Skip to main content

oxar

fast archives and safe codecs for python, written in rust

build wheels python rust license

pure safe rust core (#![forbid(unsafe_code)]) with zero-overhead python bindings.

quick start • speed • safety • cli • docs


why we built this

working with archives in python usually means juggling zipfile, tarfile, and external compression libraries with conflicting apis, gil bottlenecks, and risky defaults (like zip-slip or unpack bombs).

oxar gives you one clean tool for everything:

  • 100% safe rust: compiled under #![forbid(unsafe_code)]. no raw pointers, memory leaks, or unchecked c extensions.
  • secure by default: path traversal attacks, symlink loops, and overlapping entry bombs are rejected automatically.
  • fast: releases the python gil for heavy workloads. up to 6.6x faster than standard library modules.

speed

measured against python stdlib on linux x86_64 across 22 paired runs:

operation oxar stdlib result
tar.gz read single file 5.2 ms 34.6 ms 6.6x faster
tar.gz extract all 9.3 ms 27.2 ms 2.9x faster
tar.gz list 4.4 ms 10.5 ms 2.4x faster
zip read single file 1.3 ms 2.4 ms 1.8x faster
zip extract all 7.8 ms 8.9 ms 1.14x faster
zstd compression fast unsupported full support
bzip2 compression faster baseline oxar wins

full benchmarks and reproduction steps are in docs/benchmarks.md.


quick start

pip install oxar

inspect and extract archives

import oxar

# list files without unzipping everything
for entry in oxar.list("archive.tar.gz"):
    print(entry.kind.value, entry.size, entry.path)

# grab one file directly
with oxar.open("backup.zip") as arc:
    data = arc.read("config.json", max_size=10 * 1024 * 1024)

# safely extract to a directory (with size caps and path sandboxing)
report = oxar.extract("archive.tar.gz", "output/")
print(f"extracted {report.entries} files ({report.bytes_written} bytes)")

one-shot codecs

import oxar

compressed = oxar.compress(b"hello world", codec="zstd", level=3)
raw = oxar.decompress(compressed, codec="zstd")

supported codecs: zstd, gzip, bzip2, xz, lzma, lz4, brotli, snappy, zlib, deflate.


how extraction works

flowchart LR
    A[archive bytes] --> B[format parser]
    B --> C[policy checks]
    C -->|clean stream| D[sandboxed fs sink]
    D --> E[disk]
    C -.->|traversals / bombs| X[rejected]

format readers never write directly to disk. every path is sanitized and verified inside a capability-isolated sink before anything touches your filesystem.


cli

oxar includes a fast command line tool:

# list contents
oxar list backup.zip

# extract safely
oxar extract backup.tar.gz restored/

# create archives
oxar create bundle.zip src/
oxar create bundle.tar src/ --format tar

# test integrity or detect formats
oxar test backup.zip --json
oxar detect unknown.bin --json

development

# run rust checks
cargo fmt --all --check
cargo test --workspace

# run python checks
pytest tests/
python tools/check_repository.py

license

mit or apache-2.0. see license-mit and license-apache.

Metadata

Release files for oxar 0.1.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for oxar 0.1.1
File Size Uploaded
oxar-0.1.1.tar.gz 126.3 kB Details

Built distributions (wheels)

Table of built distributions (wheels) for oxar 0.1.1
File
oxar-0.1.1-cp313-cp313-win_amd64.whl CPython 3.13 CPython 3.13 Windows x86-64 Details
oxar-0.1.1-cp313-cp313-musllinux_1_2_x86_64.whl CPython 3.13 CPython 3.13 Linux musl 1.2+ x86-64 Details
oxar-0.1.1-cp313-cp313-manylinux_2_28_x86_64.whl CPython 3.13 CPython 3.13 Linux glibc 2.28+ x86-64 Details
oxar-0.1.1-cp313-cp313-macosx_11_0_arm64.whl CPython 3.13 CPython 3.13 macOS 11.0+ ARM64 Details
oxar-0.1.1-cp312-cp312-win_amd64.whl CPython 3.12 CPython 3.12 Windows x86-64 Details
oxar-0.1.1-cp312-cp312-musllinux_1_2_x86_64.whl CPython 3.12 CPython 3.12 Linux musl 1.2+ x86-64 Details
oxar-0.1.1-cp312-cp312-manylinux_2_28_x86_64.whl CPython 3.12 CPython 3.12 Linux glibc 2.28+ x86-64 Details
oxar-0.1.1-cp312-cp312-macosx_11_0_arm64.whl CPython 3.12 CPython 3.12 macOS 11.0+ ARM64 Details
oxar-0.1.1-cp311-cp311-win_amd64.whl CPython 3.11 CPython 3.11 Windows x86-64 Details
oxar-0.1.1-cp311-cp311-musllinux_1_2_x86_64.whl CPython 3.11 CPython 3.11 Linux musl 1.2+ x86-64 Details
oxar-0.1.1-cp311-cp311-manylinux_2_28_x86_64.whl CPython 3.11 CPython 3.11 Linux glibc 2.28+ x86-64 Details
oxar-0.1.1-cp311-cp311-macosx_11_0_arm64.whl CPython 3.11 CPython 3.11 macOS 11.0+ ARM64 Details

Total release size: 59.9 MB

Release files / oxar-0.1.1.tar.gz

Download URL oxar-0.1.1.tar.gz
Size 126.3 kB
Tags Source
SHA-256 checksum
How to use checksums
f5c66af30bd820a03417916a5dbcd071fcf4c706437891d76221593c426f5374
BLAKE2b-256 checksum
How to use checksums
2059487265885675ae07c940201cca6b2ee24dc160f77f22d4f991ed74068bf3
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.

Transparency log

Release files / oxar-0.1.1-cp313-cp313-win_amd64.whl

Download URL oxar-0.1.1-cp313-cp313-win_amd64.whl
Size 2.1 MB
Tags CPython 3.13 Windows x86-64
SHA-256 checksum
How to use checksums
6bace804581b9d1333d3cc201705eaf3a551f49cda52967224999f45d91b46c8
BLAKE2b-256 checksum
How to use checksums
34d4c03e1a26a0362f5a4806212f583a0d3d27da05f0e5e6c6ff0bedd4e7ede8
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.

Transparency log

Release files / oxar-0.1.1-cp313-cp313-musllinux_1_2_x86_64.whl

Download URL oxar-0.1.1-cp313-cp313-musllinux_1_2_x86_64.whl
Size 7.8 MB
Tags CPython 3.13 Linux musl 1.2+ x86-64
SHA-256 checksum
How to use checksums
9cdef4eb1ba8158a8a1fe207aee547aa0050b3109357961f4ea1842999261f9e
BLAKE2b-256 checksum
How to use checksums
335f06a9e6bb6fab14ae30619cf95d5eb8c906341c4b232a3a11b314cc98b66c
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.

Transparency log

Release files / oxar-0.1.1-cp313-cp313-manylinux_2_28_x86_64.whl

Download URL oxar-0.1.1-cp313-cp313-manylinux_2_28_x86_64.whl
Size 8.0 MB
Tags CPython 3.13 Linux glibc 2.28+ x86-64
SHA-256 checksum
How to use checksums
8a27e847ff48f3a839c2e88f3c07c958484788511818b91836a37fa32a27d392
BLAKE2b-256 checksum
How to use checksums
a4e6a1385025b45eb2198b6a4ec273cdf6fae2a2d81595482c8cc537c667b8dd
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.

Transparency log

Release files / oxar-0.1.1-cp313-cp313-macosx_11_0_arm64.whl

Download URL oxar-0.1.1-cp313-cp313-macosx_11_0_arm64.whl
Size 2.0 MB
Tags CPython 3.13 macOS 11.0+ ARM64
SHA-256 checksum
How to use checksums
aca07917f4eef5c6834fb8fd55c5d21fd907c66d4f262d012b065c08c61851fc
BLAKE2b-256 checksum
How to use checksums
c68e301907e8a6132d1b43f412f96509964013b8c3d4202806c8a7a0a1d4e2fd
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.

Transparency log

Release files / oxar-0.1.1-cp312-cp312-win_amd64.whl

Download URL oxar-0.1.1-cp312-cp312-win_amd64.whl
Size 2.1 MB
Tags CPython 3.12 Windows x86-64
SHA-256 checksum
How to use checksums
75a05947fdc7264d8d4abfa6941dd62918b02b573c3b590774ec77024e34335d
BLAKE2b-256 checksum
How to use checksums
cea43c3013c11e6efd7ee62c5ff3d6d16313c8a1f35e80ca7199bb6d636e7073
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.

Transparency log

Release files / oxar-0.1.1-cp312-cp312-musllinux_1_2_x86_64.whl

Download URL oxar-0.1.1-cp312-cp312-musllinux_1_2_x86_64.whl
Size 7.8 MB
Tags CPython 3.12 Linux musl 1.2+ x86-64
SHA-256 checksum
How to use checksums
f21376daff31173fcbc7959624b05f989c8e163e65bda1d4b8035c0d05bc5d84
BLAKE2b-256 checksum
How to use checksums
37e6ed611eb45b23ff6561f0409510c957a30e9cea001d60325679f4a81a24ff
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.

Transparency log

Release files / oxar-0.1.1-cp312-cp312-manylinux_2_28_x86_64.whl

Download URL oxar-0.1.1-cp312-cp312-manylinux_2_28_x86_64.whl
Size 8.0 MB
Tags CPython 3.12 Linux glibc 2.28+ x86-64
SHA-256 checksum
How to use checksums
e0a6b1df8a193a25df75633350499d37d38143962eedb2a4de4fc019b9993f8b
BLAKE2b-256 checksum
How to use checksums
52b22d89585605d9880d30dadb13cd2660ea939eb0fdf2fa4befc089c2a6eec1
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.

Transparency log

Release files / oxar-0.1.1-cp312-cp312-macosx_11_0_arm64.whl

Download URL oxar-0.1.1-cp312-cp312-macosx_11_0_arm64.whl
Size 2.0 MB
Tags CPython 3.12 macOS 11.0+ ARM64
SHA-256 checksum
How to use checksums
1f06f761dfa818115172b075bb7a2e3243a75ee04ab8aab9e39e35c558ceaf1e
BLAKE2b-256 checksum
How to use checksums
988b40c303be70e3830b7e098b3bdd69688f872e158c6d82531e76b56fa18cb3
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.

Transparency log

Release files / oxar-0.1.1-cp311-cp311-win_amd64.whl

Download URL oxar-0.1.1-cp311-cp311-win_amd64.whl
Size 2.1 MB
Tags CPython 3.11 Windows x86-64
SHA-256 checksum
How to use checksums
19d904fe22e0c93bb1adf514a2a08a23dacb2b1f4bc41daa59df3625e4599eca
BLAKE2b-256 checksum
How to use checksums
3ec423064bf64553f54383d4ca1b0cfcc023cb07a3553531e174dbf277fb7e13
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.

Transparency log

Release files / oxar-0.1.1-cp311-cp311-musllinux_1_2_x86_64.whl

Download URL oxar-0.1.1-cp311-cp311-musllinux_1_2_x86_64.whl
Size 7.8 MB
Tags CPython 3.11 Linux musl 1.2+ x86-64
SHA-256 checksum
How to use checksums
c30ea7ea690ec061555bf6870d9c2bc6c63232e1eec2ee5fee685c895083ad46
BLAKE2b-256 checksum
How to use checksums
e593fdac382104057d5f1e1e0aab8dc8686a2092141ace13a42c71cd93231efa
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.

Transparency log

Release files / oxar-0.1.1-cp311-cp311-manylinux_2_28_x86_64.whl

Download URL oxar-0.1.1-cp311-cp311-manylinux_2_28_x86_64.whl
Size 8.0 MB
Tags CPython 3.11 Linux glibc 2.28+ x86-64
SHA-256 checksum
How to use checksums
a0b5f7da07ff9b616977567bc9eac98f80b60be05c51cbff23503f0badc1b954
BLAKE2b-256 checksum
How to use checksums
6997700cb540e1a096360dcf89e1abea70fe10f6e9e3fd4d71820e593f5f9358
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.

Transparency log

Release files / oxar-0.1.1-cp311-cp311-macosx_11_0_arm64.whl

Download URL oxar-0.1.1-cp311-cp311-macosx_11_0_arm64.whl
Size 2.0 MB
Tags CPython 3.11 macOS 11.0+ ARM64
SHA-256 checksum
How to use checksums
9207e2bba622ceb31f0d24a5f14a5f6fe20a4082cdc8a3cee93598e762b31ce6
BLAKE2b-256 checksum
How to use checksums
c0fa2f2bd5609b44cebd5c99d3706139ab5560260cfe83f63c325f46c44e8620
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.

Transparency log

Release history Release notifications | RSS feed

This release

0.1.1 This release

13 release files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page