Skip to content

v0.1.4

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Jul 19:32
v0.1.4
98f5e11
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Unzip: private, offline ZIP extraction for Firefox and Chrome, entirely in your browser.

Your files never leave your device; no uploads, no accounts, no telemetry; all processing local.

Highlights

  • Streaming, bounded-memory extraction with per-entry and aggregate caps.
  • Fail-closed ZIP parsing driven by the central directory: encrypted, Zip64/over-4 GB, corrupt, and crafted archives are rejected with clear messages.
  • Full path safety (zip-slip, absolute/UNC/drive paths, Windows reserved names, bidi/Unicode spoofing, case-collisions).
  • Virtualized, sortable, filterable file tree; download one file or the whole tree with collision-safe names.
  • Cancellable, WCAG-AA accessible, real-Firefox end-to-end tested; one MV3 codebase for Chrome and Firefox; zero install-time permissions.

Known limitations

Extraction is intentionally limited to the standard-ZIP boundary. Encrypted (password-protected) archives, Zip64 and archives over 4 GB, and other non-standard formats are not extracted and are rejected with a clear message.

Compatibility

Runs on current stable Firefox and Chrome (MV3).

Install

This is a developer preview; signed store listings are on the way.

  • Chrome: unzip the -chrome.zip asset, open chrome://extensions, enable Developer mode, choose Load unpacked, and select the extracted folder.
  • Firefox: unzip the -firefox.zip asset, open about:debugging#/runtime/this-firefox, choose Load Temporary Add-on, and select manifest.json. A temporary add-on is cleared when Firefox restarts.
  • Firefox (AMO) and Chrome (Chrome Web Store): coming soon.

Verify your download

Download SHA256SUMS alongside the ZIP files, then verify their checksums:

sha256sum -c SHA256SUMS

On macOS:

shasum -a 256 -c SHA256SUMS

Each asset also has a keyless GitHub OIDC signature bundle. Verify the checksum file before trusting it:

cosign verify-blob --bundle SHA256SUMS.sigstore.json --certificate-identity-regexp '^https://github\.com/animeshkundu/file-tools/\.github/workflows/release\.yml@refs/tags/v[^/]+$' --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS

For an independent build comparison, check out this tag, run npm ci, then npm run zip and npm run zip:firefox. Compare the generated ZIP SHA-256 values with SHA256SUMS, or compare the build inputs with the attached sources ZIP. Byte-for-byte equality can depend on the local toolchain and packaging metadata.

Learn more: https://animesh.kundus.in/file-tools/

Changelog

Attached: the built Chrome and Firefox extension packages, the Firefox sources archive, checksums, and keyless signature bundles.

Assets 10
Loading