--- title: tar-codec: a fast and secure tar parser for the Rust... description: Astral released tar-codec, a new Rust library for parsing and writing tar archives, now the default tar backend in uv starting with version 0.13. It replaces... canonical: https://daily.dev/posts/tar-codec-a-fast-and-secure-tar-parser-for-the-rust-ecosystem-k00vel7gm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: tar-codec: a fast and secure tar parser for the Rust ecosystem | daily.dev og:description: Astral released tar-codec, a new Rust library for parsing and writing tar archives, now the default tar backend in uv starting with version 0.13. It replaces... og:url: https://daily.dev/posts/tar-codec-a-fast-and-secure-tar-parser-for-the-rust-ecosystem-k00vel7gm og:image: https://api.daily.dev/og/posts/K00Vel7gM.png og:image:alt: tar-codec: a fast and secure tar parser for the Rust ecosystem og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # tar-codec: a fast and secure tar parser for the Rust ecosystem **[Astral](https://daily.dev/sources/astral-sh)** · 30 min read · 0 upvotes · 0 comments ## Summary Astral released tar-codec, a new Rust library for parsing and writing tar archives, now the default tar backend in uv starting with version 0.13. It replaces astral-tokio-tar, a long chain of forks, and runs roughly twice as fast. The bigger motivation was security: the old library suffered parser differentials where uv, pip, and other tools could extract different contents from the same tarball. tar-codec is stricter by design, rejecting archives that mix tar families (UStar/pax vs GNU) instead of trying to merge their state machines. It's built in layers, with a separate tar-framing crate and a new archive-trait crate for safe, anchored extraction using cap-std. Astral says it is actively looking into replacing uv's ZIP parser for similar reasons. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What tar parsing library does uv use by default starting in version 0.13? uv uses tar-codec, a new Rust tar encoding/decoding library built by Astral, as its default tar backend starting with uv 0.13. It replaces astral-tokio-tar, a fork chain originating from dignifiedquire/async-tar. The legacy backend can still be enabled by setting the environment variable UV_LEGACY_TAR_BACKEND=1. tar-codec was available earlier behind a --preview-features tar-codec flag since uv 0.12. _Developers upgrading uv track backend changes like this on daily.dev before they hit a breaking default switch._ ### Why did Astral replace uv's old tokio-tar based parser with a new implementation? Astral found numerous security advisories and parser differentials in astral-tokio-tar that could let different tools (uv, pip) extract different contents from the same tarball, including 'append' and 'full' differential attacks. They concluded the tokio-tar family was too lenient by design and that retrofitting strict constraints would be more error-prone than a ground-up rewrite, which also delivered roughly 2x faster tar parsing performance. _Teams weighing a parser rewrite against patching legacy code can compare real tradeoffs like these on daily.dev._ ### How does tar-codec prevent parser differential attacks between different tar format families like GNU and pax? tar-codec locks the entire parse to a single tar family, either UStar/pax or GNU, based on the first block's magic and version, and rejects archives whose headers don't agree on which family they belong to. This avoids the ambiguous state-mixing seen in other parsers, where stacking a GNU 'L' extension against a pax 'x' extension has unclear semantics and causes implementations to disagree on extraction results, creating exploitable desynchronization. _Developers hardening file format parsers against desync bugs can follow design writeups like this on daily.dev._ ## Similar posts on daily.dev - [Announcing Zstandard in Rust](https://daily.dev/posts/announcing-zstandard-in-rust-l4vxsmadl) · Lobsters · 0 upvotes · 0 comments - [Security advisory for Cargo](https://daily.dev/posts/security-advisory-for-cargo-d6hrds8ue) · Rust · 3 upvotes · 0 comments - [Writing Rust code that's faster than state-of-the-art libraries by asking agents to make the code faster](https://daily.dev/posts/writing-rust-code-that-s-faster-than-state-of-the-art-libraries-by-asking-agents-to-make-the-code-fa-886d02uwp) · Max Woolf's Blog · 0 upvotes · 0 comments --- Tags: [#rust](https://daily.dev/tags/rust) [View this post on daily.dev](https://daily.dev/posts/tar-codec-a-fast-and-secure-tar-parser-for-the-rust-ecosystem-k00vel7gm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"tar-codec: a fast and secure tar parser for the Rust ecosystem","url":"https://daily.dev/posts/tar-codec-a-fast-and-secure-tar-parser-for-the-rust-ecosystem-k00vel7gm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tar-codec-a-fast-and-secure-tar-parser-for-the-rust-ecosystem-k00vel7gm"},"datePublished":"2026-10-27T16:48:27.725Z","dateModified":"2026-10-29T05:46:11.771Z","description":"Astral released tar-codec, a new Rust library for parsing and writing tar archives, now the default tar backend in uv starting with version 0.13. It replaces...","image":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","thumbnailUrl":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","isAccessibleForFree":true,"articleSection":"Astral","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Astral","logo":"https://media.daily.dev/image/upload/s--NI5d91BK--/f_auto,q_auto/v1774959974/logos/astral-sh?_a=BAMAMiWQ0","url":"https://daily.dev/sources/astral-sh"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tar-codec-a-fast-and-secure-tar-parser-for-the-rust-ecosystem-k00vel7gm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"rust","timeRequired":"PT30M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Astral","item":"https://daily.dev/sources/astral-sh"},{"@type":"ListItem","position":3,"name":"tar-codec: a fast and secure tar parser for the Rust ecosystem"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/tar-codec-a-fast-and-secure-tar-parser-for-the-rust-ecosystem-k00vel7gm#faq","mainEntity":[{"@type":"Question","name":"What tar parsing library does uv use by default starting in version 0.13?","acceptedAnswer":{"@type":"Answer","text":"uv uses tar-codec, a new Rust tar encoding/decoding library built by Astral, as its default tar backend starting with uv 0.13. It replaces astral-tokio-tar, a fork chain originating from dignifiedquire/async-tar. The legacy backend can still be enabled by setting the environment variable UV_LEGACY_TAR_BACKEND=1. tar-codec was available earlier behind a --preview-features tar-codec flag since uv 0.12. Developers upgrading uv track backend changes like this on daily.dev before they hit a breaking default switch."}},{"@type":"Question","name":"Why did Astral replace uv's old tokio-tar based parser with a new implementation?","acceptedAnswer":{"@type":"Answer","text":"Astral found numerous security advisories and parser differentials in astral-tokio-tar that could let different tools (uv, pip) extract different contents from the same tarball, including 'append' and 'full' differential attacks. They concluded the tokio-tar family was too lenient by design and that retrofitting strict constraints would be more error-prone than a ground-up rewrite, which also delivered roughly 2x faster tar parsing performance. Teams weighing a parser rewrite against patching legacy code can compare real tradeoffs like these on daily.dev."}},{"@type":"Question","name":"How does tar-codec prevent parser differential attacks between different tar format families like GNU and pax?","acceptedAnswer":{"@type":"Answer","text":"tar-codec locks the entire parse to a single tar family, either UStar/pax or GNU, based on the first block's magic and version, and rejects archives whose headers don't agree on which family they belong to. This avoids the ambiguous state-mixing seen in other parsers, where stacking a GNU 'L' extension against a pax 'x' extension has unclear semantics and causes implementations to disagree on extraction results, creating exploitable desynchronization. Developers hardening file format parsers against desync bugs can follow design writeups like this on daily.dev."}}]} ```