◉ COOLJAPAN
← All posts
July 13, 2026 • 10 min read

OxiArc 0.3.6 Released — The 75-Item Audit That Ended Five Private Codec Dialects

OxiArc 0.3.6 pairs a security-hardening pass with a 22-auditor, 75-item reference-interop campaign: zstd's FSE fix takes real-frame decode from 0/64 to 64/64, brotli's RFC 7932 rewrite goes 141/172 failures to 608/608, plus LZMA2, bzip2, and SZIP fixes. 2,426 tests passing, Pure Rust.

release oxiarc zstd brotli lzma security interop fuzzing pure-rust compression

A codec that only round-trips against itself hasn’t been tested — it’s been rehearsed.

Today we released OxiArc 0.3.6 — a release that bundles two hardening passes from the same development cycle: a 2026-07-08 security-hardening and API-stabilization pass, and a 2026-07-13 reference-interoperability campaign that ran 22 auditors across zstd, brotli, LZMA/XZ, bzip2, SZIP, LZW/TIFF, DEFLATE wrappers, LZ4, Snappy, LZHUF, and every archive container format — and found that several codecs weren’t merely buggy, they were private dialects: internally consistent, perfectly self-round-tripping, and almost completely unable to talk to the reference implementation they claimed to support.

No C, no Fortran, no zlib, no libarchive, no external shared libraries. Just clean, memory-safe, blazing-fast archiving and compression that compiles to a single static binary, targets WASM, and runs everywhere. OxiArc is the Pure Rust replacement for the zip, tar, gzip, zstd, and 7-zip tools — and for the Rust crates zip, flate2, zstd, bzip2, lz4, tar, snap, brotli, and miniz_oxide.

Why OxiArc 0.3.6 is a game changer

“We pass our own test suite” has always been a weaker claim than it sounds. Self round-trips alone cannot prove interoperability — an encoder and decoder that share the same deviation from a spec will round-trip perfectly while being incompatible with everything else. A 22-auditor differential investigation found exactly that hiding in five codecs — zstd, brotli, LZMA2/XZ, TIFF-LZW, and SZIP each passed their own tests while failing against the real reference implementation in both directions. The resulting 75-item remediation plan (P0-P3, all 75 shipped) includes:

Technical Deep Dive

OxiArc’s four-layer architecture is what let a 22-auditor campaign attack the whole codebase systematically instead of chasing bugs one file at a time:

  1. L1 — oxiarc-core: the primitives everything else trusts. BitReader/BitWriter (LSB-first for DEFLATE-family formats, MSB-first via msb_bitstream for LZH/LHA), RingBuffer, and slicing-by-8 CRC-16/32/64 with aarch64 PMULL / x86_64 PCLMULQDQ+SSE4.1 SIMD paths. 0.3.6 fixes a CRC SIMD diagnostics misreport (the dispatched code path was already correct; only is_simd_available()/implementation_name() lied about which one), adds non-panicking RingBuffer::try_new/OutputRingBuffer::try_new for untrusted window sizes, and makes BitReader::fill_buffer loop on short reads instead of erroring on valid pipe/socket streams.
  2. L2 — ten codec crates, where the private dialects lived. oxiarc-zstd, oxiarc-brotli, oxiarc-lzma, oxiarc-bzip2, oxiarc-szip, oxiarc-lzw, oxiarc-lz4, oxiarc-lzhuf, oxiarc-snappy, and oxiarc-deflate each implement one format’s algorithm in isolation — exactly where a self-consistent-but-wrong bitstream can hide indefinitely. Every one of these crates is now gated by a reference-differential oracle feature.
  3. L3 — oxiarc-archive: the container layer where hostile input meets the parser. Thirteen formats (ZIP, TAR, GZIP, LZH, XZ, 7z, CAB, LZ4, Zstd, Bzip2, Brotli, Snappy, ISO 9660) share this crate, and it absorbed most of the memory-safety fixes: a ZIP AES integer-underflow panic, a DOS-date month=0 underflow, spanned-ZIP rejection, a TAR PAX slice-index panic, an ISO 9660 cyclic-directory DoS, a 7z unbounded-varint allocation, and a ZIP-encryption-detection fix that now reads the actual general-purpose bit 0 instead of a homegrown marker only OxiArc’s own writer ever produced.
  4. L4 — oxiarc-cli: where --memory-limit has to mean what it says. The CLI is the last mile between an untrusted file and a bounded process — the one flag whose entire job is standing between a user and a decompression bomb, which is why closing its silent-no-op gap mattered as much as any codec fix in this release.

Getting Started

cargo install oxiarc-cli

cargo add [email protected]

use oxiarc_archive::ZipReader;
use std::fs::File;

fn read_zip() -> oxiarc_core::error::Result<()> {
    let file = File::open("archive.zip")?;
    let mut zip = ZipReader::new(file)?;

    for entry in zip.entries() {
        println!("{}: {} bytes (compressed: {})",
            entry.name, entry.size, entry.compressed_size);
    }

    if let Some(entry) = zip.entry_by_name("readme.txt").cloned() {
        let data = zip.extract(&entry)?;
        println!("Content: {}", String::from_utf8_lossy(&data));
    }

    Ok(())
}

Nothing about this API changed in 0.3.6 — what changed is what’s on the other side of it. A ZIP built by 7-Zip, WinRAR, or zip -e, and a .xz/.bz2/.zst/.br/.tiff file produced by any standard reference tool, now round-trip through OxiArc exactly the way they round-trip through their own reference implementation.

What’s New in 0.3.6

Tips

This is the foundation

Interoperability at the bitstream level is what lets OxiArc sit underneath the rest of the ecosystem without surprises. OxiGDAL is the direct beneficiary of the flagship zstd fix — the 64 real-world Zarr v3 zstd frames that triggered this entire campaign now decode 64/64 byte-identical through the CLI, clearing the way for OxiGDAL to bump its dependency and retire a long-standing #[ignore]. OxiRS routes its zstd-shim compatibility layer straight through oxiarc-zstd. FVRS, OxiMedia, SciRS2/NumRS2, RusMES, and ToRSh all pin oxiarc-* crates for the same archive and compression paths, wherever they read or write formats that also need to open correctly outside the COOLJAPAN ecosystem.

Repository: https://github.com/cool-japan/oxiarc

Star the repo if you want an archiver that doesn’t just trust its own round-trip tests, but proves it against the tools everyone else actually uses.

The era of the private dialect that quietly passes its own test suite is over. Pure Rust archiving that’s byte-for-byte compatible — audited by 22 people against every reference implementation that matters — is here.

— KitaSan at COOLJAPAN OÜ July 13, 2026

↑ Back to all posts