Re:The Hardest Tarball?
by rmast on Tuesday November 10, 2026 @01:03PM
(#50443857)
A strict parser makes sense for flagging that there are issues, but that also can’t block extraction; it needs to be configurable enough that users can make a decision on how to handle the ambiguity.
[ Parent
| on HN ]
There are many scenarios (such as fetching package distributions over the internet) where the user lacks sufficient information to make an informed and secure decision about how to safely parse and extract a malformed tar (or any other archive format).
(Another way of saying that is that we live in a post-Postel world[1].)
[1]: https://alexgaynor.net/2025/mar/25/postels-law-and-the-three...
That’s true, but also much more general than our SBOM generator is targeting. We’re typically looking at filesystems pulled from embedded systems, or their update files. Ultimately we want to accurately represent what the state of the file system in the device looks like, which can require reverse engineering the update process to determine how to handle ambiguous cases (“correct” is matching what the device firmware update does).