Pakko — Windows ZIP Archiver

Minimal WinUI 3 GUI wrapper for Windows built-in ZIP support.

No 7-Zip. No WinRAR. No third-party compression code.

🌐 Project website · 🛒 Get it from Microsoft Store · ☕ Support the project on Ko-fi · 🇺🇦 Українською

---

Why Not 7-Zip or WinRAR?

Pakko uses a different trust model — not a claim of absolute security superiority, but a different set of supply chain dependencies with different auditability properties. Both tools have supply chain characteristics (developer jurisdiction, no reproducible builds, CVE history) that some security-conscious environments find unacceptable.

For the full CVE tables and rationale, see SECURITY.md (the canonical source).

---

What Pakko Uses Instead

Component	Source	Auditability
ZIP compression	System.IO.Compression — .NET BCL	Open source, part of .NET runtime
UI framework	WinUI 3 / Windows App SDK	Open source on GitHub

The entire compression stack is part of the .NET Base Class Library — maintained by Microsoft with a public CVE process, reproducible builds, and community audit via dotnet/runtime.

Trust dependency: The .NET runtime and Windows App SDK are themselves trust dependencies. Pakko's security properties depend on the integrity of Microsoft's supply chain and build infrastructure. Organizations that trust the Microsoft/.NET ecosystem will find this architecture auditable; those that do not should evaluate accordingly.

---

Security Properties

• No third-party compression dependencies — attack surface limited to .NET runtime
• Open source — full codebase auditable
• Minimal permissions — no network access, no background services
• No telemetry — no data leaves the machine
• Mark of the Web (MOTW) propagation — extracted files inherit Zone.Identifier from the archive by default; prevents macro execution in extracted Office docs (7-Zip does not do this by default)
• No libarchive in-process — tar/RAR/7z extraction via isolated tar.exe subprocess, sandboxed in an AppContainer with no network capability, not an in-process parser
• Group Policy / ADMX support — administrators can lock down risky features (e.g. tar-family extraction) fleet-wide; see docs/POLICIES.md

---

Tech Stack

Layer	Technology
UI	WinUI 3 + Windows App SDK
Language	C# 12 / .NET 10 LTS
Compression	System.IO.Compression (ZIP)
Distribution	MSIX (self-contained)
Min OS	Windows 10 1809 (build 17763) / Windows Server 2019
License	Apache 2.0

---

Supported Formats

Format	Status	Method
ZIP	✅ read/write, v1.0	System.IO.Compression
TAR/GZ/BZ2/XZ/ZST/LZMA	✅ read (v1.3) + create (v1.4)	tar.exe (Windows built-in), AppContainer-sandboxed for extraction
RAR	✅ read only, v1.3	tar.exe (Windows built-in) — libarchive has no RAR writer
7z	✅ read only, v1.3	tar.exe (Windows built-in) — libarchive has no 7z writer
Password-protected ZIP	✅ read (ZipCrypto, WinZip AES) and create (AES-256 only)	System.IO.Compression + .NET cryptography
Encrypted 7z/RAR	❌ detected and refused with a clear error	—

---

Windows 11 Integration

Pakko closes gaps in Windows Explorer:

• Native context menu — Open, Extract here, Extract to folder, Add to X.zip, Add to X.tar, Compress…, Test archive, Scan for threats, Hash: CRC-32 / SHA-256 (both the modern IExplorerCommand menu and the classic "Show more options" menu); each command runs in a Pakko window with progress, a password prompt and a conflict dialog
• File type associations — double-click any supported archive format opens directly into Pakko's Archive Browser, not just .zip
• Archive Browser — navigate an archive's folder structure without extracting everything first, extract a selection or the whole archive, then climb past the archive root into the real filesystem (drives, "This PC") the same way NanaZip's classic file manager does
• Scan for threats — hands an archive's contents to the antivirus installed on the machine (through Windows' AMSI interface), password-protected ZIP entries included
• Recovery data (PAR2) — standard PAR 2.0 files written next to a new archive (5, 10 or 20 %), then "Verify with PAR2" and "Repair with PAR2" in the menu and the app; the repaired copy is a new file and the original is only read. par2cmdline and MultiPar read Pakko's sets, and Pakko reads theirs
• Group Policy / ADMX — administrators can disable tar-family extraction and other risk-relevant features fleet-wide via a real ADMX template; see docs/POLICIES.md

Windows 11 23H2+ includes tar.exe (Microsoft-signed bsdtar), which Pakko uses — no third-party compression tools — to read RAR/7z/tar/gz/bz2/xz/zst/lzma, and to create tar-family archives (plain tar plus the five compression-filter variants).

---

Command-Line Interface

pakko.exe (project name Archiver.CLI) is a standalone, self-contained command-line build with 7z-familiar commands (x/t/i/a/l, and r to repair from PAR2 files) — it runs independently of the GUI/MSIX. See docs/CLI.md for the full command/switch specification. Download it as its own per-architecture zip (with a SHA256SUMS file for verification) from the project's GitHub Releases page — every version tag is built and published there automatically. The zip is not added to PATH; from v1.7.0 the Microsoft Store/MSIX install also gives the pakko command in any terminal, and the zip can be installed with winget once the winget catalog accepts the package — see docs/CLI.md's "Distribution" section.

---

Project Status

ZIP archive/extract (with passwords), the native shell extension (context menu, file associations, MOTW propagation), sandboxed RAR/7z/tar-family read + tar-family create via tar.exe, the Archive Browser, antivirus scan, PAR2 recovery data, the pakko command line and Group Policy/ADMX support are all implemented and on-device verified. Per-release history: CHANGELOG.md.

• ✅ Archive (single / separate) with compression level selector, ZIP or any tar-family format
• ✅ Extract with smart folder logic, ZIP slip protection, and a per-conflict Ask/Overwrite/ Rename/Skip resolution
• ✅ Password-protected ZIP — extract, test, browse, and threat-scan (ZipCrypto + WinZip AES), with a password prompt in the app, the Explorer menu, and the CLI (-p); create AES-256 encrypted ZIPs from the app or pakko a -p (file names inside the archive stay visible)
• ✅ System tray icon
• ✅ File log (%LocalAppData%\Pakko\logs\pakko.log)
• ✅ i18n — 37 locales, OS-language auto-match with English fallback
• ✅ MSIX packaging, signed with a dev cert via Deploy.ps1
• ✅ Mid-file cancellation (async streaming)
• ✅ Safe temp file/dir pattern — no partial files on cancel
• ✅ Compression-ratio bomb detection (1000:1 threshold), confirm-and-extract if the destination has room, for ZIP and every tar-family format
• ✅ UTF-8 filenames — Cyrillic and emoji round-trip verified
• ✅ Native right-click context menu — Open, Extract here, Extract to folder, Add to X.zip/X.tar, Compress…, Test archive, Scan for threats, Hash (CRC-32, SHA-256)
• ✅ Scan for threats — archive contents checked by the installed antivirus through AMSI
• ✅ Extracted files and folders keep the dates stored in the archive
• ✅ Recovery data (PAR2) — created next to an archive from the app or pakko a -rr, verified by pakko t, Explorer and the app, repaired into a new file by pakko r, Explorer and the app
• ✅ pakko command line — in any terminal after a Store install, or as a standalone zip
• ✅ File type association (every readable format). No URI protocol is registered (the former pakko:// scheme was removed), so a web page cannot launch Pakko through a link of its own
• ✅ MOTW propagation on extracted files by default, always for Archive Browser previews; the user may leave it off for one trusted archive, unless Group Policy decides
• ✅ Alternate Data Stream / reserved-filename / reparse-point protections during extraction
• ✅ Archive Browser — navigate, extract selected/all, preview an image or text file without a manual extract, climb past the archive root into the real filesystem
• ✅ RAR/7z/tar-family extraction runs inside an AppContainer sandbox — quarantine staging, ACL'd output directory, Job Object process limits, no network capability
• ✅ Group Policy / ADMX support — see docs/POLICIES.md
• ✅ Full automated test suite, run on every push in CI (see the Build Status badge above)

Now available on the Microsoft Store: https://apps.microsoft.com/detail/9p5mw010d8pr (also installable via winget install 9P5MW010D8PR --source msstore). GitHub Releases remain available as an alternative for every version tag.

See docs/SPEC.md's "Future Roadmap" section for the version-to-focus table, and docs/TASKS.md for the detailed task list.

---

Known Issues

• Context menu flickers on the first right-click in a newly opened Explorer window — this is a known Windows Explorer verb/icon-cache artifact (Explorer caches top-level shell-extension verbs across COM DLL registrations until it requeries them), not a Pakko bug.

---

Building and Deploying

Prerequisites: Visual Studio 2026 (.NET desktop + Desktop C++ workloads, MSVC v143 x64/ARM64 build tools), .NET 10 SDK.

See scripts/README.md for the full build/sign/deploy steps and CONTRIBUTING.md for the contributor workflow. Production code signing with a trusted certificate is planned (T-F10) — see docs/SIGNING.md for Pakko's Code Signing Policy (team roles, build process, and artifacts covered).

---

Running Tests

dotnet test --filter "Category!=Slow&Category!=VeryLarge"

Always run without a path argument — all projects must stay green after every change. See docs/TESTING.md for the full test plan, fixture generation, and the Category=Slow/Category=VeryLarge tiers.

---

Documents

• Developer / API Docs — generated site: architecture, conventions, CLI reference, and an API reference built from Archiver.Core's own XML doc comments
• Changelog — per-release history
• Security Policy — threat model, CVE tables, mitigations
• Privacy Policy
• Code Signing Policy
• Group Policy / ADMX Reference
• CLI Command Reference
• Contributing Guide
• Code of Conduct
• License (Apache 2.0)