Pagonic v0.5.0 — Trustworthy ZIP Inspection for Automation

Highlights

Pagonic v0.5.0 makes the existing ZIP inspector easier to use in automation while keeping the product focused on “inspect before you extract”.

• Explicit verify and safe-extract policy thresholds and exit-code contract.
• Generated synthetic security regression corpus for traversal, collisions, metadata, structure, unsupported methods, and resource limits.
• Stable inspection JSON schema and deterministic ordering documentation.
• Copyable GitHub Actions, Bash, and PowerShell integration examples.
• ZipHandler compatibility policy: available without a new deprecation warning throughout the 0.5 line.
• Refreshed, slower README terminal demo showing version, inspection, verification refusal, and safe-extraction refusal.

Installation

The v0.5.0 package is now published on PyPI:

python -m pip install pagonic==0.5.0

For an isolated CLI installation, use either:

uv tool install pagonic
pipx install pagonic

The matching artifacts are also available on TestPyPI for publication checks and below as GitHub release assets. Pagonic remains an alpha-stage security-aware ZIP inspection and safe extraction toolkit.

Validation

Local normal suite: 399 passed, 8 skipped.

Local comprehensive suite: 404 passed, 3 skipped.

GitHub Actions test matrix passed all 8 Windows/Linux Python 3.10–3.13 jobs.

The published package was verified with clean Windows and Linux (WSL Ubuntu) installations using pip check, pagonic --version, inspect --json, verify, and safe-extract --dry-run.

Pagonic v0.4.0 — Safe ZIP Inspector

Pagonic v0.4.0

Pagonic is a security-aware Python ZIP inspection and safe extraction toolkit.
The core workflow is simple:

Inspect before you extract.

This release turns the 0.4 API polish work on main into a coherent public
release surface while keeping the project intentionally ZIP-focused.

Highlights

• Stable inspection, verification, and safe-extract workflows.
• Typed result contracts for archive, compression, extraction, and file metadata.
• Focused ZipReader, ZipWriter, and inspect_archive APIs.
• ZipHandler remains available as a compatibility facade for older callers.
• Defensive configuration state handling.
• Cross-platform path safety and deterministic risk reporting.
• Directly runnable inspect-first basic usage example.
• Public contribution, security reporting, issue templates, and a 0.5 roadmap.
• Optional GUI remains outside the base installation.

Validation

• Main test suite: 329 passed, 8 skipped.
• Comprehensive suite: 334 passed, 3 skipped.
• Source distribution and wheel build succeeded.
• pip check passed.
• Clean wheel installation and CLI smoke passed for version, help, compress,
  inspect JSON, verify, safe-extract dry-run, and extraction.

Scope and limitations

• This is an alpha-stage early public release.
• Pagonic is ZIP-focused and is not a general multi-format archive manager.
• It is not a replacement for 7-Zip or WinRAR.
• It is not presented as production-ready for critical automation.
• Benchmark output is intended for local regression tracking, not a universal
  performance claim.
• No PyPI or TestPyPI package is published as part of this release.
• The optional GUI is secondary to the library and CLI inspection workflow.

For migration details, see docs/migration-0.4.md. For planned work, see the
0.5 roadmap in docs/roadmap.md.

Pagonic v0.3.0 — Safe ZIP Inspector

Pagonic v0.3.0 — Safe ZIP Inspector

Pagonic v0.3.0 is the first public release of Pagonic’s new direction: a security-aware Python ZIP inspection and safe extraction toolkit.

The main idea is simple:

Inspect before you extract.

Pagonic focuses on ZIP archive inspection, deterministic risk reporting, safer extraction behavior, and Python/CLI automation workflows. It is not a 7-Zip or WinRAR replacement, and it is not presented as production-ready software.

Highlights

This release introduces and stabilizes the Safe ZIP Inspector product surface:

• pagonic inspect
• pagonic inspect --json
• pagonic inspect --markdown
• pagonic verify --max-risk
• pagonic safe-extract --dry-run
• pagonic list --tree

The public direction is now centered around inspecting ZIP files before extraction, validating risk signals, producing readable reports, and extracting only after a safety gate.

Security and Hardening

This release includes several important safety improvements:

• Hardened ZIP path safety behavior against Zip Slip / path traversal cases.
• Improved handling for POSIX absolute paths, Windows drive paths, mixed separators, and traversal entries.
• safe-extract now refuses unsupported ZIP compression methods instead of continuing into unsafe or unclear extraction behavior.
• Inspection reports now use deterministic risk flags and structured report fields.
• The basic usage example now follows an inspect-first workflow.

Inspection Reports

Pagonic can report ZIP archive risk signals such as:

• path traversal entries
• absolute paths
• Windows drive paths
• hidden files
• suspicious extensions
• high compression ratio entries
• large uncompressed size
• too many files
• unsupported compression methods
• CRC or ZIP structure errors

Reports are available through terminal output, JSON, and Markdown-oriented output.

Validation

This release was validated on both the main development machine and a clean Linux Dev Node.

• Main PC: 303 passed, 8 skipped
• Setra Dev Node: 302 passed, 9 skipped
• python -m build: success
• python -m pip check: success
• Wheel-installed CLI smoke: success
• python examples/basic_usage.py: success with inspect-first flow

Current Scope and Limits

Pagonic v0.3.0 is an alpha-stage / early public release.

Important notes:

• Not production-ready.
• Not a 7-Zip or WinRAR replacement.
• ZIP-focused; no broad multi-format archive manager claim.
• No PyPI/TestPyPI package is published for this release.
• GUI remains optional and secondary.
• ZipHandler remains as a compatibility facade.
• Future public API direction centers on ZipReader, ZipWriter, and inspection/reporting APIs.
• Benchmark output is intended for local validation and regression tracking, not universal speed claims.

Install From Source

For this release, use the GitHub source checkout:

git clone https://github.com/SetraTheXX/pagonic.git
cd pagonic
python -m pip install -e .

Optional GUI dependencies:

python -m pip install -e ".[gui]"

Development dependencies:

python -m pip install -e ".[dev]"

Quick Start

Inspect an archive before extraction:

pagonic inspect archive.zip

Generate JSON output:

pagonic inspect archive.zip --json

Verify an archive for automation:

pagonic verify archive.zip --max-risk medium

Preview safe extraction:

pagonic safe-extract archive.zip ./out --dry-run

List archive contents as a tree:

pagonic list archive.zip --tree

Release Checklist

• Tag: v0.3.0
• GitHub release type: normal release
• Pre-release checkbox: not checked
• PyPI/TestPyPI: not published