Skip to content

Samepack v0.2.0 — Lock the files, not the compression

Latest
Latest

Choose a tag to compare

View all tags
@LubuSeb LubuSeb released this 30 Aug 14:47
v0.2.0
753cfe5

Samepack v0.2.0 — Lock the files, not the compression

Two archives can contain the same release payload and still have completely different hashes. Samepack v0.2.0 records what matters—the files—and verifies later archives across ZIP, TAR, and TAR.GZ.

The v0.2 workflow

samepack record --output baseline.samepack.json source.zip
samepack verify baseline.samepack.json regenerated.tar.gz

The baseline is a persistent, versioned, strict JSON manifest, so verification no longer needs the original archive. One manifest can verify multiple candidate archives in one command. When a candidate differs, Samepack reports exact added, removed, content-changed, kind-changed, and executable-behavior changes.

Samepack normalizes regular-file modes for portable comparison and packing. Executable behavior can be preserved explicitly with --preserve-executable, and wrapper removal is always explicit with --strip-root.

Public proof

The included standard-library corpus harness processed 18 exact public GitHub commit pairs:

  • 36 ZIP and TAR.GZ archives
  • 743.1 MiB compressed
  • 1.50 GiB of payload
  • 124,356 paths
  • different outer hashes for every pair
  • matching portable payload roots for every pair

Four Go fuzz targets cover archive parsing, strict manifest parsing, cross-format equivalence, and mutations. The documented local campaign completed 399,166 executions.

Zero dependencies, explicit boundaries

Samepack's runtime and proof harness use only the Go standard library. It ships as one standalone binary per platform.

Archives are inspected without extracting entries to disk. Samepack rejects unsafe paths, special file modes, ambiguous path graphs, malformed manifests, and oversized inputs under documented limits. Reproducible release builds use pinned inputs, and published binaries are accompanied by SHA-256 checksums.

Downloads and proof links

  • Release: https://github.com/LubuSeb/samepack/releases/tag/v0.2.0
  • Release commit: 753cfe571abb50cd1bc93ca9eeda66f45914e08c
  • Demo video: https://vimeo.com/1222477449
  • Repository: https://github.com/LubuSeb/samepack

AI disclosure: ChatGPT/Codex was used as development tooling.

Assets 12
Loading