How do I inspect and extract a trusted archive into a separate directory?
Inspect an archive’s contents and origin before extracting it. Use an empty destination outside a live application tree and a nonprivileged account. Archive entries can include links and unusual paths, so a listing is useful context but not a guarantee that arbitrary untrusted content is safe.
Before you start
- An authorised SSH session on the Linux server.
Instructions
1. List the archive without extracting it
Use the exact downloaded file and verify its integrity through the publisher’s trusted process. Review entry names, links and expected top-level layout.
tar -tvf "$HOME/server-notes/release.tar.gz"GNU tar can detect common compression formats while reading. Reject unexpected absolute paths, traversal components or unrelated files.
2. Extract into a new controlled directory
Create a destination that is not a live document root. Keep owner and permission restoration constrained and refuse to replace existing files.
mkdir -- "$HOME/server-notes/release-review" &&
tar --extract --file="$HOME/server-notes/release.tar.gz" --directory="$HOME/server-notes/release-review" --no-same-owner --no-same-permissions --keep-old-filesRun without sudo. The && guard allows extraction only when the new destination was created successfully. If it already exists, inspect it and choose a new controlled directory before extraction.
Check the result
- Only the expected files appear under the review directory, with appropriate local ownership and no unintended overwrite. Deployment is a separate reviewed step.
Troubleshooting
- An archive is from an untrusted source
- Use a properly isolated analysis environment rather than extracting it on a production server.
- tar refuses an existing file
- That protection is intentional. Inspect the destination instead of adding an overwrite option.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.