oxar
fast archives and safe codecs for python, written in rust
pure safe rust core (#![forbid(unsafe_code)]) with zero-overhead python bindings.
quick start • speed • safety • cli • docs
why we built this
working with archives in python usually means juggling zipfile, tarfile, and external compression libraries with conflicting apis, gil bottlenecks, and risky defaults (like zip-slip or unpack bombs).
oxar gives you one clean tool for everything:
- 100% safe rust: compiled under
#![forbid(unsafe_code)]. no raw pointers, memory leaks, or unchecked c extensions. - secure by default: path traversal attacks, symlink loops, and overlapping entry bombs are rejected automatically.
- fast: releases the python gil for heavy workloads. up to 6.6x faster than standard library modules.
speed
measured against python stdlib on linux x86_64 across 22 paired runs:
| operation | oxar | stdlib | result |
|---|---|---|---|
| tar.gz read single file | 5.2 ms | 34.6 ms | 6.6x faster |
| tar.gz extract all | 9.3 ms | 27.2 ms | 2.9x faster |
| tar.gz list | 4.4 ms | 10.5 ms | 2.4x faster |
| zip read single file | 1.3 ms | 2.4 ms | 1.8x faster |
| zip extract all | 7.8 ms | 8.9 ms | 1.14x faster |
| zstd compression | fast | unsupported | full support |
| bzip2 compression | faster | baseline | oxar wins |
full benchmarks and reproduction steps are in docs/benchmarks.md.
quick start
pip install oxar
inspect and extract archives
import oxar
# list files without unzipping everything
for entry in oxar.list("archive.tar.gz"):
print(entry.kind.value, entry.size, entry.path)
# grab one file directly
with oxar.open("backup.zip") as arc:
data = arc.read("config.json", max_size=10 * 1024 * 1024)
# safely extract to a directory (with size caps and path sandboxing)
report = oxar.extract("archive.tar.gz", "output/")
print(f"extracted {report.entries} files ({report.bytes_written} bytes)")
one-shot codecs
import oxar
compressed = oxar.compress(b"hello world", codec="zstd", level=3)
raw = oxar.decompress(compressed, codec="zstd")
supported codecs: zstd, gzip, bzip2, xz, lzma, lz4, brotli, snappy, zlib, deflate.
how extraction works
flowchart LR
A[archive bytes] --> B[format parser]
B --> C[policy checks]
C -->|clean stream| D[sandboxed fs sink]
D --> E[disk]
C -.->|traversals / bombs| X[rejected]
format readers never write directly to disk. every path is sanitized and verified inside a capability-isolated sink before anything touches your filesystem.
cli
oxar includes a fast command line tool:
# list contents
oxar list backup.zip
# extract safely
oxar extract backup.tar.gz restored/
# create archives
oxar create bundle.zip src/
oxar create bundle.tar src/ --format tar
# test integrity or detect formats
oxar test backup.zip --json
oxar detect unknown.bin --json
development
# run rust checks
cargo fmt --all --check
cargo test --workspace
# run python checks
pytest tests/
python tools/check_repository.py
license
mit or apache-2.0. see license-mit and license-apache.
Metadata
Release files for oxar 0.1.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| oxar-0.1.1.tar.gz | 126.3 kB | Details |
Built distributions (wheels)
| File | Reset | |||
|---|---|---|---|---|
| oxar-0.1.1-cp313-cp313-win_amd64.whl | CPython 3.13 | CPython 3.13 | Windows x86-64 | Details |
| oxar-0.1.1-cp313-cp313-musllinux_1_2_x86_64.whl | CPython 3.13 | CPython 3.13 | Linux musl 1.2+ x86-64 | Details |
| oxar-0.1.1-cp313-cp313-manylinux_2_28_x86_64.whl | CPython 3.13 | CPython 3.13 | Linux glibc 2.28+ x86-64 | Details |
| oxar-0.1.1-cp313-cp313-macosx_11_0_arm64.whl | CPython 3.13 | CPython 3.13 | macOS 11.0+ ARM64 | Details |
| oxar-0.1.1-cp312-cp312-win_amd64.whl | CPython 3.12 | CPython 3.12 | Windows x86-64 | Details |
| oxar-0.1.1-cp312-cp312-musllinux_1_2_x86_64.whl | CPython 3.12 | CPython 3.12 | Linux musl 1.2+ x86-64 | Details |
| oxar-0.1.1-cp312-cp312-manylinux_2_28_x86_64.whl | CPython 3.12 | CPython 3.12 | Linux glibc 2.28+ x86-64 | Details |
| oxar-0.1.1-cp312-cp312-macosx_11_0_arm64.whl | CPython 3.12 | CPython 3.12 | macOS 11.0+ ARM64 | Details |
| oxar-0.1.1-cp311-cp311-win_amd64.whl | CPython 3.11 | CPython 3.11 | Windows x86-64 | Details |
| oxar-0.1.1-cp311-cp311-musllinux_1_2_x86_64.whl | CPython 3.11 | CPython 3.11 | Linux musl 1.2+ x86-64 | Details |
| oxar-0.1.1-cp311-cp311-manylinux_2_28_x86_64.whl | CPython 3.11 | CPython 3.11 | Linux glibc 2.28+ x86-64 | Details |
| oxar-0.1.1-cp311-cp311-macosx_11_0_arm64.whl | CPython 3.11 | CPython 3.11 | macOS 11.0+ ARM64 | Details |
Total release size: 59.9 MB
Release files / oxar-0.1.1.tar.gz
| Download URL | oxar-0.1.1.tar.gz |
|---|---|
| Size | 126.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
f5c66af30bd820a03417916a5dbcd071fcf4c706437891d76221593c426f5374
|
|
BLAKE2b-256 checksum How to use checksums |
2059487265885675ae07c940201cca6b2ee24dc160f77f22d4f991ed74068bf3
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.
Transparency logRelease files / oxar-0.1.1-cp313-cp313-win_amd64.whl
| Download URL | oxar-0.1.1-cp313-cp313-win_amd64.whl |
|---|---|
| Size | 2.1 MB |
| Tags | CPython 3.13 Windows x86-64 |
|
SHA-256 checksum How to use checksums |
6bace804581b9d1333d3cc201705eaf3a551f49cda52967224999f45d91b46c8
|
|
BLAKE2b-256 checksum How to use checksums |
34d4c03e1a26a0362f5a4806212f583a0d3d27da05f0e5e6c6ff0bedd4e7ede8
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.
Transparency logRelease files / oxar-0.1.1-cp313-cp313-musllinux_1_2_x86_64.whl
| Download URL | oxar-0.1.1-cp313-cp313-musllinux_1_2_x86_64.whl |
|---|---|
| Size | 7.8 MB |
| Tags | CPython 3.13 Linux musl 1.2+ x86-64 |
|
SHA-256 checksum How to use checksums |
9cdef4eb1ba8158a8a1fe207aee547aa0050b3109357961f4ea1842999261f9e
|
|
BLAKE2b-256 checksum How to use checksums |
335f06a9e6bb6fab14ae30619cf95d5eb8c906341c4b232a3a11b314cc98b66c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.
Transparency logRelease files / oxar-0.1.1-cp313-cp313-manylinux_2_28_x86_64.whl
| Download URL | oxar-0.1.1-cp313-cp313-manylinux_2_28_x86_64.whl |
|---|---|
| Size | 8.0 MB |
| Tags | CPython 3.13 Linux glibc 2.28+ x86-64 |
|
SHA-256 checksum How to use checksums |
8a27e847ff48f3a839c2e88f3c07c958484788511818b91836a37fa32a27d392
|
|
BLAKE2b-256 checksum How to use checksums |
a4e6a1385025b45eb2198b6a4ec273cdf6fae2a2d81595482c8cc537c667b8dd
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.
Transparency logRelease files / oxar-0.1.1-cp313-cp313-macosx_11_0_arm64.whl
| Download URL | oxar-0.1.1-cp313-cp313-macosx_11_0_arm64.whl |
|---|---|
| Size | 2.0 MB |
| Tags | CPython 3.13 macOS 11.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
aca07917f4eef5c6834fb8fd55c5d21fd907c66d4f262d012b065c08c61851fc
|
|
BLAKE2b-256 checksum How to use checksums |
c68e301907e8a6132d1b43f412f96509964013b8c3d4202806c8a7a0a1d4e2fd
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.
Transparency logRelease files / oxar-0.1.1-cp312-cp312-win_amd64.whl
| Download URL | oxar-0.1.1-cp312-cp312-win_amd64.whl |
|---|---|
| Size | 2.1 MB |
| Tags | CPython 3.12 Windows x86-64 |
|
SHA-256 checksum How to use checksums |
75a05947fdc7264d8d4abfa6941dd62918b02b573c3b590774ec77024e34335d
|
|
BLAKE2b-256 checksum How to use checksums |
cea43c3013c11e6efd7ee62c5ff3d6d16313c8a1f35e80ca7199bb6d636e7073
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.
Transparency logRelease files / oxar-0.1.1-cp312-cp312-musllinux_1_2_x86_64.whl
| Download URL | oxar-0.1.1-cp312-cp312-musllinux_1_2_x86_64.whl |
|---|---|
| Size | 7.8 MB |
| Tags | CPython 3.12 Linux musl 1.2+ x86-64 |
|
SHA-256 checksum How to use checksums |
f21376daff31173fcbc7959624b05f989c8e163e65bda1d4b8035c0d05bc5d84
|
|
BLAKE2b-256 checksum How to use checksums |
37e6ed611eb45b23ff6561f0409510c957a30e9cea001d60325679f4a81a24ff
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.
Transparency logRelease files / oxar-0.1.1-cp312-cp312-manylinux_2_28_x86_64.whl
| Download URL | oxar-0.1.1-cp312-cp312-manylinux_2_28_x86_64.whl |
|---|---|
| Size | 8.0 MB |
| Tags | CPython 3.12 Linux glibc 2.28+ x86-64 |
|
SHA-256 checksum How to use checksums |
e0a6b1df8a193a25df75633350499d37d38143962eedb2a4de4fc019b9993f8b
|
|
BLAKE2b-256 checksum How to use checksums |
52b22d89585605d9880d30dadb13cd2660ea939eb0fdf2fa4befc089c2a6eec1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.
Transparency logRelease files / oxar-0.1.1-cp312-cp312-macosx_11_0_arm64.whl
| Download URL | oxar-0.1.1-cp312-cp312-macosx_11_0_arm64.whl |
|---|---|
| Size | 2.0 MB |
| Tags | CPython 3.12 macOS 11.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
1f06f761dfa818115172b075bb7a2e3243a75ee04ab8aab9e39e35c558ceaf1e
|
|
BLAKE2b-256 checksum How to use checksums |
988b40c303be70e3830b7e098b3bdd69688f872e158c6d82531e76b56fa18cb3
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.
Transparency logRelease files / oxar-0.1.1-cp311-cp311-win_amd64.whl
| Download URL | oxar-0.1.1-cp311-cp311-win_amd64.whl |
|---|---|
| Size | 2.1 MB |
| Tags | CPython 3.11 Windows x86-64 |
|
SHA-256 checksum How to use checksums |
19d904fe22e0c93bb1adf514a2a08a23dacb2b1f4bc41daa59df3625e4599eca
|
|
BLAKE2b-256 checksum How to use checksums |
3ec423064bf64553f54383d4ca1b0cfcc023cb07a3553531e174dbf277fb7e13
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.
Transparency logRelease files / oxar-0.1.1-cp311-cp311-musllinux_1_2_x86_64.whl
| Download URL | oxar-0.1.1-cp311-cp311-musllinux_1_2_x86_64.whl |
|---|---|
| Size | 7.8 MB |
| Tags | CPython 3.11 Linux musl 1.2+ x86-64 |
|
SHA-256 checksum How to use checksums |
c30ea7ea690ec061555bf6870d9c2bc6c63232e1eec2ee5fee685c895083ad46
|
|
BLAKE2b-256 checksum How to use checksums |
e593fdac382104057d5f1e1e0aab8dc8686a2092141ace13a42c71cd93231efa
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.
Transparency logRelease files / oxar-0.1.1-cp311-cp311-manylinux_2_28_x86_64.whl
| Download URL | oxar-0.1.1-cp311-cp311-manylinux_2_28_x86_64.whl |
|---|---|
| Size | 8.0 MB |
| Tags | CPython 3.11 Linux glibc 2.28+ x86-64 |
|
SHA-256 checksum How to use checksums |
a0b5f7da07ff9b616977567bc9eac98f80b60be05c51cbff23503f0badc1b954
|
|
BLAKE2b-256 checksum How to use checksums |
6997700cb540e1a096360dcf89e1abea70fe10f6e9e3fd4d71820e593f5f9358
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.
Transparency logRelease files / oxar-0.1.1-cp311-cp311-macosx_11_0_arm64.whl
| Download URL | oxar-0.1.1-cp311-cp311-macosx_11_0_arm64.whl |
|---|---|
| Size | 2.0 MB |
| Tags | CPython 3.11 macOS 11.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
9207e2bba622ceb31f0d24a5f14a5f6fe20a4082cdc8a3cee93598e762b31ce6
|
|
BLAKE2b-256 checksum How to use checksums |
c0fa2f2bd5609b44cebd5c99d3706139ab5560260cfe83f63c325f46c44e8620
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.
Transparency log