Plugins

Pack a directory into a deterministic tar, read an archive's contents without extracting it, unpack while refusing every member that could reach outside the destination, and verify what came out against what went in by SHA-256. No external dependency — the tar format is written and read in this plugin. Extraction is deliberately more permissive on reading than on writing, because a reader's job is to report what an archive says, while a writer must never emit what it cannot read back. A tar has no central index, so the walk tracks whether it reached the end-of-archive marker: without that, a half-file checksums fine and reads as complete.