---
# pages-wadp
title: Support .tar.zst uploads (zstd)
status: completed
type: task
priority: normal
created_at: 2026-07-21T04:15:13Z
updated_at: 2026-07-21T04:33:38Z
parent: pages-w7ow
---

Wire zstd-compressed tar archives through the dispatch foundation.

- Crate: `ruzstd = \"0.8\"` in `[dependencies]` (pure-Rust, no_std-capable zstd decoder; wasm-safe).
- Streaming path: raw bytes -> `ruzstd::StreamingDecoder` (implements io::Read) -> `build_tar_manifest`. Each tar entry Read flows through `read_entry_limited` unchanged.
- Detect via zstd magic `28 b5 2f fd`.
- Tests: happy path, missing index.html, path traversal, size limits, zstd tar-bomb rejected by the streaming guard. `ruzstd` is decode-focused — build .tar.zst fixtures with a real zstd encoder available in the dev shell, or vendor a small precompressed fixture; prefer generating in-test if an encoder crate is acceptable (else document the fixture).

## Summary of Changes
zstd via `ruzstd` 0.8 StreamingDecoder (pure Rust). Streaming path preserves the bomb guard. Fixtures built with ruzstd's own encoder (no C dev-dep). Tests: happy, missing index, traversal, limits, streaming bomb, corrupt-frame.