Python and Rust libraries for MDZip: four core libraries, one format

[kylemwhite]

MDZip now has core libraries for Python and Rust, alongside the existing ones for .NET and JavaScript. Each one reads, writes and validates .mdz files, and each passes the same shared conformance tests from the specification. An app built on any of them reads and writes the same files as every other MDZip tool.

Python

mdzip-core for Python 3.10 and later, using only the standard library.

pip install mdzip-core

import mdzip_core

data = mdzip_core.create({"index.md": "# Trip notes\n\n![Beach](images/beach.png)\n", "images/beach.png": png})
open("trip.mdz", "wb").write(data)

with mdzip_core.open("trip.mdz") as archive:
    text = archive.read_text(archive.entry_point)   # index.md

Rust

mdzip-core for Rust 1.85 and later, with small pure-Rust dependencies. API docs.

cargo add mdzip-core

use mdzip_core::{create, CreateOptions, MdzArchive};

let data = create(
    [("index.md", "# Trip notes\n\n![Beach](images/beach.png)\n".as_bytes()), ("images/beach.png", png)],
    &CreateOptions::new(),
)?;
std::fs::write("trip.mdz", data)?;

let archive = MdzArchive::open_path("trip.mdz")?;
let text = archive.read_text(&archive.entry_point()?)?;   // index.md

What both of them do

• Write conforming files. Every archive gets the manifest.json the specification requires, with the main document recorded, so other tools open the right file.
• Change files safely. Updating an archive keeps everything you didn't touch, including images, files your app doesn't know about and manifest fields other apps wrote.
• Open untrusted files safely. Unsafe paths, ZIP bombs and symbolic links are rejected or ignored, with a stable error code.

Why the shared tests matter

The specification comes with test files every MDZip library has to pass: tricky entry points, unusual file names, hostile archives, and files that must survive being opened and saved. All four core libraries run them, so a file written in Python opens the same way in the Rust, .NET and JavaScript libraries, and in the apps built on them.

If you're adding .mdz support to an app, Add MDZip to your app has the steps, and Works with MDZip shows everything that reads and writes it today.

Python on PyPI · Rust on crates.io · Python source · Rust source

_{The .NET logo is a trademark of the .NET Foundation. The JavaScript logo is by Chris Williams, under the MIT License. The Python logo is a trademark of the Python Software Foundation. The Rust logo is by the Rust Foundation, used under CC BY 4.0. None of these organizations is affiliated with or endorses MDZip.}