Tarvertise — Put a message in your tarballs

While working on Deduptar I ran into a bug in GNU tar — it doesn't terminal-control-code-escape PAX label names when it complains on stderr that it doesn't recognize said label.

The implication of this is that you can surprise GNU tar users by letting them unpack crafted tarballs. You can let tar print a message when it has finished unpacking — "Thank you for unpacking our tarball". You can embed terminal control codes in there to render colored text. ASCII art is an option. You can monetize your tarballs and rent out advertising space. And you can embed graphics of various sorts, though your mileage may vary since terminal capabilities also vary. You can even let tar ... play a movie! See below.

I've emailed the maintainers off-list as I thought this bug might be lightly security-sensitive, and they've fixed it promptly.

Here's a research tool I made to craft tar archives with such messages in them:

• Source code
• amd64 Linux binary

And here's video material from All Systems Go 2023 that demonstrates the bug.