BlobDive: inspect nested archives with explicit limits and structured output
I'm building BlobDive, an open-source Rust CLI for understanding unfamiliar software artifacts without extracting archive entries to disk.
It detects formats from content and inspects nested ZIP/TAR/GZIP archives with explicit limits on depth, entries, decompressed bytes, output size, and time. JSON/NDJSON output and deterministic references make the results useful for agent and CI workflows.
Example:
blobdive --format json inspect release.zip --depth 2 --max-entries 200
The current release is 0.3.0, under the MIT license. Recursive archive inspection currently covers ZIP/TAR/GZIP; additional recognized formats may be detection-only.
Repo, installation, and usage: github.com/yhay81/blobdive
What artifact or archive edge case trips up your agent or CI workflow today? I'd welcome realistic examples and feedback on the output contract.






1 comment
Opening a suspicious file without unpacking it sounds like it protects people from a real worry. Who feels that pain most today: security teams, software vendors, or the developers receiving releases? And have any of them told you what they would pay to avoid a bad surprise inside an archive?