tar and gzip

Archiving and compression solve different problems. An archive combines a directory tree and its metadata into one stream. Compression encodes a stream to reduce its size. A .tar.gz file is conventionally a tar archive whose stream has been compressed with gzip.

Compressing One Stream with gzip

By default, gzip compresses a file and replaces the original name with a .gz file:

$ gzip report.txt

This normally removes report.txt after successfully creating report.txt.gz. Decompress it with:

$ gunzip report.txt.gz

Use gzip -k report.txt where supported to keep the input file, or use standard streams when you need explicit control. A filename extension is a convention, not proof of the actual format; tools such as file can inspect content.

Creating a Tar Archive

Create an uncompressed archive with:

$ tar -cvf project.tar file1 file2 directory1

• -c creates a new archive.
• -v lists members while processing and is optional.
• -f project.tar names the archive file; because -f consumes an argument, keep the filename beside it.

Paths are stored as archive member names. Create archives from a deliberate working directory and avoid unintentionally capturing secrets, caches, sockets, or broad absolute paths.

Creating a Gzip-Compressed Tar Archive

GNU tar and many other implementations can invoke gzip with -z:

$ tar -czvf project.tar.gz file1 file2 directory1

The result is one gzip-compressed tar stream. Compression does not encrypt the archive or hide its contents from someone who can read and decompress it. If confidentiality is required, use an appropriate authenticated-encryption workflow and manage keys separately.

Listing Before Extracting

Treat an archive from another party as untrusted input. List its member names first:

$ tar -tzf download.tar.gz

Look for unexpected absolute paths, .. traversal components, surprising symbolic or hard links, device files, and names that would overwrite important files. Modern tar implementations apply protections, but behavior and options vary, and extracting still creates attacker-chosen names and content.

Extract into a newly created, nonprivileged staging directory:

$ mkdir extraction-stage
$ tar -xzf download.tar.gz -C extraction-stage

Do not extract an unreviewed archive as root. Verify what was created before moving selected files to their final locations.

Other Compression Formats

Tar implementations can work with compressors such as bzip2 and xz, commonly selected with -j and -J respectively in GNU tar. Format support and automatic detection differ, so consult tar --help or the local manual. ZIP is a separate archive format operated with tools such as zip and unzip.

Practice with disposable files in File Packaging and Compression, then apply inspection and staging in Create and Restore a Backup with tar.

Summary

You can now combine tar archiving with gzip compression safely.

1. Distinguish a tar archive from gzip compression.
2. Create archives with -c and gzip streams with -z.
3. List members with -t before extracting with -x.
4. Extract untrusted content into a nonprivileged staging directory.
5. Treat compression as separate from encryption.