653a 3a54 6172 0a00 0000  Archive::Tar....
00000210: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000220: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000230: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000240: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000250: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000260: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000270: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000280: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000290: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000300: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000310: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000320: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000330: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000340: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000350: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000360: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000370: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000380: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000390: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000400: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000410: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000420: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000430: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000440: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000450: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000460: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000470: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000480: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000490: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000500: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000510: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000520: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000530: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000540: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000550: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000560: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000570: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000580: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000590: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000600: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000610: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000620: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000630: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000640: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000650: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000660: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000670: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000680: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000690: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000700: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000710: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000720: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000730: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000740: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000750: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000760: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000770: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000780: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000790: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................

What implementations make of it

implementationversionoutcomewhat it makes of it
GNU tartar (GNU tar) 1.35➕ acceptsthe tree of the case
bsdtarbsdtar 3.8.10 - libarchive 3.8.10➕ acceptsthe tree of the case
BusyBox tarBusyBox v1.38.0, defconfig➕ acceptsthe tree of the case
7-Zip7-Zip (z) 26.05 (x64)➕ acceptsthe tree of the case
Python tarfile, filter=data, as in pipCPython 3.15.2➕ acceptsthe tree of the case
Python tarfile, filter=tarCPython 3.15.2➕ acceptsthe tree of the case
Python tarfile, filter=fully_trustedCPython 3.15.2➕ acceptsthe tree of the case
node-tartar 7.5.22➕ acceptsthe tree of the case
node-tar, stricttar 7.5.22➕ acceptsthe tree of the case
tar-fstar-fs 3.1.3, on tar-stream 3.2.2➕ acceptsthe tree of the case
Java Commons CompressCommons Compress 1.28.0, Expander, on Java 27.0.1.0.2➕ acceptsthe tree of the case
.NET System.Formats.TarSystem.Formats.Tar of .NET 10.0.14, ExtractToDirectory➕ acceptsthe tree of the case
PHP PharData, as in ComposerPharData of PHP 8.5.12, as Composer's TarDownloader calls it➕ acceptsthe tree of the case
Go containerd archive.Applycontainerd v2.4.2, archive.Apply, of go1.27.3➕ acceptsthe tree of the case
Rust tartar 0.4.46, unpack➕ acceptsthe tree of the case
Rust astral-tokio-tarastral-tokio-tar 0.7.0, unpack➕ acceptsthe tree of the case
Rust tar-codec, as in uvtar-codec 0.0.15, with the policies of uv 0.13➖ rejectserror: at byte 0: invalid tar checksum: stored None, computed 4538
RubyGemsRubyGems 4.0.20 of Ruby 4.0.9, extract_tar_gz➕ acceptsthe tree of the case
R untar, internalutils::untar of R 4.6.1, tar = "internal"➕ acceptsthe tree of the case
Perl Archive::TarArchive::Tar 3.12 of Perl v5.44.0➕ acceptsthe tree of the case
Haskell tartar 0.7.2.0, extract, of GHC 9.14➕ acceptsthe tree of the case
Julia Tar.jlTar 1.10.0 of Julia 1.13.3➕ acceptsthe tree of the case
live-bootstrap untarmescc-tools-extra a151c245e512, as live-bootstrap pins it, built with cc➕ acceptsthe tree of the case
live-bootstrap untar, --non-strictmescc-tools-extra a151c245e512, as live-bootstrap pins it, built with cc➕ acceptsthe tree of the case

Prevalence in release tarballs

Release tarballs of Spack, nixpkgs, Guix and live-bootstrap, and samples of PyPI, crates.io and RubyGems with number.chksum.leading-space. The default policy accepts them.

ecosystemtarballswith itshare
Spack37,5531960.52%
nixpkgs18,9905452.87%
Guix10,1682722.68%
PyPI10,0000none
crates.io5,0000none
RubyGems5,0000none
live-bootstrap17184.68%
total (distinct)82,5868190.99%

See a sample of these 819 tarballs, with the sha256 of each and an example from it.