tar-stream is a streaming tar parser and generator.
Installations
npm install tar-stream
Releases
Unable to fetch releases
Developer
mafintosh
Developer Guide
Module System
CommonJS, UMD
Min. Node Version
Typescript Support
No
Node Version
20.10.0
NPM Version
10.2.3
Statistics
414 Stars
238 Commits
93 Forks
8 Watching
1 Branches
44 Contributors
Updated on 18 Nov 2024
Bundle Size
41.35 kB
Minified
11.78 kB
Minified + Gzipped
Languages
JavaScript (100%)
Total Downloads
Cumulative downloads
Total Downloads
4,263,481,019
Last day
-0.5%
5,752,175
Compared to previous day
Last week
4.1%
30,570,603
Compared to previous week
Last month
10.3%
126,207,597
Compared to previous month
Last year
40.8%
1,350,752,866
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
tar-stream
tar-stream is a streaming tar parser and generator and nothing else. It operates purely using streams which means you can easily extract/parse tarballs without ever hitting the file system.
Note that you still need to gunzip your data if you have a .tar.gz
. We recommend using gunzip-maybe in conjunction with this.
npm install tar-stream
Usage
tar-stream exposes two streams, pack which creates tarballs and extract which extracts tarballs. To modify an existing tarball use both.
It implementes USTAR with additional support for pax extended headers. It should be compatible with all popular tar distributions out there (gnutar, bsdtar etc)
Related
If you want to pack/unpack directories on the file system check out tar-fs which provides file system bindings to this module.
Packing
To create a pack stream use tar.pack()
and call pack.entry(header, [callback])
to add tar entries.
1const tar = require('tar-stream') 2const pack = tar.pack() // pack is a stream 3 4// add a file called my-test.txt with the content "Hello World!" 5pack.entry({ name: 'my-test.txt' }, 'Hello World!') 6 7// add a file called my-stream-test.txt from a stream 8const entry = pack.entry({ name: 'my-stream-test.txt', size: 11 }, function(err) { 9 // the stream was added 10 // no more entries 11 pack.finalize() 12}) 13 14entry.write('hello') 15entry.write(' ') 16entry.write('world') 17entry.end() 18 19// pipe the pack stream somewhere 20pack.pipe(process.stdout)
Extracting
To extract a stream use tar.extract()
and listen for extract.on('entry', (header, stream, next) )
1const extract = tar.extract() 2 3extract.on('entry', function (header, stream, next) { 4 // header is the tar header 5 // stream is the content body (might be an empty stream) 6 // call next when you are done with this entry 7 8 stream.on('end', function () { 9 next() // ready for next entry 10 }) 11 12 stream.resume() // just auto drain the stream 13}) 14 15extract.on('finish', function () { 16 // all entries read 17}) 18 19pack.pipe(extract)
The tar archive is streamed sequentially, meaning you must drain each entry's stream as you get them or else the main extract stream will receive backpressure and stop reading.
Extracting as an async iterator
The extraction stream in addition to being a writable stream is also an async iterator
1const extract = tar.extract() 2 3someStream.pipe(extract) 4 5for await (const entry of extract) { 6 entry.header // the tar header 7 entry.resume() // the entry is the stream also 8}
Headers
The header object using in entry
should contain the following properties.
Most of these values can be found by stat'ing a file.
1{ 2 name: 'path/to/this/entry.txt', 3 size: 1314, // entry size. defaults to 0 4 mode: 0o644, // entry mode. defaults to to 0o755 for dirs and 0o644 otherwise 5 mtime: new Date(), // last modified date for entry. defaults to now. 6 type: 'file', // type of entry. defaults to file. can be: 7 // file | link | symlink | directory | block-device 8 // character-device | fifo | contiguous-file 9 linkname: 'path', // linked file name 10 uid: 0, // uid of entry owner. defaults to 0 11 gid: 0, // gid of entry owner. defaults to 0 12 uname: 'maf', // uname of entry owner. defaults to null 13 gname: 'staff', // gname of entry owner. defaults to null 14 devmajor: 0, // device major version. defaults to 0 15 devminor: 0 // device minor version. defaults to 0 16}
Modifying existing tarballs
Using tar-stream it is easy to rewrite paths / change modes etc in an existing tarball.
1const extract = tar.extract() 2const pack = tar.pack() 3const path = require('path') 4 5extract.on('entry', function (header, stream, callback) { 6 // let's prefix all names with 'tmp' 7 header.name = path.join('tmp', header.name) 8 // write the new entry to the pack stream 9 stream.pipe(pack.entry(header, callback)) 10}) 11 12extract.on('finish', function () { 13 // all entries done - lets finalize it 14 pack.finalize() 15}) 16 17// pipe the old tarball to the extractor 18oldTarballStream.pipe(extract) 19 20// pipe the new tarball the another stream 21pack.pipe(newTarballStream)
Saving tarball to fs
1const fs = require('fs') 2const tar = require('tar-stream') 3 4const pack = tar.pack() // pack is a stream 5const path = 'YourTarBall.tar' 6const yourTarball = fs.createWriteStream(path) 7 8// add a file called YourFile.txt with the content "Hello World!" 9pack.entry({ name: 'YourFile.txt' }, 'Hello World!', function (err) { 10 if (err) throw err 11 pack.finalize() 12}) 13 14// pipe the pack stream to your file 15pack.pipe(yourTarball) 16 17yourTarball.on('close', function () { 18 console.log(path + ' has been written') 19 fs.stat(path, function(err, stats) { 20 if (err) throw err 21 console.log(stats) 22 console.log('Got file info successfully!') 23 }) 24})
Performance
See tar-fs for a performance comparison with node-tar
License
MIT
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
no binaries found in the repo
Reason
0 existing vulnerabilities detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
Found 12/30 approved changesets -- score normalized to 4
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/test-node.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-node.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/mafintosh/tar-stream/test-node.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-node.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/mafintosh/tar-stream/test-node.yml/master?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/test-node.yml:23
- Info: 0 out of 2 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 npmCommand dependencies pinned
Reason
branch protection not enabled on development/release branches
Details
- Warn: branch protection not enabled for branch 'master'
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 13 are checked with a SAST tool
Score
4.4
/10
Last Scanned on 2024-11-18
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn MoreOther packages similar to tar-stream
tar-fs
filesystem bindings for tar-stream
@types/tar-stream
TypeScript definitions for tar-stream
tar-stream-compat
tar-stream is a streaming tar parser and generator and nothing else. It is streams2 and operates purely using streams which means you can easily extract/parse tarballs without ever hitting the file system.
@chartiq/vinyl-tar
vinyl binding for tar-stream