Painless compression and decompression in the terminal https://crates.io/crates/ouch
  • Rust 96.1%
  • Shell 2%
  • Python 1.8%
  • Nix 0.1%
Find a file
valoq 77a7fac267
feat: add Landlock filesystem sandbox
Implement a per-process filesystem sandbox using Landlock (Linux ABI v6,
kernel ≥6.12) that confines decompression and listing to only the files
and directories the operation actually needs.

Key changes:

- New `src/sandbox/mod.rs` – `SandboxPolicy` builder that collects
  read, read-write, remove-in, and remove-dir-in grants.
- New `src/sandbox/landlock.rs` – Landlock backend requiring ABI v6,
  building a ruleset that denies execution, device-node creation,
  network access, and IPC scoping. Emits a warning when Landlock is
  unavailable.
- Integration into `commands/decompress.rs` – resolve output paths and
  build the sandbox policy *before* spawning the rayon thread pool so
  workers are confined; warn when `--dir`/`--here` points at $HOME.
- Integration into `commands/list.rs` – pre-open RAR spill tempfiles
  so `unrar` can read them through the sandbox.
- New `--no-sandbox` CLI flag (and `OUCH_NO_SANDBOX` env var) to
  disable confinement.
- `cargo test` runs with the sandbox enabled by default; test helpers
  strip any inherited `OUCH_NO_SANDBOX`.

---------

Co-authored-by: João Marcos <marcospb19@hotmail.com>
2026-07-03 23:06:06 -03:00
.github ci: bump actions/checkout in the github-actions group (#1009) 2026-06-17 20:59:29 -03:00
benchmarks Sort results.md (#791) 2025-04-14 13:24:27 -03:00
scripts edit DRAFT_NEW_RELEASE.md 2026-05-26 05:26:25 -03:00
src feat: add Landlock filesystem sandbox 2026-07-03 23:06:06 -03:00
tests feat: add Landlock filesystem sandbox 2026-07-03 23:06:06 -03:00
.gitignore add new release scripts 2026-05-26 02:56:59 -03:00
build.rs Improve man pages for subcommands (#980) 2026-05-11 01:48:30 -03:00
Cargo.lock feat: add Landlock filesystem sandbox 2026-07-03 23:06:06 -03:00
Cargo.toml feat: add Landlock filesystem sandbox 2026-07-03 23:06:06 -03:00
CHANGELOG.md feat: add Landlock filesystem sandbox 2026-07-03 23:06:06 -03:00
CONTRIBUTING.md Update CONTRIBUTING.md (#921) 2026-02-17 03:04:04 -03:00
Cross.toml chore: remove comment from Cross configuration 2024-09-06 21:47:03 -03:00
LICENSE Add LGPL legal notices for bzip3[-rs] 2024-11-17 14:50:02 -03:00
README.md chore: migrate Zlib and Bzip2 to use pure Rust libs 2026-05-18 02:15:52 -03:00
rust-toolchain.toml update dependencies (#969) 2026-05-18 02:07:45 -03:00
rustfmt.toml edition 2024 (#928) 2026-02-17 22:03:57 -03:00

Crates.io link License

Ouch!

ouch stands for Obvious Unified Compression Helper.

It's a CLI tool for compressing and decompressing various formats.

Features

  1. Easy to use.
  2. Fast.
  3. Great error message feedback.
  4. No runtime dependencies.
  5. Accessibility mode (see more).
  6. Shell completions and man pages.

Usage

ouch has three main subcommands:

  • ouch decompress (alias d)
  • ouch compress (alias c)
  • ouch list (alias l or ls)

To see help for a specific command:

ouch help <COMMAND>
ouch <COMMAND> --help  # equivalent

Decompressing

Use the decompress subcommand, ouch will detect the extensions automatically.

ouch decompress a.zip

# Decompress multiple files
ouch decompress a.zip b.tar.gz c.tar

The -d/--dir flag can be used to redirect decompression results to another directory.

# Decompress 'summer_vacation.zip' inside of new folder 'pictures'
ouch decompress summer_vacation.zip --dir pictures

Compressing

Pass input files to the compress subcommand, add the output file at the end.

# Compress two files into `archive.zip`
ouch compress one.txt two.txt archive.zip

# Compress file.txt using .lz4 and .zst
ouch compress file.txt file.txt.lz4.zst

ouch detects the extensions of the output file to decide what formats to use.

Listing

ouch list archive.zip

# Example with tree formatting
ouch list source-code.zip --tree

Output:

└── src
   ├── archive
   │  ├── mod.rs
   │  ├── tar.rs
   │  └── zip.rs
   ├── utils
   │  ├── colors.rs
   │  ├── formatting.rs
   │  ├── mod.rs
   │  └── fs.rs
   ├── commands
   │  ├── list.rs
   │  ├── compress.rs
   │  ├── decompress.rs
   │  └── mod.rs
   ├── accessible.rs
   ├── error.rs
   ├── cli.rs
   └── main.rs

Supported formats

Format .tar .zip .7z .gz .sz .zst .xz .lzma .lz .bz, .bz2 .bz3 .lz4 .rar .br
Supported ✓¹ ✓¹ ✓² ✓² ✓² ✓³

✓: Supports compression and decompression.

✓¹: Due to limitations of the compression format itself, (de)compression can't be done with streaming.

✓²: Supported, and compression runs in parallel.

✓³: Due to RAR's restrictive license, only decompression and listing can be supported.

If you wish to exclude non-free code from your build, you can disable RAR support by building without the unrar feature.

Aliases for these formats are also supported:

  • tar: tgz, tbz, tbz2, tlz4, txz, tlzma, tsz, tzst, tlz, cbt
  • zip: cbz, epub
  • 7z: cb7
  • rar: cbr

Formats can be chained:

  • .tar.gz
  • .tar.gz.xz.zst.gz.lz4.sz

If the filename has no extensions, ouch will try to infer the format by the file signature and ask the user for confirmation.

Installation

Packaging status

Refer to the packages list on the right.

The most commonly used installation methods:

On Arch Linux

pacman -S ouch

On MacOS via Homebrew

brew install ouch

On Windows via Scoop

scoop install ouch

From crates.io

cargo install ouch

(If you're on Ubuntu, you might need to install clang to build it from crates.io.)

Download the latest release bundle

Check the releases page.

Release binaries are signed with Sigstore via GitHub's artifact attestations. Verify a downloaded binary with the GitHub CLI:

gh attestation verify ouch-x86_64-unknown-linux-musl --repo ouch-org/ouch

Reproducing a release build

Release builds are reproducible. Given the source at a tagged commit, anyone can rebuild the same binary and check that it matches what we shipped. Steps:

git clone https://github.com/ouch-org/ouch
cd ouch
git checkout <tag>
export SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)
export RUSTFLAGS="--remap-path-prefix=$(pwd)=."
cargo build --locked --release --target <triple>

The toolchain version is pinned in rust-toolchain.toml and rustup will install it automatically. Cross-compiled targets (anything using cross-rs/cross) inherit the cross Docker image's toolchain, which is not pinned by digest yet, so those targets are bit-for-bit reproducible only against the same cross image release.

Compiling from source code

Check the wiki guide on compiling.

Benchmarks

Benchmark results are available here. Performance of compressing and decompressing Rust source code is measured and compared with Hyperfine. The values presented are the average (wall clock) elapsed time.

Note: ouch focuses heavily on usage ergonomics and nice error messages, but we plan on doing some optimization in the future.

Versions used:

Contributing

Contributions of all sizes are welcome and appreciated!

  • Open an issue.
  • Package it for your favorite distribution or package manager.
  • Share it with a friend!
  • Open a pull request.

If you're creating a Pull Request, check CONTRIBUTING.md.