.TAR File Format

Introduction

This is the standard tar format, the one POSIX defines. It is what bsdtar from libarchive writes by default, what Python’s tarfile module writes by default since Python 3.8, and what GNU tar writes with --format=ustar or --format=posix. Most archives met today are in it.

It covers three generations of tar, because each only adds to the one before:

• Version 7 tar (January 1979), the first tar. Its header is a name, mode, owner, size, time, checksum, type and link target in the first 257 bytes of a 512-byte block; the rest of the block is zeros.
• POSIX.1-1988 ustar puts a magic ustar, a version 00, the owner’s user and group names, device numbers and a 155-byte path prefix in the bytes Version 7 left unused, and adds type flags for symbolic links, devices, folders and FIFOs. A Version 7 reader ignores those bytes and reads a ustar header correctly.
• POSIX.1-2001 pax keeps the ustar header and adds two type flags, x and g, for extended headers whose data is a list of key and value records: paths of any length, sizes over 8 GiB, times with fractions, Unicode names. A ustar reader that does not know them extracts them as small regular files and reads the rest of the archive correctly. POSIX.1-2008, 2017 and 2024 keep the format unchanged.

A tar file dropped on any page of this site opens in the explorer, which shows its structure: each member’s header field by field, the pax records in front of it, its data, and the blocks that end the archive.

GNU tar’s own format and star’s use the same first 257 bytes but give the rest of the header other meanings, so they are separate formats; see all the tar variations.

Structure

An archive is a sequence of 512-byte blocks. Each member is a header block describing it, followed by its contents, padded with zeros to a whole number of blocks. A folder, a link or a device is a header with no contents; the header’s type flag says which it is. Two blocks of zeros end the archive.

There is no index. To list an archive, a reader reads each header, rounds the size in it up to a whole block to skip the data, and reads the next header. A global extended header, type g, may appear anywhere and applies to every member after it.

Telling it apart

The explorer’s parser for this format checks the first header. Its checksum must be right, summed as unsigned or as signed bytes. Bytes 257 to 262 must be ustar\0, with any version after them (a version other than 00 is reported), or all zero, as in a Version 7 header. And the header must not be star’s: no tar\0 at byte 508, and not star’s time fields at 476 and 488. An archive with no members, only zero blocks, is shown as this format, since it has no header to tell its format by.

A header whose bytes 257 to 264 are ustar, two spaces and a NUL is a GNU tar archive, and one with star’s signature or times is a star archive. The explorer then tries those parsers instead. Headers of other kinds inside an archive are still decoded by their own magic.

Variants

• POSIX ustar and pax archive – the POSIX header with the “ustar” magic, owner names and a 155-byte prefix; pax adds records
• GNU tar archive – GNU tar’s own header, with times and sparse maps where ustar has the prefix
• Schily tar archive (star) – star’s header: a 131-byte prefix, with access and change times after it

Links