Technology1 min read

The Hardest Tarball?

By · Published by Everything Blog

In short

The archive leverages an overridden size attribute on a hard link alongside an empty file, confusing parsers about whether the trailing bytes represent link content or the next entry's header. While implementations like GNU tar, Python, and Go handle the structure normally, others overwrite files, omit entries entirely, or fail with decoding errors. In extreme cases, environments such as .NET, Julia, and uv crash or refuse to process the archive at all. The demonstration is part of tar-minefield, a larger testing repository cataloging 134 edge-case archives to benchmark parsing behaviors.

Key points

  • Archive parsing rules vary drastically across platforms when processing ambiguous metadat…: Archive parsing rules vary drastically across platforms when processing ambiguous metadata or non-standard file headers.
  • Developers cannot assume consistent archive extraction across languages, as some runtimes…: Developers cannot assume consistent archive extraction across languages, as some runtimes reject or corrupt files that others read cleanly.
  • The tar-minefield project provides 134 edge-case samples to help developers identify and…: The tar-minefield project provides 134 edge-case samples to help developers identify and fix behavioral discrepancies across extraction tools.

Sources checked by our analysis pipeline: 1

Nov 7th, 2026

Here is a curiosity: an archive that can be constructed using a single GNU tar invocation, that is extracted in 8 distinct ways depending on what tool you use.

$ printf hello > file

$ touch empty

$ tar --format=pax --pax-option='delete=?time,size:=512' \

--transform='s,^\./file$,café,' \

-cf hardest.tar file ./file empty

It creates an archive hardest.tar

from three files file ./file empty

in sequence, where file

is repeated so that GNU tar stores the second one as a hard link, and empty

is empty. Exploiting the unique path of the second entry, the hard link is renamed to café

. This triggers tar to create a pax header to store the file name as UTF-8. We add a size=512

record to the pax header, which overrides the default size=0

from the hard link. The value 512 is not a coincidence: it is exactly the size of a tar header.

Visually, this archive has the following structure, with two basic interpretations based on whether a hard link can have a size or not.

Now, POSIX says that data blocks for…

Technology