---
# pages-g39t
title: Support .tar.gz / .tgz uploads (gzip)
status: completed
type: task
priority: normal
created_at: 2026-07-21T04:15:09Z
updated_at: 2026-07-21T04:33:38Z
parent: pages-w7ow
---

Wire gzip-compressed tar archives through the dispatch foundation.

- Crate: `flate2 = { version = \"1\", default-features = false, features = [\"rust_backend\"] }` in `[dependencies]` (pure-Rust miniz_oxide backend; wasm-safe).
- Streaming path: raw bytes -> `flate2::read::GzDecoder` (or `MultiGzDecoder`) -> `build_tar_manifest`. Each tar entry Read flows through `read_entry_limited` unchanged.
- Detect via gzip magic `1f 8b`.
- Tests (mirror the zip tests in core/upload.rs): happy multi-file-with-subdirs, missing index.html, path traversal, per-file/total limits, and a gzip tar-bomb rejected by the streaming guard. Build fixtures in-memory with the `flate2`+`tar` writers.

## Summary of Changes
gzip via `flate2` (rust_backend/miniz_oxide). Streaming path: bytes -> GzDecoder -> read_tar_entries; each tar entry flows through read_entry_limited so the bomb guard is preserved. Tests: happy multi-file+subdirs, missing index, traversal, per-file/total limits, streaming bomb.