Samepack v0.2.0 — Lock the files, not the compression

Samepack v0.2.0 — Lock the files, not the compression

Two archives can contain the same release payload and still have completely different hashes. Samepack v0.2.0 records what matters—the files—and verifies later archives across ZIP, TAR, and TAR.GZ.

The v0.2 workflow

samepack record --output baseline.samepack.json source.zip
samepack verify baseline.samepack.json regenerated.tar.gz

The baseline is a persistent, versioned, strict JSON manifest, so verification no longer needs the original archive. One manifest can verify multiple candidate archives in one command. When a candidate differs, Samepack reports exact added, removed, content-changed, kind-changed, and executable-behavior changes.

Samepack normalizes regular-file modes for portable comparison and packing. Executable behavior can be preserved explicitly with --preserve-executable, and wrapper removal is always explicit with --strip-root.

Public proof

The included standard-library corpus harness processed 18 exact public GitHub commit pairs:

• 36 ZIP and TAR.GZ archives
• 743.1 MiB compressed
• 1.50 GiB of payload
• 124,356 paths
• different outer hashes for every pair
• matching portable payload roots for every pair

Four Go fuzz targets cover archive parsing, strict manifest parsing, cross-format equivalence, and mutations. The documented local campaign completed 399,166 executions.

Zero dependencies, explicit boundaries

Samepack's runtime and proof harness use only the Go standard library. It ships as one standalone binary per platform.

Archives are inspected without extracting entries to disk. Samepack rejects unsafe paths, special file modes, ambiguous path graphs, malformed manifests, and oversized inputs under documented limits. Reproducible release builds use pinned inputs, and published binaries are accompanied by SHA-256 checksums.

Downloads and proof links

• Release: https://github.com/LubuSeb/samepack/releases/tag/v0.2.0
• Release commit: 753cfe571abb50cd1bc93ca9eeda66f45914e08c
• Demo video: https://vimeo.com/1222477449
• Repository: https://github.com/LubuSeb/samepack

AI disclosure: ChatGPT/Codex was used as development tooling.

Samepack v0.1.0

Samepack is a zero-dependency CLI for deterministic release archives and safe archive forensics.

Highlights:

• Builds canonical TAR, TAR.GZ, and ZIP archives.
• Explains whether different archive hashes mean packaging-only differences or changed payload files.
• Reports exact added, removed, and modified paths without extracting either archive.
• Provides stable JSON and CI-friendly exit codes.
• Rejects traversal, absolute/control-character paths, duplicates, case collisions, oversized entries, and unsafe special types.
• Uses only the Go standard library; go.mod has no require block.

Proof:

• Windows and Linux produce byte-identical demo archives in the public verification workflow.
• Executables are built twice and compared on each CI platform.
• Real GitHub-generated ripgrep TAR.GZ and ZIP archives were correctly identified as identical payload content.

Download the binary for your operating system and verify it with checksums.txt.