hatchzip Files

Security

Update if you extract archives you didn't make yourself.

• An archive named ...zip or ..zip extracted outside its folder. When only dots were left of its name, extracting to the default folder wrote into the folder above (for ...zip) or into the archive's own folder (for ..zip). From there a crafted archive could also replace its own progress files, which the next run trusted. Such an archive now gets a folder of its own, and no entry can be written onto the archive's volumes or progress files. (GHSA-rhvf-79m9-6j2g and GHSA-wvr2-58h7-r4f2, thanks @Deadnaut0)
• A crafted 34-byte RAR crashed HatchZip when it was opened. It is now refused as damaged, before anything is touched. (GHSA-hr29-vhvr-xfx9, thanks @kirakira-dev)
• A hard-linked archive is no longer emptied under its other name. Extracting in place shrinks a file under every name it has, so an archive or volume with another hard link is now refused in place, with nothing changed. --keep-archive still extracts it. (#48, thanks @plusky)
• Files are verified before their batch is claimed. A batch's files are now checked on disk before the archive bytes behind them are freed, closing a case where an extraction could finish without one of its files. (#37, thanks @spaxe-dev)

New

• .tar.xz extracts in place, one xz block at a time, with the same crash safety and resume as .tar.gz. Single-block files (what xz -T1 writes) and files without integrity checks are extracted only while keeping the archive. .txz works too. (#38, thanks @011010 and @garvrao80)
• Browse an archive as a folder tree in the app: folders first, sizes totalled, the top folder opened, and the keyboard works (Left, Right, Up, Down). (#40, [#53], thanks @garvrao80)
• Names that differ only in case, such as Makefile and makefile in a Linux kernel tree, extract where the destination keeps them apart: ext4, f2fs and tmpfs folders without the casefold flag, btrfs, XFS without ASCII case-insensitivity, and case-sensitive APFS and HFS+. Everywhere else they are still refused before anything changes. (#56, thanks @plusky)
• Hindi. The app's main window follows the system language and is translated into Hindi, the first language after English. Translations from native speakers of other languages are welcome. (#44, thanks @garvrao80)
• cargo binstall hatchzip downloads the release build instead of compiling. (#45)

Fixes

• Correct times for ZIPs from 7-Zip and Windows, read from the NTFS field. Before, files were off by your time zone's offset. (#49, thanks @plusky)
• Zone-less ZIP times are read as local time, as unzip, 7-Zip and Explorer do. (#55, thanks @plusky)
• A .tar.gz or .tar.xz frees space on Windows even when its resume points are close together. NTFS frees space in 64 KiB units, and points closer than that used to free nothing until the end. (#64, thanks @011010)
• Tar times from pax records are used when present. (#42, thanks @jayhemnani9910)

Downloads

Every file comes with a SHA-256 checksum and signed build provenance. To check a download:

:::sh
gh attestation verify HatchZip-x64.msi --repo xevrion/hatchzip

Checksums and VirusTotal links for every file: Verify your download.

On Windows, HatchZip-x64-portable.zip runs without installing anything.

Package managers: brew install xevrion/tap/hatchzip (command line), brew install --cask xevrion/tap/hatchzip (app), scoop bucket add xevrion https://github.com/xevrion/scoop-bucket followed by scoop install xevrion/hatchzip, and cargo binstall hatchzip.

RAR archives are decoded by UnRAR, under its own license, included with every download.

HatchZip is free and open source. If it saved you some disk space, sponsoring keeps it going.

Full Changelog: https://github.com/xevrion/hatchzip/compare/v0.1.8...v0.1.9