The typeflag byte at offset 156 of the
header says what kind of member it
describes. It is a single ASCII character. GNU tar uses the POSIX flags for files, links
and folders, and capital letters of its own for long names, sparse files, incremental
backups and multi-volume archives. The names in the tables are those of GNU tar’s
tar.h.
Files, links and folders
| Flag | Name | Member | Description | Data |
|---|---|---|---|---|
0 (30) | REGTYPE | Regular file | The data blocks after the header are the file’s contents. | size bytes |
NUL (00) | AREGTYPE | Regular file | The old form of 0, “kept for compatibility”. A name ending in / is a folder. | size bytes |
1 | LNKTYPE | Hard link | Another name for a file stored earlier in the archive; linkname names it. | none |
2 | SYMTYPE | Symbolic link | linkname holds the target. | none |
3 | CHRTYPE | Character device | devmajor and devminor give the device numbers. | none |
4 | BLKTYPE | Block device | As for a character device. | none |
5 | DIRTYPE | Directory | A folder. In an incremental archive, a folder is written as D instead. | none |
6 | FIFOTYPE | FIFO | A named pipe. | none |
7 | CONTTYPE | Contiguous file | Read as a regular file. | size bytes |
For types 1 to 6, readers such as Go and libarchive skip no
data whatever size says. The explorer does the same, and follows the size
only when the block after the header is not a header and the block after the data
would be, reporting it when it does.
Extended headers
A GNU-format archive should not contain pax headers: GNU tar writes them only in its
posix format, whose headers carry the POSIX magic. Readers still meet
them in mixed archives, and the explorer decodes an x, g or
Solaris X header in a GNU archive as POSIX describes it, linking to the
pax extensions of the ustar
format.
| Flag | Name | Header |
|---|---|---|
x | XHDTYPE | Extended header: records for the next member. |
g | XGLTYPE | Global extended header: records for every following member. |
X | SOLARIS_XHDTYPE | Solaris’s extended header, read like x. |
GNU tar’s flags
| Flag | Name | Member | Data |
|---|---|---|---|
D | GNUTYPE_DUMPDIR | A folder in an incremental backup, with the list of names it held: see dump directories. | the dumpdir |
K | GNUTYPE_LONGLINK | The next member’s link target: see long names. | the text and a NUL |
L | GNUTYPE_LONGNAME | The next member’s name: see long names. | the text and a NUL |
M | GNUTYPE_MULTIVOL | The rest of a file begun on the previous volume: see multi-volume. | size bytes |
N | – | Old long names, no longer written: see old names. | size bytes |
S | GNUTYPE_SPARSE | A file with holes: see sparse files. | the stored parts |
V | GNUTYPE_VOLHDR | The archive’s volume label: see volume labels. | none in practice |
Dump directories (D)
GNU tar’s incremental backups (--listed-incremental) write each folder as
a D member. Its data, the dumpdir, lists the names the folder held when the
backup was made, so that restoring can delete files removed since an earlier backup,
and can carry out renames. The GNU manual:
- Each entry is a one-letter control code, a name and a NUL.
- “Each dumpdir ends with a single nul character”, so the list ends with an empty name.
| Code | Meaning | Name |
|---|---|---|
Y | The file is in this archive. | relative to the folder |
N | The file has not changed since the last backup and is not in this archive. | relative |
D | A folder. | relative |
R | Rename this file to the name in the next T entry. | absolute |
T | The new name for the R before it. | absolute |
X | A temporary folder used while renaming. | absolute |
An example from Go’s test archive gnu-incremental.tar, whose first member
is a D folder. Its data, at 0x200:
00000200 59 66 6F 6F 00 59 73 70 61 72 73 65 00 00 Yfoo.Ysparse..Yfoo and Ysparse, then the empty name that ends the list.Members of such archives carry their access and change times in the
GNU fields, and in Go’s
test data their mode holds the whole file mode, such as 0100644. In pax
archives GNU tar puts the same list in a GNU.dumpdir record instead.
Multi-volume continuations (M)
A multi-volume archive (--multi-volume) is split across tapes or files.
When a file does not fit on one volume, the next volume starts with an
M header for it, holding the rest of the file. Its
offset field, at byte 369, says where in the whole file this part
begins, and its size is the length of this part. A reader that does not
know M extracts the part as a file of its own.
Volume labels (V)
An archive made with a label (--label) starts with a V
header whose name holds the label; tar(5) calls it “a tape/volume header
name”. It describes the archive, not a file, and has no data in practice.
Old long names (N)
Early versions of GNU tar stored long names in N members. tar(5): they
are “no longer generated” and “generally ignored when reading”. The explorer shows
their data as it is.
Other flags
POSIX reserves A to Z for vendors. Besides GNU tar’s own,
readers meet these:
| Flag | From | Meaning |
|---|---|---|
A | Solaris | An access control list. tar(5): the data is a seven-digit octal number and a NUL, then the ACL; 01000000 is POSIX.1e, 03000000 NFSv4. AIX also writes A, after the file’s data. |
E | Solaris | An extended attribute file. |
I | star | Inode metadata only, with no data. |
A reader that meets a flag it does not know treats the member as a regular file. The explorer does the same, and shows the flag as an unknown type.