Skip to content

UnpackProof v0.1.0

Choose a tag to compare

View all tags
@0then0 0then0 released this 03 Oct 13:59
· 2 commits to main since this release
v0.1.0
6fcd76c

First public release of UnpackProof, a small CLI for regression testing TAR extraction commands on synthetic fixtures in disposable Docker containers.

Included

  • Deterministic TAR cases for ordinary, nested, empty, Unicode and PAX paths; duplicate members; existing files; internal symlinks and hardlinks; denied links; and truncated input.
  • Explicit link and overwrite policies, with an obligatory positive extraction control.
  • Independent bounded filesystem snapshots checking names, bytes, declared permissions, link identity and protected fixture preservation.
  • Non-root target execution with no network, a read-only root filesystem, dropped capabilities and runtime, memory, CPU, process, storage and captured-output limits.
  • Human and JSON reports with image identity, target version, execution disposition, findings, observation completeness and separate cleanup status.
  • Evidence saved before destructive cleanup, with recovery checkpoints for report-storage failures and bounded interruption handling.
  • Python tarfile and Node.js tar example adapters, controlled incorrect adapters and Linux Docker integration tests.

Installation and validation

This is a source release; prebuilt binaries and container images are not included. Build the host CLI and a Linux guest binary matching your Docker architecture, then prepare the example adapter images using the README. The project pins Go 1.27.1 and adapter dependencies.

Unit tests, race checks, vet and Docker integration tests passed. CI for the released commit passed without annotations.

Scope and limitations

v0.1 covers TAR and Linux filesystem semantics inside Docker. The oracle observes final snapshots; transient changes reverted before observation can remain undetected. Captured output is bounded and may be truncated. If all report storage is unavailable, destructive cleanup is deferred and retained tmpfs contents remain available only until the keeper deadline.

UnpackProof is not a security scanner or a proof of extractor safety. ZIP/RAR/7z, Windows semantics, hostile payloads, archive bombs and fuzzing are outside this release.

License: Apache-2.0.

Assets 2
Loading