+2026-05-07 11:32 Christos Zoulas <christos@zoulas.com>

+

+ * release 5.48

+

+2026-05-11 15:55 Christos Zoulas <christos@zoulas.com>

+

+ * add landlock support (valoq)

+

+2026-04-19 15:55 Christos Zoulas <christos@zoulas.com>

+

+ * add BE/LE GUID

+

+2026-04-17 11:05 Christos Zoulas <christos@zoulas.com>

+

+ * multiple fixes to prevent integer overflow in 32 bits (kerwin)

+

+2026-04-15 12:40 Christos Zoulas <christos@zoulas.com>

+

+ * PR/745: streamout: Don't flush when trying to set negative offsets

+ on pipes, just continue, fixes 'cat file.zip | file -'

+ * PR/753: vmihalko: Fix race is magic_getpath()

+

+2026-03-11 15:14 Christos Zoulas <christos@zoulas.com>

+

+ * PR/728: Anton Monroe: Reinstate regex/c

+

+ * PR/622: Odd_Bloke: Handle negative offsets in file_buffer(),

+ when fd is not available.

+# Makefile.in generated by automake 1.18 from Makefile.am.

+# Copyright (C) 1994-2025 Free Software Foundation, Inc.

+am__rm_f = rm -f $(am__rm_f_notfound)

+am__rm_rf = rm -rf $(am__rm_f_notfound)

+ { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \

+ || { echo " ( cd '$$dir' && rm -f" $$files ")"; \

+ $(am__cd) "$$dir" && echo $$files | $(am__xargs_n) 40 $(am__rm_f); }; \

+ find "$(distdir)" -type d ! -perm -700 -exec chmod u+rwx {} ';' \

+ ; rm -rf "$(distdir)" \

+GZIP_ENV = -9

+distcleancheck_listfiles = \

+ find . \( -type f -a \! \

+ \( -name .nfs* -o -name .smb* -o -name .__afs* \) \) -print

+am__rm_f_notfound = @am__rm_f_notfound@

+am__xargs_n = @am__xargs_n@

+ $(AM_V_at)rm -f stamp-h1

+ $(AM_V_GEN)cd $(top_builddir) && $(SHELL) ./config.status config.h

+ $(AM_V_GEN)($(am__cd) $(top_srcdir) && $(AUTOHEADER))

+ $(AM_V_at)rm -f stamp-h1

+ $(AM_V_at)touch $@

+

+ $(AM_V_at)$(MKDIR_P) "$(distdir)"

+dist-bzip3: distdir

+ tardir=$(distdir) && $(am__tar) | bzip3 -c >$(distdir).tar.bz3

+ $(am__post_remove_distdir)

+

+ eval GZIP= gzip -dc $(distdir).tar.gz | $(am__untar) ;;\

+ *.tar.bz3*) \

+ bzip3 -dc $(distdir).tar.bz3 | $(am__untar) ;;\

+ eval GZIP= gzip -dc $(distdir).shar.gz | unshar ;;\

+ -$(am__rm_f) $(CONFIG_CLEAN_FILES)

+ -test . = "$(srcdir)" || $(am__rm_f) $(CONFIG_CLEAN_VPATH_FILES)

+ dist-all dist-bzip2 dist-bzip3 dist-gzip dist-lzip dist-shar \

+ dist-tarZ dist-xz dist-zip dist-zstd distcheck distclean \

+

+# Tell GNU make to disable its built-in pattern rules.

+%:: %,v

+%:: RCS/%,v

+%:: RCS/%

+%:: s.%

+%:: SCCS/s.%

+ @(#) $File: README.md,v 1.7 2026/06/07 23:44:12 christos Exp $

+* `ChangeLog` - log of important changes

+* `README.md` - read this second (you are currently reading this file).

+* `src/landlock.c` - linux landlock protection

+* `src/swap.h` - byte swapping

+* `src/swap.c` - byte swapping

+* `src/seccomp.c` - linux seccomp protection

+# generated automatically by aclocal 1.18 -*- Autoconf -*-

+# Copyright (C) 1996-2025 Free Software Foundation, Inc.

+# Copyright (C) 2002-2025 Free Software Foundation, Inc.

+[am__api_version='1.18'

+m4_if([$1], [1.18], [],

+[AM_AUTOMAKE_VERSION([1.18])dnl

+# Copyright (C) 2001-2025 Free Software Foundation, Inc.

+# Copyright (C) 1997-2025 Free Software Foundation, Inc.

+# Copyright (C) 1999-2025 Free Software Foundation, Inc.

+ # When given -MP, icc 7.0 and 7.1 complain thus:

+# Copyright (C) 1999-2025 Free Software Foundation, Inc.

+# Copyright (C) 1996-2025 Free Software Foundation, Inc.

+ [_AM_IF_OPTION([tar-pax], [_AM_PROG_TAR([pax])],

+ [_AM_IF_OPTION([tar-v7], [_AM_PROG_TAR([v7])],

+ [_AM_PROG_TAR([ustar])])])])

+AC_REQUIRE([_AM_SILENT_RULES])dnl

+AC_REQUIRE([_AM_PROG_RM_F])

+AC_REQUIRE([_AM_PROG_XARGS_N])

+# Copyright (C) 2001-2025 Free Software Foundation, Inc.

+# Copyright (C) 2003-2025 Free Software Foundation, Inc.

+# Copyright (C) 2001-2025 Free Software Foundation, Inc.

+# Copyright (C) 1997-2025 Free Software Foundation, Inc.

+# Copyright (C) 2001-2025 Free Software Foundation, Inc.

+# Copyright (C) 1999-2025 Free Software Foundation, Inc.

+ # aligned with autoconf, so not including core; see bug#72225.

+ rm -f -r a.out a.exe b.out conftest.$ac_ext conftest.$ac_objext \

+ conftest.dSYM conftest1.$ac_ext conftest1.$ac_objext conftest1.dSYM \

+ conftest2.$ac_ext conftest2.$ac_objext conftest2.dSYM

+# Copyright (C) 2022-2025 Free Software Foundation, Inc.

+#

+# This file is free software; the Free Software Foundation

+# gives unlimited permission to copy and/or distribute it,

+# with or without modifications, as long as this notice is preserved.

+

+# _AM_PROG_RM_F

+# ---------------

+# Check whether 'rm -f' without any arguments works.

+# https://bugs.gnu.org/10828

+AC_DEFUN([_AM_PROG_RM_F],

+[am__rm_f_notfound=

+AS_IF([(rm -f && rm -fr && rm -rf) 2>/dev/null], [], [am__rm_f_notfound='""'])

+AC_SUBST(am__rm_f_notfound)

+])

+

+# Copyright (C) 2001-2025 Free Software Foundation, Inc.

+# Copyright (C) 1996-2025 Free Software Foundation, Inc.

+# _AM_SLEEP_FRACTIONAL_SECONDS

+# ----------------------------

+AC_DEFUN([_AM_SLEEP_FRACTIONAL_SECONDS], [dnl

+AC_CACHE_CHECK([whether sleep supports fractional seconds],

+ am_cv_sleep_fractional_seconds, [dnl

+AS_IF([sleep 0.001 2>/dev/null], [am_cv_sleep_fractional_seconds=yes],

+ [am_cv_sleep_fractional_seconds=no])

+])])

+

+# _AM_FILESYSTEM_TIMESTAMP_RESOLUTION

+# -----------------------------------

+# Determine the filesystem's resolution for file modification

+# timestamps. The coarsest we know of is FAT, with a resolution

+# of only two seconds, even with the most recent "exFAT" extensions.

+# The finest (e.g. ext4 with large inodes, XFS, ZFS) is one

+# nanosecond, matching clock_gettime. However, it is probably not

+# possible to delay execution of a shell script for less than one

+# millisecond, due to process creation overhead and scheduling

+# granularity, so we don't check for anything finer than that. (See below.)

+AC_DEFUN([_AM_FILESYSTEM_TIMESTAMP_RESOLUTION], [dnl

+AC_REQUIRE([_AM_SLEEP_FRACTIONAL_SECONDS])

+AC_CACHE_CHECK([filesystem timestamp resolution],

+ am_cv_filesystem_timestamp_resolution, [dnl

+# Default to the worst case.

+am_cv_filesystem_timestamp_resolution=2

+

+# Only try to go finer than 1 sec if sleep can do it.

+# Don't try 1 sec, because if 0.01 sec and 0.1 sec don't work,

+# - 1 sec is not much of a win compared to 2 sec, and

+# - it takes 2 seconds to perform the test whether 1 sec works.

+#

+# Instead, just use the default 2s on platforms that have 1s resolution,

+# accept the extra 1s delay when using $sleep in the Automake tests, in

+# exchange for not incurring the 2s delay for running the test for all

+# packages.

+#

+am_try_resolutions=

+if test "$am_cv_sleep_fractional_seconds" = yes; then

+ # Even a millisecond often causes a bunch of false positives,

+ # so just try a hundredth of a second. The time saved between .001 and

+ # .01 is not terribly consequential.

+ am_try_resolutions="0.01 0.1 $am_try_resolutions"

+fi

+

+# In order to catch current-generation FAT out, we must *modify* files

+# that already exist; the *creation* timestamp is finer. Use names

+# that make ls -t sort them differently when they have equal

+# timestamps than when they have distinct timestamps, keeping

+# in mind that ls -t prints the *newest* file first.

+rm -f conftest.ts?

+: > conftest.ts1

+: > conftest.ts2

+: > conftest.ts3

+

+# Make sure ls -t actually works. Do 'set' in a subshell so we don't

+# clobber the current shell's arguments. (Outer-level square brackets

+# are removed by m4; they're present so that m4 does not expand

+# <dollar><star>; be careful, easy to get confused.)

+if (

+ set X `[ls -t conftest.ts[12]]` &&

+ {

+ test "$[]*" != "X conftest.ts1 conftest.ts2" ||

+ test "$[]*" != "X conftest.ts2 conftest.ts1";

+ }

+); then :; else

+ # If neither matched, then we have a broken ls. This can happen

+ # if, for instance, CONFIG_SHELL is bash and it inherits a

+ # broken ls alias from the environment. This has actually

+ # happened. Such a system could not be considered "sane".

+ _AS_ECHO_UNQUOTED(

+ ["Bad output from ls -t: \"`[ls -t conftest.ts[12]]`\""],

+ [AS_MESSAGE_LOG_FD])

+ AC_MSG_FAILURE([ls -t produces unexpected output.

+Make sure there is not a broken ls alias in your environment.])

+fi

+

+for am_try_res in $am_try_resolutions; do

+ # Any one fine-grained sleep might happen to cross the boundary

+ # between two values of a coarser actual resolution, but if we do

+ # two fine-grained sleeps in a row, at least one of them will fall

+ # entirely within a coarse interval.

+ echo alpha > conftest.ts1

+ sleep $am_try_res

+ echo beta > conftest.ts2

+ sleep $am_try_res

+ echo gamma > conftest.ts3

+

+ # We assume that 'ls -t' will make use of high-resolution

+ # timestamps if the operating system supports them at all.

+ if (set X `ls -t conftest.ts?` &&

+ test "$[]2" = conftest.ts3 &&

+ test "$[]3" = conftest.ts2 &&

+ test "$[]4" = conftest.ts1); then

+ #

+ # Ok, ls -t worked. If we're at a resolution of 1 second, we're done,

+ # because we don't need to test make.

+ make_ok=true

+ if test $am_try_res != 1; then

+ # But if we've succeeded so far with a subsecond resolution, we

+ # have one more thing to check: make. It can happen that

+ # everything else supports the subsecond mtimes, but make doesn't;

+ # notably on macOS, which ships make 3.81 from 2006 (the last one

+ # released under GPLv2). https://bugs.gnu.org/68808

+ #

+ # We test $MAKE if it is defined in the environment, else "make".

+ # It might get overridden later, but our hope is that in practice

+ # it does not matter: it is the system "make" which is (by far)

+ # the most likely to be broken, whereas if the user overrides it,

+ # probably they did so with a better, or at least not worse, make.

+ # https://lists.gnu.org/archive/html/automake/2024-06/msg00051.html

+ #

+ # Create a Makefile (real tab character here):

+ rm -f conftest.mk

+ echo 'conftest.ts1: conftest.ts2' >conftest.mk

+ echo ' touch conftest.ts2' >>conftest.mk

+ #

+ # Now, running

+ # touch conftest.ts1; touch conftest.ts2; make

+ # should touch ts1 because ts2 is newer. This could happen by luck,

+ # but most often, it will fail if make's support is insufficient. So

+ # test for several consecutive successes.

+ #

+ # (We reuse conftest.ts[12] because we still want to modify existing

+ # files, not create new ones, per above.)

+ n=0

+ make=${MAKE-make}

+ until test $n -eq 3; do

+ echo one > conftest.ts1

+ sleep $am_try_res

+ echo two > conftest.ts2 # ts2 should now be newer than ts1

+ if $make -f conftest.mk | grep 'up to date' >/dev/null; then

+ make_ok=false

+ break # out of $n loop

+ fi

+ n=`expr $n + 1`

+ done

+ fi

+ #

+ if $make_ok; then

+ # Everything we know to check worked out, so call this resolution good.

+ am_cv_filesystem_timestamp_resolution=$am_try_res

+ break # out of $am_try_res loop

+ fi

+ # Otherwise, we'll go on to check the next resolution.

+ fi

+done

+rm -f conftest.ts?

+# (end _am_filesystem_timestamp_resolution)

+])])

+

+[AC_REQUIRE([_AM_FILESYSTEM_TIMESTAMP_RESOLUTION])

+# This check should not be cached, as it may vary across builds of

+# different projects.

+AC_MSG_CHECKING([whether build environment is sane])

+ AC_MSG_RESULT([no])

+ AC_MSG_RESULT([no])

+am_build_env_is_sane=no

+am_has_slept=no

+rm -f conftest.file

+for am_try in 1 2; do

+ echo "timestamp, slept: $am_has_slept" > conftest.file

+ if (

+ set X `ls -Lt "$srcdir/configure" conftest.file 2> /dev/null`

+ if test "$[]*" = "X"; then

+ # -L didn't work.

+ set X `ls -t "$srcdir/configure" conftest.file`

+ fi

+ test "$[]2" = conftest.file

+ ); then

+ am_build_env_is_sane=yes

+ break

+ fi

+ # Just in case.

+ sleep "$am_cv_filesystem_timestamp_resolution"

+ am_has_slept=yes

+done

+AC_MSG_RESULT([$am_build_env_is_sane])

+if test "$am_build_env_is_sane" = no; then

+ AC_MSG_ERROR([newly created file is older than distributed files!

+

+AS_IF([test -e conftest.file || grep 'slept: no' conftest.file >/dev/null 2>&1],, [dnl

+ ( sleep "$am_cv_filesystem_timestamp_resolution" ) &

+])

+# Copyright (C) 2009-2025 Free Software Foundation, Inc.

+# _AM_SILENT_RULES

+# ----------------

+# Enable less verbose build rules support.

+AC_DEFUN([_AM_SILENT_RULES],

+[AM_DEFAULT_VERBOSITY=1

+AC_ARG_ENABLE([silent-rules], [dnl

+dnl Delay evaluation of AM_DEFAULT_VERBOSITY to the end to allow multiple calls

+dnl to AM_SILENT_RULES to change the default value.

+AC_CONFIG_COMMANDS_PRE([dnl

+case $enable_silent_rules in @%:@ (((

+ yes) AM_DEFAULT_VERBOSITY=0;;

+ no) AM_DEFAULT_VERBOSITY=1;;

+esac

+if test $am_cv_make_support_nested_variables = yes; then

+ dnl Using '$V' instead of '$(V)' breaks IRIX make.

+ AM_V='$(V)'

+ AM_DEFAULT_V='$(AM_DEFAULT_VERBOSITY)'

+else

+ AM_V=$AM_DEFAULT_VERBOSITY

+ AM_DEFAULT_V=$AM_DEFAULT_VERBOSITY

+fi

+])dnl

+])

+

+# AM_SILENT_RULES([DEFAULT])

+# --------------------------

+# Set the default verbosity level to DEFAULT ("yes" being less verbose, "no" or

+# empty being verbose).

+AC_DEFUN([AM_SILENT_RULES],

+[AC_REQUIRE([_AM_SILENT_RULES])

+AM_DEFAULT_VERBOSITY=m4_if([$1], [yes], [0], [1])m4_newline

+dnl We intentionally force a newline after the assignment, since a) nothing

+dnl good can come of more text following, and b) that was the behavior

+dnl before 1.17. See https://bugs.gnu.org/72267.

+# Copyright (C) 2001-2025 Free Software Foundation, Inc.

+# Copyright (C) 2006-2025 Free Software Foundation, Inc.

+# Copyright (C) 2004-2025 Free Software Foundation, Inc.

+ if test x$am_uid = xunknown; then

+ AC_MSG_WARN([ancient id detected; assuming current UID is ok, but dist-ustar might not work])

+ elif test $am_uid -le $am_max_uid; then

+ AC_MSG_RESULT([yes])

+ AC_MSG_RESULT([no])

+ _am_tools=none

+ if test x$gm_gid = xunknown; then

+ AC_MSG_WARN([ancient id detected; assuming current GID is ok, but dist-ustar might not work])

+ elif test $am_gid -le $am_max_gid; then

+ AC_MSG_RESULT([yes])

+# Copyright (C) 2022-2025 Free Software Foundation, Inc.

+#

+# This file is free software; the Free Software Foundation

+# gives unlimited permission to copy and/or distribute it,

+# with or without modifications, as long as this notice is preserved.

+

+# _AM_PROG_XARGS_N

+# ----------------

+# Check whether 'xargs -n' works. It should work everywhere, so the fallback

+# is not optimized at all as we never expect to use it.

+AC_DEFUN([_AM_PROG_XARGS_N],

+[AC_CACHE_CHECK([xargs -n works], am_cv_xargs_n_works, [dnl

+AS_IF([test "`echo 1 2 3 | xargs -n2 echo`" = "1 2

+3"], [am_cv_xargs_n_works=yes], [am_cv_xargs_n_works=no])])

+AS_IF([test "$am_cv_xargs_n_works" = yes], [am__xargs_n='xargs -n'], [dnl

+ am__xargs_n='am__xargs_n () { shift; sed "s/ /\\n/g" | while read am__xargs_n_arg; do "$@" "$am__xargs_n_arg"; done; }'

+])dnl

+AC_SUBST(am__xargs_n)

+])

+

+scriptversion=2025-02-03.05; # UTC

+# Copyright (C) 1999-2025 Free Software Foundation, Inc.

+# func_file_conv build_file unneeded_conversions

+# type is listed in (the comma separated) UNNEEDED_CONVERSIONS, no

+# conversion will take place.

+ if test -n "$MSYSTEM" && (cygpath --version) >/dev/null 2>&1; then

+ # MSYS2 environment.

+ file_conv=cygwin

+ else

+ # Original MinGW environment.

+ file_conv=mingw

+ fi

+ MSYS*)

+ # Old MSYS environment, or MSYS2 with 32-bit MSYS2 shell.

+ file_conv=cygwin

+ ;;

+ CYGWIN*)

+ # Cygwin environment.

+ # This is the optimization mentioned above:

+ # If UNNEEDED_CONVERSIONS contains $file_conv, don't convert.

+ cygwin/*)

+ file=`cygpath -w "$file" || echo "$file"`

+ *.o | *.lo | *.[oO][bB][jJ])

+GNU Automake home page: <https://www.gnu.org/software/automake/>.

+General help using GNU software: <https://www.gnu.org/gethelp/>.

+ echo "compile (GNU Automake) $scriptversion"

+ clang-cl | *[/\\]clang-cl | clang-cl.exe | *[/\\]clang-cl.exe | \

+# eval: (add-hook 'before-save-hook 'time-stamp nil t)

+/* Define to 1 if you have the <limits.h> header file. */

+#undef HAVE_LIMITS_H

+

+/* Define to 1 if you have the <linux/landlock.h> header file. */

+#undef HAVE_LINUX_LANDLOCK_H

+

+# Generated by GNU Autoconf 2.72 for file 5.48.

+PACKAGE_VERSION='5.48'

+PACKAGE_STRING='file 5.48'

+am__xargs_n

+am__rm_f_notfound

+enable_landlock

+'configure' configures file 5.48 to adapt to many kinds of systems.

+ short | recursive ) echo "Configuration of file 5.48:";;

+ --disable-landlock disable Landlock filesystem sandboxing

+ [default=auto]

+file configure 5.48

+It was created by file $as_me 5.48, which was

+am__api_version='1.18'

+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether sleep supports fractional seconds" >&5

+printf %s "checking whether sleep supports fractional seconds... " >&6; }

+if test ${am_cv_sleep_fractional_seconds+y}

+then :

+ printf %s "(cached) " >&6

+else case e in #(

+ e) if sleep 0.001 2>/dev/null

+then :

+ am_cv_sleep_fractional_seconds=yes

+else case e in #(

+ e) am_cv_sleep_fractional_seconds=no ;;

+esac

+fi

+ ;;

+esac

+fi

+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $am_cv_sleep_fractional_seconds" >&5

+printf "%s\n" "$am_cv_sleep_fractional_seconds" >&6; }

+

+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking filesystem timestamp resolution" >&5

+printf %s "checking filesystem timestamp resolution... " >&6; }

+if test ${am_cv_filesystem_timestamp_resolution+y}

+then :

+ printf %s "(cached) " >&6

+else case e in #(

+ e) # Default to the worst case.

+am_cv_filesystem_timestamp_resolution=2

+

+# Only try to go finer than 1 sec if sleep can do it.

+# Don't try 1 sec, because if 0.01 sec and 0.1 sec don't work,

+# - 1 sec is not much of a win compared to 2 sec, and

+# - it takes 2 seconds to perform the test whether 1 sec works.

+#

+# Instead, just use the default 2s on platforms that have 1s resolution,

+# accept the extra 1s delay when using $sleep in the Automake tests, in

+# exchange for not incurring the 2s delay for running the test for all

+# packages.

+#

+am_try_resolutions=

+if test "$am_cv_sleep_fractional_seconds" = yes; then

+ # Even a millisecond often causes a bunch of false positives,

+ # so just try a hundredth of a second. The time saved between .001 and

+ # .01 is not terribly consequential.

+ am_try_resolutions="0.01 0.1 $am_try_resolutions"

+fi

+

+# In order to catch current-generation FAT out, we must *modify* files

+# that already exist; the *creation* timestamp is finer. Use names

+# that make ls -t sort them differently when they have equal

+# timestamps than when they have distinct timestamps, keeping

+# in mind that ls -t prints the *newest* file first.

+rm -f conftest.ts?

+: > conftest.ts1

+: > conftest.ts2

+: > conftest.ts3

+

+# Make sure ls -t actually works. Do 'set' in a subshell so we don't

+# clobber the current shell's arguments. (Outer-level square brackets

+# are removed by m4; they're present so that m4 does not expand

+# <dollar><star>; be careful, easy to get confused.)

+if (

+ set X `ls -t conftest.ts[12]` &&

+ {

+ test "$*" != "X conftest.ts1 conftest.ts2" ||

+ test "$*" != "X conftest.ts2 conftest.ts1";

+ }

+); then :; else

+ # If neither matched, then we have a broken ls. This can happen

+ # if, for instance, CONFIG_SHELL is bash and it inherits a

+ # broken ls alias from the environment. This has actually

+ # happened. Such a system could not be considered "sane".

+ printf "%s\n" ""Bad output from ls -t: \"`ls -t conftest.ts[12]`\""" >&5

+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in '$ac_pwd':" >&5

+printf "%s\n" "$as_me: error: in '$ac_pwd':" >&2;}

+as_fn_error $? "ls -t produces unexpected output.

+Make sure there is not a broken ls alias in your environment.

+See 'config.log' for more details" "$LINENO" 5; }

+fi

+

+for am_try_res in $am_try_resolutions; do

+ # Any one fine-grained sleep might happen to cross the boundary

+ # between two values of a coarser actual resolution, but if we do

+ # two fine-grained sleeps in a row, at least one of them will fall

+ # entirely within a coarse interval.

+ echo alpha > conftest.ts1

+ sleep $am_try_res

+ echo beta > conftest.ts2

+ sleep $am_try_res

+ echo gamma > conftest.ts3

+

+ # We assume that 'ls -t' will make use of high-resolution

+ # timestamps if the operating system supports them at all.

+ if (set X `ls -t conftest.ts?` &&

+ test "$2" = conftest.ts3 &&

+ test "$3" = conftest.ts2 &&

+ test "$4" = conftest.ts1); then

+ #

+ # Ok, ls -t worked. If we're at a resolution of 1 second, we're done,

+ # because we don't need to test make.

+ make_ok=true

+ if test $am_try_res != 1; then

+ # But if we've succeeded so far with a subsecond resolution, we

+ # have one more thing to check: make. It can happen that

+ # everything else supports the subsecond mtimes, but make doesn't;

+ # notably on macOS, which ships make 3.81 from 2006 (the last one

+ # released under GPLv2). https://bugs.gnu.org/68808

+ #

+ # We test $MAKE if it is defined in the environment, else "make".

+ # It might get overridden later, but our hope is that in practice

+ # it does not matter: it is the system "make" which is (by far)

+ # the most likely to be broken, whereas if the user overrides it,

+ # probably they did so with a better, or at least not worse, make.

+ # https://lists.gnu.org/archive/html/automake/2024-06/msg00051.html

+ #

+ # Create a Makefile (real tab character here):

+ rm -f conftest.mk

+ echo 'conftest.ts1: conftest.ts2' >conftest.mk

+ echo ' touch conftest.ts2' >>conftest.mk

+ #

+ # Now, running

+ # touch conftest.ts1; touch conftest.ts2; make

+ # should touch ts1 because ts2 is newer. This could happen by luck,

+ # but most often, it will fail if make's support is insufficient. So

+ # test for several consecutive successes.

+ #

+ # (We reuse conftest.ts[12] because we still want to modify existing

+ # files, not create new ones, per above.)

+ n=0

+ make=${MAKE-make}

+ until test $n -eq 3; do

+ echo one > conftest.ts1

+ sleep $am_try_res

+ echo two > conftest.ts2 # ts2 should now be newer than ts1

+ if $make -f conftest.mk | grep 'up to date' >/dev/null; then

+ make_ok=false

+ break # out of $n loop

+ fi

+ n=`expr $n + 1`

+ done

+ fi

+ #

+ if $make_ok; then

+ # Everything we know to check worked out, so call this resolution good.

+ am_cv_filesystem_timestamp_resolution=$am_try_res

+ break # out of $am_try_res loop

+ fi

+ # Otherwise, we'll go on to check the next resolution.

+ fi

+done

+rm -f conftest.ts?

+# (end _am_filesystem_timestamp_resolution)

+ ;;

+esac

+fi

+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $am_cv_filesystem_timestamp_resolution" >&5

+printf "%s\n" "$am_cv_filesystem_timestamp_resolution" >&6; }

+

+# This check should not be cached, as it may vary across builds of

+# different projects.

+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5

+printf "%s\n" "no" >&6; }

+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5

+printf "%s\n" "no" >&6; }

+am_build_env_is_sane=no

+am_has_slept=no

+rm -f conftest.file

+for am_try in 1 2; do

+ echo "timestamp, slept: $am_has_slept" > conftest.file

+ if (

+ set X `ls -Lt "$srcdir/configure" conftest.file 2> /dev/null`

+ if test "$*" = "X"; then

+ # -L didn't work.

+ set X `ls -t "$srcdir/configure" conftest.file`

+ fi

+ test "$2" = conftest.file

+ ); then

+ am_build_env_is_sane=yes

+ break

+ fi

+ # Just in case.

+ sleep "$am_cv_filesystem_timestamp_resolution"

+ am_has_slept=yes

+done

+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $am_build_env_is_sane" >&5

+printf "%s\n" "$am_build_env_is_sane" >&6; }

+if test "$am_build_env_is_sane" = no; then

+ as_fn_error $? "newly created file is older than distributed files!

+

+if test -e conftest.file || grep 'slept: no' conftest.file >/dev/null 2>&1

+then :

+

+else case e in #(

+ e) ( sleep "$am_cv_filesystem_timestamp_resolution" ) &

+ ;;

+esac

+AM_DEFAULT_VERBOSITY=1

+am__rm_f_notfound=

+if (rm -f && rm -fr && rm -rf) 2>/dev/null

+then :

+

+else case e in #(

+ e) am__rm_f_notfound='""' ;;

+esac

+fi

+

+

+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking xargs -n works" >&5

+printf %s "checking xargs -n works... " >&6; }

+if test ${am_cv_xargs_n_works+y}

+then :

+ printf %s "(cached) " >&6

+else case e in #(

+ e) if test "`echo 1 2 3 | xargs -n2 echo`" = "1 2

+3"

+then :

+ am_cv_xargs_n_works=yes

+else case e in #(

+ e) am_cv_xargs_n_works=no ;;

+esac

+fi ;;

+esac

+fi

+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $am_cv_xargs_n_works" >&5

+printf "%s\n" "$am_cv_xargs_n_works" >&6; }

+if test "$am_cv_xargs_n_works" = yes

+then :

+ am__xargs_n='xargs -n'

+else case e in #(

+ e) am__xargs_n='am__xargs_n () { shift; sed "s/ /\\n/g" | while read am__xargs_n_arg; do "" "$am__xargs_n_arg"; done; }'

+ ;;

+esac

+fi

+

+ VERSION='5.48'

+_am_tools='gnutar plaintar pax cpio none'

+

+# The POSIX 1988 'ustar' format is defined with fixed-size fields.

+ # There is notably a 21 bits limit for the UID and the GID. In fact,

+ # the 'pax' utility can hang on bigger UID/GID (see automake bug#8343

+ # and bug#13588).

+ am_max_uid=2097151 # 2^21 - 1

+ am_max_gid=$am_max_uid

+ # The $UID and $GID variables are not portable, so we need to resort

+ # to the POSIX-mandated id(1) utility. Errors in the 'id' calls

+ # below are definitely unexpected, so allow the users to see them

+ # (that is, avoid stderr redirection).

+ am_uid=`id -u || echo unknown`

+ am_gid=`id -g || echo unknown`

+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether UID '$am_uid' is supported by ustar format" >&5

+printf %s "checking whether UID '$am_uid' is supported by ustar format... " >&6; }

+ if test x$am_uid = xunknown; then

+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: ancient id detected; assuming current UID is ok, but dist-ustar might not work" >&5

+printf "%s\n" "$as_me: WARNING: ancient id detected; assuming current UID is ok, but dist-ustar might not work" >&2;}

+ elif test $am_uid -le $am_max_uid; then

+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5

+printf "%s\n" "yes" >&6; }

+ else

+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5

+printf "%s\n" "no" >&6; }

+ _am_tools=none

+ fi

+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether GID '$am_gid' is supported by ustar format" >&5

+printf %s "checking whether GID '$am_gid' is supported by ustar format... " >&6; }

+ if test x$gm_gid = xunknown; then

+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: ancient id detected; assuming current GID is ok, but dist-ustar might not work" >&5

+printf "%s\n" "$as_me: WARNING: ancient id detected; assuming current GID is ok, but dist-ustar might not work" >&2;}

+ elif test $am_gid -le $am_max_gid; then

+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5

+printf "%s\n" "yes" >&6; }

+ else

+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5

+printf "%s\n" "no" >&6; }

+ _am_tools=none

+ fi

+

+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to create a ustar tar archive" >&5

+printf %s "checking how to create a ustar tar archive... " >&6; }

+

+ # Go ahead even if we have the value already cached. We do so because we

+ # need to set the values for the 'am__tar' and 'am__untar' variables.

+ _am_tools=${am_cv_prog_tar_ustar-$_am_tools}

+

+ for _am_tool in $_am_tools; do

+ case $_am_tool in

+ gnutar)

+ for _am_tar in tar gnutar gtar; do

+ { echo "$as_me:$LINENO: $_am_tar --version" >&5

+ ($_am_tar --version) >&5 2>&5

+ ac_status=$?

+ echo "$as_me:$LINENO: \$? = $ac_status" >&5

+ (exit $ac_status); } && break

+ done

+ am__tar="$_am_tar --format=ustar -chf - "'"$$tardir"'

+ am__tar_="$_am_tar --format=ustar -chf - "'"$tardir"'

+ am__untar="$_am_tar -xf -"

+ ;;

+ plaintar)

+ # Must skip GNU tar: if it does not support --format= it doesn't create

+ # ustar tarball either.

+ (tar --version) >/dev/null 2>&1 && continue

+ am__tar='tar chf - "$$tardir"'

+ am__tar_='tar chf - "$tardir"'

+ am__untar='tar xf -'

+ ;;

+ pax)

+ am__tar='pax -L -x ustar -w "$$tardir"'

+ am__tar_='pax -L -x ustar -w "$tardir"'

+ am__untar='pax -r'

+ ;;

+ cpio)

+ am__tar='find "$$tardir" -print | cpio -o -H ustar -L'

+ am__tar_='find "$tardir" -print | cpio -o -H ustar -L'

+ am__untar='cpio -i -H ustar -d'

+ ;;

+ none)

+ am__tar=false

+ am__tar_=false

+ am__untar=false

+ ;;

+ esac

+

+ # If the value was cached, stop now. We just wanted to have am__tar

+ # and am__untar set.

+ test -n "${am_cv_prog_tar_ustar}" && break

+

+ # tar/untar a dummy directory, and stop if the command works.

+ rm -rf conftest.dir

+ mkdir conftest.dir

+ echo GrepMe > conftest.dir/file

+ { echo "$as_me:$LINENO: tardir=conftest.dir && eval $am__tar_ >conftest.tar" >&5

+ (tardir=conftest.dir && eval $am__tar_ >conftest.tar) >&5 2>&5

+ ac_status=$?

+ echo "$as_me:$LINENO: \$? = $ac_status" >&5

+ (exit $ac_status); }

+ rm -rf conftest.dir

+ if test -s conftest.tar; then

+ { echo "$as_me:$LINENO: $am__untar <conftest.tar" >&5

+ ($am__untar <conftest.tar) >&5 2>&5

+ ac_status=$?

+ echo "$as_me:$LINENO: \$? = $ac_status" >&5

+ (exit $ac_status); }

+ { echo "$as_me:$LINENO: cat conftest.dir/file" >&5

+ (cat conftest.dir/file) >&5 2>&5

+ ac_status=$?

+ echo "$as_me:$LINENO: \$? = $ac_status" >&5

+ (exit $ac_status); }

+ grep GrepMe conftest.dir/file >/dev/null 2>&1 && break

+ fi

+ done

+ rm -rf conftest.dir

+

+ if test ${am_cv_prog_tar_ustar+y}

+then :

+ printf %s "(cached) " >&6

+else case e in #(

+ e) am_cv_prog_tar_ustar=$_am_tool ;;

+esac

+fi

+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $am_cv_prog_tar_ustar" >&5

+printf "%s\n" "$am_cv_prog_tar_ustar" >&6; }

+AM_DEFAULT_VERBOSITY=0

+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for Landlock LSM support" >&5

+printf %s "checking for Landlock LSM support... " >&6; }

+# Check whether --enable-landlock was given.

+if test ${enable_landlock+y}

+then :

+ enableval=$enable_landlock;

+fi

+

+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $enable_landlock" >&5

+printf "%s\n" "$enable_landlock" >&6; }

+

+ # aligned with autoconf, so not including core; see bug#72225.

+ rm -f -r a.out a.exe b.out conftest.$ac_ext conftest.$ac_objext \

+ conftest.dSYM conftest1.$ac_ext conftest1.$ac_objext conftest1.dSYM \

+ conftest2.$ac_ext conftest2.$ac_objext conftest2.dSYM

+ # When given -MP, icc 7.0 and 7.1 complain thus:

+ac_fn_c_check_header_compile "$LINENO" "limits.h" "ac_cv_header_limits_h" "$ac_includes_default"

+if test "x$ac_cv_header_limits_h" = xyes

+then :

+ printf "%s\n" "#define HAVE_LIMITS_H 1" >>confdefs.h

+

+fi

+if test "$enable_landlock" != "no"; then

+ ac_fn_c_check_header_compile "$LINENO" "linux/landlock.h" "ac_cv_header_linux_landlock_h" "$ac_includes_default"

+if test "x$ac_cv_header_linux_landlock_h" = xyes

+then :

+ printf "%s\n" "#define HAVE_LINUX_LANDLOCK_H 1" >>confdefs.h

+

+fi

+

+fi

+case $enable_silent_rules in # (((

+ yes) AM_DEFAULT_VERBOSITY=0;;

+ no) AM_DEFAULT_VERBOSITY=1;;

+esac

+if test $am_cv_make_support_nested_variables = yes; then

+ AM_V='$(V)'

+ AM_DEFAULT_V='$(AM_DEFAULT_VERBOSITY)'

+else

+ AM_V=$AM_DEFAULT_VERBOSITY

+ AM_DEFAULT_V=$AM_DEFAULT_VERBOSITY

+fi

+

+This file was extended by file $as_me 5.48, which was

+file config.status 5.48

+AC_INIT([file],[5.48],[christos@astron.com])

+AC_MSG_CHECKING(for Landlock LSM support)

+AC_ARG_ENABLE([landlock],

+[AS_HELP_STRING([--disable-landlock], [disable Landlock filesystem sandboxing @<:@default=auto@:>@])])

+AC_MSG_RESULT($enable_landlock)

+

+AC_CHECK_HEADERS(spawn.h utime.h wchar.h wctype.h limits.h)

+if test "$enable_landlock" != "no"; then

+ AC_CHECK_HEADERS(linux/landlock.h)

+fi

+scriptversion=2024-12-03.03; # UTC

+# Copyright (C) 1999-2025 Free Software Foundation, Inc.

+GNU Automake home page: <https://www.gnu.org/software/automake/>.

+General help using GNU software: <https://www.gnu.org/gethelp/>.

+ echo "depcomp (GNU Automake) $scriptversion"

+# Avoid interference from the environment.

+## Note that this doesn't just cater to obsolete pre-3.x GCC compilers.

+## but also to in-use compilers like IBM xlc/xlC and the HP C compiler.

+# eval: (add-hook 'before-save-hook 'time-stamp nil t)

+# Makefile.in generated by automake 1.18 from Makefile.am.

+# Copyright (C) 1994-2025 Free Software Foundation, Inc.

+am__rm_f = rm -f $(am__rm_f_notfound)

+am__rm_rf = rm -rf $(am__rm_f_notfound)

+ { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \

+ || { echo " ( cd '$$dir' && rm -f" $$files ")"; \

+ $(am__cd) "$$dir" && echo $$files | $(am__xargs_n) 40 $(am__rm_f); }; \

+am__rm_f_notfound = @am__rm_f_notfound@

+am__xargs_n = @am__xargs_n@

+

+ -$(am__rm_f) $(CLEANFILES)

+ -$(am__rm_f) $(CONFIG_CLEAN_FILES)

+ -test . = "$(srcdir)" || $(am__rm_f) $(CONFIG_CLEAN_VPATH_FILES)

+

+# Tell GNU make to disable its built-in pattern rules.

+%:: %,v

+%:: RCS/%,v

+%:: RCS/%

+%:: s.%

+%:: SCCS/s.%

+.\" $File: magic.man,v 1.118 2026/04/19 19:56:49 christos Exp $

+.Dd April 19, 2026

+For regex, this turns on REG_ICASE.

+target, whereas upper case characters in the magic only match lower case

+For regex, this turns on REG_ICASE.

+When a line count is specified, an implicit byte count is also computed assuming

+.It Dv guid ,

+.It Dv leguid ,

+.It Dv beguid

+Its format is a string.

+The operator

+This constant is applied using the specified operator

+there is neither PE\e0\e0 nor LX\e0\e0 in the above example).

+

+#------------------------------------------------------------------------------

+# $File: a2ml,v 1.1 2026/03/20 13:59:12 christos Exp $

+# a2ml: file(1) magic for A2ML (Attested Markup Language) files

+# URL: https://github.com/hyperpolymath/a2ml

+# From: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>

+

+# A2ML is a lightweight attested markup format with a typed, formally

+# verified core. Files use the .a2ml extension.

+# Specification: https://github.com/hyperpolymath/standards/blob/main/a2ml/SPEC-v1.0.adoc

+# MIME type: application/vnd.a2ml

+

+# Document starts with @abstract directive (canonical A2ML opening)

+0 string @abstract: A2ML Attested Markup Language document

+!:mime application/vnd.a2ml

+!:ext a2ml

+

+# AI manifest files starting with agent-id or manifest block

+0 string agent-id: A2ML Attested Markup Language document (AI manifest)

+!:mime application/vnd.a2ml

+!:ext a2ml

+

+0 string manifest: A2ML Attested Markup Language document (AI manifest)

+!:mime application/vnd.a2ml

+!:ext a2ml

+

+0 string pedigree: A2ML Attested Markup Language document (AI manifest)

+!:mime application/vnd.a2ml

+!:ext a2ml

+

+# Heading line followed by @abstract deeper in the file

+0 string #\\

+>&0 search/512 \n@abstract: A2ML Attested Markup Language document

+!:mime application/vnd.a2ml

+!:ext a2ml

+

+# @opaque directive with language annotation (A2ML code block)

+0 search/512 @opaque(lang= A2ML Attested Markup Language document

+!:mime application/vnd.a2ml

+!:ext a2ml

+!:strength -10

+

+# @refs block (A2ML reference list)

+0 search/512 \n@refs:\n A2ML Attested Markup Language document

+!:mime application/vnd.a2ml

+!:ext a2ml

+!:strength -10

+# $File: acorn,v 1.10 2026/06/02 16:53:30 christos Exp $

+

+# BBC Micro ROM image type magic

+# 16KB 6502 sideways ROMs — name string at offset 9 (Acorn convention)

+#

+

+# Language+Service ROMs: JMP at +0 AND +3, target high byte $80-$BF

+0 ubyte 0x4c

+>2 ubyte >0x7f

+>>2 ubyte <0xc0

+>>>3 ubyte 0x4c

+>>>>5 ubyte >0x7f

+>>>>>5 ubyte <0xc0

+>>>>>>9 string >\0 BBC Micro ROM (%s)

+

+# Service-only ROMs: $00 at +0..+2, JMP at +3, target high byte $80-$BF

+0 lelong 0x4c000000

+>5 ubyte >0x7f

+>>5 ubyte <0xc0

+>>>9 string >\0 BBC Micro ROM (%s)

+

+# Language-only ROMs: BASIC II pattern (CMP #$01; BEQ)

+0 leshort 0x01c9

+>2 leshort 0x1ff0

+>>9 string >\0 BBC Micro ROM (%s)

+# $File: aes,v 1.5 2026/05/14 02:00:00 christos Exp $

+# From: Joerg Jenderek/Paul E. Jones

+>3 ubyte 0

+>>4 ubyte <0x10 AES encrypted data, version 0

+>3 ubyte >0

+>>4 ubyte 0

+>>>3 ubyte x AES encrypted data, version %u

+#!:mime application/aes

+!:mime application/x-aes-encrypted

+!:ext aes

+# Since Version 2 the encrypted file can have text tags

+>>3 ubyte >1

+#>>>>5 ubeshort x \b, tag length %u

+#>>>>5 pstring/H x '%s'

+>>>>&1 string x "%.64s"

+# $File: amigaos,v 1.26 2026/04/17 15:13:18 christos Exp $

+!:mime image/x-amiga-icon

+

+# MOST was a text/image viewer for AmigaOS, CFF is its compressed file format

+

+# Text format (CFF\x00)

+0 string CFF\0 MOST compressed text data

+!:ext cff

+>0x30 beshort x \b, %u bytes compressed

+>0x34 beshort x \b, %u bytes uncompressed

+

+# Image format (CFF\x01)

+0 string CFF\1 MOST compressed image data

+!:ext cff

+>0x32 beshort x \b, %u wide

+>0x34 beshort x \b, %u tall

+

+#------------------------------------------------------------------------------

+# Crunch-Mania: file(1) magic for Amiga Crunch-Mania compressed files

+# https://www.amiga-stuff.com/crunchers-id.html

+

+# Standard mode

+0 string CrM! Crunch-Mania data, standard

+!:ext crm

+>6 belong x \b, %u bytes uncompressed

+

+0 string Crm! Crunch-Mania data, standard, sampled

+!:ext crm

+>6 belong x \b, %u bytes uncompressed

+

+# LZH mode

+0 string CrM2 Crunch-Mania data, LZH

+!:ext crm

+>6 belong x \b, %u bytes uncompressed

+

+0 string Crm2 Crunch-Mania data, LZH, sampled

+!:ext crm

+>6 belong x \b, %u bytes uncompressed

+

+# Encrypted variants

+0 string crM! Crunch-Mania data, standard, encrypted

+!:ext crm

+>6 belong x \b, %u bytes uncompressed

+

+0 string crm! Crunch-Mania data, standard, sampled, encrypted

+!:ext crm

+>6 belong x \b, %u bytes uncompressed

+

+0 string crM2 Crunch-Mania data, LZH, encrypted

+!:ext crm

+>6 belong x \b, %u bytes uncompressed

+

+0 string crm2 Crunch-Mania data, LZH, sampled, encrypted

+!:ext crm

+>6 belong x \b, %u bytes uncompressed

+#------------------------------------------------------------------------------

+# $File: andrew,v 1.1 2026/04/16 15:13:19 christos Exp $

+# andrew: file(1) magic for Andrew Project files:

+# https://en.wikipedia.org/wiki/Andrew_Project

+

+# Andrew Toolkit (ATK / AUIS) data stream

+# From Carnegie Mellon University's Andrew User Interface System (c. 1988)

+

+0 string \\begindata{raster, Andrew Toolkit raster image data

+!:mime application/andrew-inset

+!:ext raster

+

+0 string \\begindata{text, Andrew Toolkit text document

+!:mime application/andrew-inset

+!:ext ez

+

+0 string \\begindata{table, Andrew Toolkit table

+!:mime application/andrew-inset

+!:ext ez

+

+0 string \\begindata{figure, Andrew Toolkit figure

+!:mime application/andrew-inset

+!:ext ez

+

+0 string \\begindata{zip, Andrew Toolkit zip (compound document)

+!:mime application/andrew-inset

+!:ext ez

+

+# Generic fallback for any other ATK data type

+0 regex/s \\\\begindata\\{[a-z] Andrew Toolkit data

+!:mime application/andrew-inset

+!:ext ez

+# $File: android,v 1.27 2026/04/12 21:11:22 christos Exp $

+# Android binary XML magic

+# Used by Android Package Mangaer to encode files in an efficient format.

+# Some known file using this format: /data/system/packages.xml, /data/system/packages-backup.xml

+# https://cs.android.com/android/platform/superproject/+/master:frameworks/base/core/java/com/android/internal/util/BinaryXmlSerializer.java;l=72

+# From <ysaxenax@gmail.com> "Yuvraj Saxena"

+0 string ABX Android binary XML

+

+# $File: apple,v 1.54 2026/06/02 17:32:17 christos Exp $

+65 string PNTGMPNT MacPaint image data, MacBinary-wrapped

+!:mime image/x-macpaint

+!:ext mac/macp/pntg

+0 belong 0x00000002

+>4 belong 0xFFFFFFFF MacPaint image data, version 2

+!:mime image/x-macpaint

+!:ext mac/macp/pntg

+0 belong 0x00000003

+>4 belong 0xFFFFFFFF MacPaint image data, version 3

+!:mime image/x-macpaint

+!:ext mac/macp/pntg

+

+# Apple Sparse Disk Image

+# Located at the start of the file

+0 string sprs Apple Sparse Disk Image

+>4 belong >0 \b, version %d

+>8 belong &0x01 \b, growable

+>8 belong &0x02 \b, layout-fixed

+>8 belong &0x04 \b, encrypted

+>8 belong &0x08 \b, kernel-managed

+>8 belong >0 \b, (flags %#x)

+>12 belong >0 \b, block size: %d

+>24 bequad >0 \b, capacity: %lld bytes

+

+# DMG image

+-512 string koly

+>-504 belong 512 Apple DMG

+>>-508 belong x \b, version %d

+# $File: archive,v 1.223 2026/05/10 01:23:57 christos Exp $

+# Bareos volume format.

+# URL:

+# https://docs.bareos.org/DeveloperGuide/mediaformat.html#volume-label-format

+# From: Bruno Fiedmann <bruno.friedmann@bareos.com>

+# Note: label_btime (local time) is stored as 8-byte big-endian microseconds;

+# must divide by 1000000 for Unix seconds

+# Note: MediaType detected using search; ProgVersion start at 142

+# (typically after LabelProg field)

+# Note: ProgVersion start at 142, but we want to remove 'Ver. ' anyways

+12 string BB02 Bareos Volume

+>36 string Bareos 2.0 immortal

+>93 string x \b, Volume Name: %s

+>100 search/100 File\0 \b, Media Type: File

+>100 search/100 Tape\0 \b, Media Type: Tape

+>100 search/100 VTape\0 \b, Media Type: VTape

+>100 search/100 Fifo\0 \b, Media Type: Fifo

+>61 beqldate/1000000 x \b, Label Date: %s

+>147 string x \b, Version: %s

+

+# Bareos Disaster Recovery Image

+# URL: https://doc.bareos.org/

+# From: Bruno Friedmann <bruno.friedmann@bareos.com>

+0 string barrifil Bareos Disaster Recovery Image

+

+

+# ZIM (Zeno IMproved) file - Archive format used by Kiwix for offline browsing

+# Reference: https://wiki.openzim.org/wiki/ZIM_file_format

+0 ulelong 0x044D495A ZIM archive data

+!:mime application/x-zim

+!:ext zim

+>4 uleshort x \b, version %u

+>6 uleshort x \b.%u

+>8 beguid x \b, UUID %s

+>24 ulelong x \b, %u entries

+>28 ulelong x \b, %u clusters

+

+# FAR Archive magic

+#

+# The Fuchsia archive format (FAR) is a specific container format used by the

+# Fuchsia operating system to store directory trees, typically for software packages.

+#

+# https://fuchsia.dev/fuchsia-src/development/source_code/archive_format

+#

+# From <ysaxenax@gmail.com> "Yuvraj Saxena"

+#

+0 ubequad 0xc8bf0b48adabc511 Fuchsia OS FAR Archive

+

+#------------------------------------------------------------------------------

+# $File: atari,v 1.2 2026/04/30 18:40:15 christos Exp $

+# atari: file(1) magic for Atari formats:

+

+# Operating system ROMs for the Atari ST series of computers, including a

+# GPLv2+ implementation called EmuTOS.

+# Teemu Hukkanen <tjhukkan@iki.fi>

+#

+# OSHEADER https://freemint.github.io/tos.hyp/en/OSHEADER.html

+# The first byte is a bra.s instruction, an unconditional short jump

+0 byte 0x60

+# The second byte is the offset for the jump target address,

+# jumping past the OS header

+# TOS 1.00 uses 0x1E

+>0x01 byte 0x1E

+>>0 use atari-tos-rom

+# TOS >1.00 and EmuTOS uses 0x2E

+>0x01 byte 0x2E

+>>0 use atari-tos-rom

+

+# EmuTOS for Amiga

+0 beshort 0x1111

+>0x02 beshort 0x4EF9

+>>0xD2 beshort 0x602E

+>>>0xD2 use atari-tos-versions

+

+0 name atari-tos-versions

+# Enumerate all known versions

+>0x02 beshort 0x0100 Atari TOS ROM 1.00

+>>0 use atari-tos-rom

+# EmuTOS uses 1.04 for 192kB ROMs, and 2.06 for >=256kB ROMs

+>0x02 beshort 0x0102 Atari TOS ROM 1.02

+>>0 use atari-tos-rom

+>0x02 beshort 0x0104 Atari TOS ROM 1.04

+>>0 use atari-tos-rom

+>0x02 beshort 0x0106 Atari TOS ROM 1.06

+>>0 use atari-tos-rom

+>0x02 beshort 0x0162 Atari TOS ROM 1.62

+>>0 use atari-tos-rom

+>0x02 beshort 0x0205 Atari TOS ROM 2.05

+>>0 use atari-tos-rom

+>0x02 beshort 0x0206

+# ST-Book TOS 2.08 header says 2.06, identify it by release date

+>>0x18 belong 0x03101992 Atari TOS ROM 2.08

+>>>0 use atari-tos-rom

+>>0x18 belong !0x03101992 Atari TOS ROM 2.06

+>>>0 use atari-tos-rom

+>0x02 beshort 0x0207 Atari TOS ROM 2.07

+>>0 use atari-tos-rom

+>0x02 beshort 0x0208 Atari TOS ROM 2.08

+>>0 use atari-tos-rom

+>0x02 beshort 0x0300 Atari TOS ROM 3.00

+>>0 use atari-tos-rom

+>0x02 beshort 0x0301 Atari TOS ROM 3.01

+>>0 use atari-tos-rom

+>0x02 beshort 0x0305 Atari TOS ROM 3.05

+>>0 use atari-tos-rom

+>0x02 beshort 0x0306 Atari TOS ROM 3.06

+>>0 use atari-tos-rom

+>0x02 beshort 0x0400 Atari TOS ROM 4.00

+>>0 use atari-tos-rom

+>0x02 beshort 0x0401 Atari TOS ROM 4.01

+>>0 use atari-tos-rom

+>0x02 beshort 0x0402 Atari TOS ROM 4.02

+>>0 use atari-tos-rom

+>0x02 beshort 0x0404 Atari TOS ROM 4.04

+>>0 use atari-tos-rom

+

+0 name atari-tos-rom

+# Release date, display using ISO 8601 date

+# Year

+>0x1A beshort x %.4x

+# Month

+>0x18 byte x \b-%.2x

+# Day

+>0x19 byte x \b-%.2x

+# os_conf: Video sync mode and language/country

+#>0x1C beshort x (os_conf: %u)

+# Video mode is not relevant for multilingual variants

+>0x1C beshort !255

+>>0x1C beshort ^1 Video: NTSC

+>>0x1C beshort &1 Video: PAL

+# Language / Country

+# https://github.com/emutos/emutos/blob/master/include/ctrycodes.h

+# TOS uses a country to indicate locale, use IETF language tags instead.

+>0x1C beshort x Locale:

+>0x1C beshort 0 en-US

+# PAL 1.04 and 1.06 TEX variants

+>0x1C beshort 1

+>>0x2A85C string AUSWAHL: de-DE

+# NTSC with de-DE

+>0x1C beshort 2

+# NTSC Kaos TOS de-CH

+>>0x26806 string Auswahl: de-CH

+# NTSC Kaos TOS en-GB

+>>0x26806 string Select: en-GB

+# NTSC 1.06 TEX variant

+>>0x2A4FC string AUSWAHL: de-DE

+# NTSC 2.06 TEX variant

+>>0x32C3E string AUSWAHL: de-DE

+# PAL de-DE

+# Several translations are based on de-DE, detect all known variants.

+>0x1C beshort 3

+# 1.00 de-DE

+>>0x15097 string AUSWAHL de-DE

+# 1.00 fi-FI

+>>0x15092 string VALINTA fi-FI

+# 1.00 dk-DK

+>>0x15090 string FIL\ V dk-DK

+# 1.02 de-DE

+>>0x16691 string AUSWAHL de-DE

+# 1.04 de-DE

+>>0x2BAE2 string AUSWAHL: de-DE

+# 1.04 cs-CZ

+>>0x2BAE4 string Soubor: cs-CZ

+# 1.04 de-DE

+>>0x2BAEC string AUSWAHL: de-DE

+# 1.06 de-DE

+>>0x2DA56 string AUSWAHL: de-DE

+# 1.62 de-DE

+>>0x2DB4A string AUSWAHL: de-DE

+# 1.62 cs-CZ

+>>0x2DB4C string Soubor: cs-CZ

+# 2.05 is-IS

+>>0x34E80 string Drif: is-IS

+# 2.05 de-DE

+>>0x34E5A string AUSWAHL: de-DE

+# 2.06 de-DE

+>>0x36B68 string AUSWAHL: de-DE

+# 2.06 cs-CZ

+>>0x36B68 string Soubor: cs-CZ

+# 2.06 sr-Latn

+>>0x36B68 string IZBOR: sr-Latn

+# 2.06 sr-Cyrl

+>>0x36B68 belong 0xC8C7C1CE sr-Cyrl

+# 2.08 de-DE

+>>0x36B18 string AUSWAHL: de-DE

+# 3.01 de-DE

+>>0x395F0 string AUSWAHL: de-DE

+# 3.06 de-DE

+>>0x3EDD2 string AUSWAHL: de-DE

+# EmuTOS uses the de-DE language code correctly

+>>0x2C string ETOS de-DE

+>0x1C beshort 5 fr-FR

+>0x1C beshort 7 en-GB

+>0x1C beshort 9 es-ES

+>0x1C beshort 11 it-IT

+# PAL sv-SE

+>0x1C beshort 13

+# 1.02 sv-SE

+>>0x1979F string PAPPERSKORG sv-SE

+# 1.04 sv-SE

+>>0x2FC9F string PAPPERSKORG sv-SE

+# 1.04 no-NO

+>>0x2FCA0 string Papirkurv no-NO

+# 1.06 sv-SE

+>>0x31C13 string PAPPERSKORG sv-SE

+# 1.62 sv-SE

+>>0x31D07 string PAPPERSKORG sv-SE

+# 2.05 sv-SE

+>>0x3C309 string PAPPERSKORG sv-SE

+# 2.06 sv-SE

+>>0x3E00D string PAPPERSKORG sv-SE

+# 3.06 sv-SE

+>>0x46277 string PAPPERSKORG sv-SE

+# EmuTOS uses the sv-SE language code correctly

+>>0x2C string ETOS sv-SE

+# 2.06 NTSC ru-RU (2004)

+>0x1C beshort 14 ru-RU

+>0x1C beshort 15 fr-CH

+# Kaos TOS NTSC de-CH

+>0x1C beshort 16 de-CH

+>0x1C beshort 17 de-CH

+>0x1C beshort 19 tr-TR

+>0x1C beshort 21 fi-FI

+>0x1C beshort 23 no-NO

+>0x1C beshort 25 dk-DK

+# Dutch TOS 1.04 (1989-04-06) uses Saudi-Arabia as country code.

+>0x1C beshort 27

+>>0x2BAB0 string Selectie: nl-NL

+>0x1C beshort 29 nl-NL

+>0x1C beshort 31 cs-CZ

+>0x1C beshort 33 hu-HU

+>0x1C beshort 35 pl-PL

+>0x1C beshort 39 ru-RU

+>0x1C beshort 49 ro-RO

+>0x1C beshort 63 el-GR

+>0x1C beshort 109 cat

+# Multilingual TOS, either TOS 4.x, or 1024kB EmuTOS, which contain multiple

+# languages, and select the language and video mode based on settings in

+# NVRAM.

+>0x1C beshort 255 Multilingual

+# Kaos TOS, a modified version of TOS 1.04

+>0x5FFC string KAOS Kaos TOS

+>0x2CDB0 string 1.4.3 Kaos TOS 1.4.3

+# EmuTOS

+>0x2C string ETOS EmuTOS

+# Extended OS header, EmuTOS >= 1.0.0

+# https://github.com/emutos/emutos/blob/master/doc/version.txt

+>0x34 string OSXH

+# Length of extended OS header

+>>0x38 belong 25

+# Major version

+>>>0x3C byte x v%d

+# Minor version

+>>>0x3D byte x \b.%d

+# Fix version

+>>>0x3E byte x \b.%d

+# Zero means official release, Non-zero means snapshot

+>>>0x3F byte !0 Snapshot

+# Display version string for snapshots

+>>>>(0x40.L) string x (%s)

+>>>0x48 beshort x Machine:

+>>>0x48 beshort &1 ST

+>>>0x48 beshort &2 STe

+>>>0x48 beshort &4 TT

+>>>0x48 beshort &8 Falcon

+>>>0x48 beshort &16 FireBee

+>>>0x48 beshort &32 M548X

+>>>0x48 beshort &64 Amiga

+>>>0x48 beshort &256 ARAnyM

+>>>0x4A beshort x CPU:

+>>>0x4A beshort &1 68000

+>>>0x4A beshort &2 68010

+>>>0x4A beshort &4 68020

+>>>0x4A beshort &8 68030

+>>>0x4A beshort &16 68040

+>>>0x4A beshort &32 68060

+>>>0x4A beshort &64 68080

+>>>0x4A beshort &256 ColdFire-V4e

+# Adjustable cold boot delay in seconds when > 0.

+>>>0x4C byte >0 Boot-Delay: %is

+# $File: c-lang,v 1.39 2026/04/16 18:17:04 christos Exp $

+>0 regex \^[[:space:]]*public:[[:space:]]*$ C++ source text

+>0 regex \^[[:space:]]*private:[[:space:]]*$ C++ source text

+>0 regex \^[[:space:]]*protected:[[:space:]]*$ C++ source text

+# $File: cad,v 1.32 2026/04/16 15:06:17 christos Exp $

+

+# AutoCAD Slide

+# Screen captures created by MSLIDE, viewed with VSLIDE

+# Spec: http://www.martinreddy.net/gfx/2d/SLD.txt

+# PRONOM: x-fmt/105

+

+0 string AutoCAD\ Slide\r\n\x1a\0 AutoCAD Slide,

+!:mime image/x-sld

+!:ext sld

+>17 byte 0x56 version 2

+>29 leshort 0x1234 \b, little-endian

+>29 beshort 0x1234 \b, big-endian

+# $File: coff,v 1.16 2026/04/20 14:53:18 christos Exp $

+# Processor type OMNI is for OMNI VM, for example used by omniprox.dll and can be created by MSVC6.0 CVTRES.EXE with /MACHINE:OMNI flag

+>0 uleshort 0xace1 OMNI VM

+# $File: compress,v 1.99 2026/04/17 12:52:29 christos Exp $

+#------------------------------------------------------------------------------

+# ZXC: ZXC compressed data

+# From: Bertrand Lebonnois <zxc.codec@gmail.com>

+# https://github.com/hellobertrand/zxc

+0 lelong 0x9CB02EF5 ZXC compressed data

+!:mime application/x-zxc

+!:ext zxc

+>4 byte x \b (v%u)

+>6 byte &0x80 \b, checksum enabled

+

+#------------------------------------------------------------------------------

+# Kanzi: Kanzi compressed data

+# From: Frederic Langlet <flanglet@gmail.com>

+# https://github.com/flanglet/kanzi-cpp/wiki/Bitstream-Format

+0 belong 0x4B414E5A kanzi compressed data

+!:mime application/x-knz

+!:ext knz

+>4 byte/16 x \b, version %u

+

+# Branch for Version > 5 (Uses Bits 3 and 2 for checksum)

+>4 byte/16 >5

+>>4 byte&0x0C 0x04 \b, 32-bit checksum

+>>4 byte&0x0C 0x08 \b, 64-bit checksum

+

+# DTSZ (Data Transformer Standard Zip)

+# Maintainer: Arie Abraham Benichou

+0 belong&0xFFFF8000 0x020208000 DTSZ compressed data

+>2 byte&0x7F x \b, version %d

+!:mime application/x-dtsz

+!:ext dtsz

+# $File: console,v 1.82 2026/06/02 16:59:22 christos Exp $

+

+# Mii character data (Wii/3DS)

+0 string RNCD Mii character data

+# Mii database (Wii)

+0 string RNOD Mii database entry

+# $File: dyadic,v 1.10 2026/05/09 20:08:12 christos Exp $

+>>>1 byte 0x1a session layout file

+# $File: filesystems,v 1.171 2026/05/17 17:30:59 christos Exp $

+# exFAT

+# x86 real mode relative jump followed by string "EXFAT "

+>0 string \xEB\x76\x90EXFAT\ \ \ \b, ExFAT Filesystem

+>>0x6E ubyte <3 \b, numer of FATs %d

+>>>0x69 ubyte x \b, revision %d.

+>>>0x68 ubyte x \b%d

+>>>0x6C ubyte x \b, (1<<%d) bytes per sector

+>>>0x6D ubyte x \b, (1<<%d) sectors per cluster

+>>>0x48 ulequad x \b, sectors %lld

+>>>0x64 ulelong x \b, serial number %#x

+# MS Windows compat, SD association SDXC spec part 2

+>>>0x1B8 ulelong >0 \b, with MBR disk signature %#-.4x

+>>>>0x1C6 ulelong 0 \b, recursive partition

+

+>1312 lelong&0xa 0x2 soft updates,

+>1312 lelong&0xa 0xa soft updates journaling,

+>1312 lelong&0x40 0x40 GEOM journaling,

+>1312 lelong&0x10 0x10 POSIX.1e ACLs,

+>1312 lelong&0x100 0x100 NFSv4 ACLs,

+# $File: finger,v 1.4 2026/04/17 15:22:11 christos Exp $

+

+# http://justsolve.archiveteam.org/wiki/Audfprint_fingerprint_file

+0 string audfprinthash Audfprint fingerprint data

+0 string audfprintpeak Audfprint fingerprint data

+!:ext afpt/afpk

+# $File: fonts,v 1.55 2026/03/24 22:28:58 christos Exp $

+0 string \000\001\000\000

+>>12 regex/4l \^[A-Za-z][A-Za-z2][A-Za-z/\ ][A-Za-z2\ ]

+#>>>0 ubelong x \b, sfnt version %#x

+>>>0 ubelong !0x4f54544f TrueType

+# fontkit FK

+>>>>12 ubelong 0x464b2020 (FontKit)

+>>>0 ubelong =0x4f54544f OpenType

+>>>12 ubelong !0x464b2020 (FontKit)

+>>>>12 string x \b, 1st "%4.4s"

+# $File: games,v 1.40 2026/04/16 20:25:40 christos Exp $

+2 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format

+>2 regex/c GM\\[1\\] - Go Game

+>2 regex/c GM\\[6\\] - BackGammon Game

+>2 regex/c GM\\[11\\] - Hex Game

+>2 regex/c GM\\[18\\] - Amazons Game

+>2 regex/c GM\\[19\\] - Octi Game

+>2 regex/c GM\\[20\\] - Gess Game

+>2 regex/c GM\\[21\\] - twix Game

+>8 regex/30c [a-z0-9:\ ]+\0\0 created on %s

+

+

+# osu! replay file

+# https://osu.ppy.sh/wiki/en/Client/File_formats/osr_%28file_format%29

+# Weak magic

+#1 lelong >20070000

+## osu lazer, why 90 C3 C9 01?

+#>1 lelong <30000017

+#>>0 byte <4

+#>>>5 byte 0x0b

+#>>>>0 byte 0 osu! standard

+#>>>>0 byte 1 osu! taiko

+#>>>>0 byte 2 osu! catch

+#>>>>0 byte 3 osu! mania

+#>>>>1 lelong x \b replay, version %u

+#!:ext osr

+#!:mime application/x-osu-replay

+

+# osu! beatmap file

+# https://osu.ppy.sh/wiki/en/Client/File_formats/osu_%28file_format%29

+

+0 string osu\040file\040format\040v osu! beatmap file

+>17 string x \b, version %s

+!:ext osu

+!:mime application/x-osu-beatmap

+# $File: images,v 1.276 2026/06/02 17:44:28 christos Exp $

+# https://www.w3.org/TR/png-3/#11IHDR

+>9 default x invalid color type,

+>10 ubyte !0 invalid compression,

+#>11 ubyte 0 adaptive,

+>11 ubyte !0 invalid filter method,

+>12 ubyte >1 invalid interlace method

+

+# APNG acTL parser

+# https://www.w3.org/TR/png-3/#acTL-chunk

+0 name apng-actl

+>0 ubelong 1 \b, %d frame

+>0 ubelong >1 \b, %d frames

+>4 ubelong 0 \b, play indefinitely

+>4 ubelong 1 \b, %d play

+>4 ubelong >1 \b, %d plays

+

+# PNG image.

+0 string \x89PNG\x0d\x0a\x1a\x0a

+!:strength +10

+>8 clear x

+

+# Mozilla APNG image.

+>33 search/16384 \x00\x00\x00\x08acTL Animated PNG image data

+!:mime image/apng

+!:ext apng/png

+>>8 string \x00\x00\x00\x0DIHDR

+>>>16 use png-ihdr

+>>&0 use apng-actl

+>8 default x

+>>8 string \x00\x00\x00\x0DIHDR PNG image data

+!:ext png

+>>>16 use png-ihdr

+>8 string \x00\x00\x00\x04CgBI

+!:ext png

+# file size 32128 is always Atari NEOchrome, not DEGAS.

+# NEOchrome files have a 128-byte header (vs DEGAS 34-byte header)

+# and are always exactly 32128 bytes (128 + 32000 pixel data).

+# DEGAS uncompressed is 32034, DEGAS Elite uncompressed is 32066.

+# URL: http://fileformats.archiveteam.org/wiki/NEOchrome

+# Reference: https://wiki.multimedia.cx/index.php?title=Neochrome

+>>>>0 use neochrome-bitmap

+# Note: GEM v1 checks must be a separate top-level entry from DEGAS mid-res

+# above, because the >>-0 offset (end-of-file) tests for DEGAS file sizes

+# corrupt the offset context for sibling > checks at level 1.

+# commented out, dup warning should be fixed differently

+#0 beshort 0x0001

+#>2 beshort 0x0008

+#>>0 use gem_info

+#>2 beshort 0x0009

+#>>0 use gem_info

+## no example for NOSIG

+#>2 beshort 24

+#>>0 use gem_info

+## no example for HYPERPAINT

+#>2 beshort 25

+#>>0 use gem_info

+#16 string XIMG\0

+#>0 use gem_info

+## no example

+#>0 use gem_info

+## no example or description

+#16 string TIMG\0

+#>0 use gem_info

+# display information of Atari NEOchrome bitmap images

+# NEOchrome files are always 32128 bytes (128-byte header + 32000 pixel data)

+# and always 320x200 at 16 colours (low-res only)

+0 name neochrome-bitmap

+>0 ubyte x Atari NEOchrome bitmap 320 x 200 x 16

+!:mime image/x-neo

+!:ext neo

+

+# Usenix FaceSaver - grayscale face image format

+# Created by Metron Computerware Ltd., used at USENIX conferences from 1987.

+# ASCII format: header lines (FirstName:, LastName:, PicData:, Image:, etc.)

+# followed by hex-encoded pixel data.

+# Spec: https://www.fileformat.info/format/facesaver/egff.htm

+# Netpbm: fstopgm, pgmtofs

+

+0 string FirstName: Usenix FaceSaver image data

+!:mime image/x-facesaver

+!:ext face/fs

+

+# CompuServe RLE (CIS) - monochrome bitmap, predecessor to GIF

+# Created by CompuServe Inc., specified October 1986 by Chris Hopkins.

+# Spec: https://www.brutman.com/RLE/RLESTND.TXT

+# ESC G H = high-res (256x192), ESC G M = medium-res (128x96)

+# Files use .rle extension (clashes with Utah RLE and others)

+

+0 string \x1bGH CompuServe RLE image data, 256 x 192

+!:mime image/x-compuserve-rle

+!:ext rle/cis

+

+0 string \x1bGM CompuServe RLE image data, 128 x 96

+!:mime image/x-compuserve-rle

+!:ext rle/cis

+

+# Created by Russell Marks in 1997 for zgv (https://en.wikipedia.org/wiki/Zgv)

+0 string MRF1 MRF image data,

+!:mime image/x-mrf

+!:ext mrf

+>4 belong x %d x

+>8 belong x %d

+

+# FIASCO - Fractal Image And Sequence Codec

+# Author: Ullrich Hafner, Univ. Würzburg (1999)

+# Source: https://github.com/l-tamas/Fiasco codec/wfa.h

+0 string FIASCO\n FIASCO fractal compressed image data

+!:ext wfa/fco

+

+0 string Fiasco FIASCO basis (dictionary) file

+!:ext fco

+

+0 string Jasc\040Paint\040Shop\040Pro\040Browser\040Cache\040File Jasc Paint Shop Pro Browser Cache

+>40 string %s (version %s)

+# Magic file for older Jasc Paint Shop Pro Browser Cache files (.jbf)

+0 string JASC\040BROWS\040FILE Jasc Paint Shop Pro Browser Cache (old format)

+

+# SBIG CCDOPS - CCD astronomical camera image format.

+# Created by Santa Barbara Instrument Group (SBIG), 1988.

+# Header line 1 is always "ST-N Image" where N is the camera model

+# number (4, 5, 6, 7, 8, 9, 10, 237, 402, etc.)

+# Spec formerly at sbig.com. Netpbm: sbigtopgm, pgmtosbig

+0 string ST-

+>&0 regex [0-9]+\040Image SBIG CCDOPS camera image

+!:mime image/x-sbig

+# $File: interleaf,v 1.11 2026/06/02 17:29:55 christos Exp $

+

+# Interleaf image data (ileaf img format) Used by Interleaf (later BroadVision)

+# technical publishing software.

+# Header: 0x89 "OPS" magic, BE 16-bit version, resolution, dimensions,

+# depth, compression flag, optional colormap.

+# Netpbm: leaftoppm, ppmtoleaf

+

+0 string \x89OPS Interleaf image data

+!:mime image/x-interleaf

+!:ext leaf

+# $File: ispell,v 1.11 2026/04/16 18:06:17 christos Exp $

+# XXX: too weak

+#>>>0 default x

+#>>>>0 search/3233 suffixes\n

+#>>>>>0 use spell-aff

+# $File: javascript,v 1.8 2026/04/15 17:29:21 christos Exp $

+!:mime text/javascript

+!:mime text/javascript

+!:mime text/javascript

+!:mime text/javascript

+!:mime text/javascript

+!:mime text/javascript

+!:mime text/javascript

+!:mime text/javascript

+!:mime text/javascript

+!:mime text/javascript

+!:mime text/javascript

+!:mime text/javascript

+!:mime text/javascript

+!:mime text/javascript

+!:mime text/javascript

+!:mime text/javascript

+

+#------------------------------------------------------------------------------

+# $File: k9,v 1.1 2026/03/20 13:59:12 christos Exp $

+# k9: file(1) magic for K9 Self-Validating Components

+# URL: https://github.com/hyperpolymath/k9-svc

+# From: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>

+

+# K9 files are self-validating components using the must-just-nickel triad.

+# They begin with the ASCII magic number "K9!" (0x4B 0x39 0x21) and use a

+# tiered security model: Kennel (data only), Yard (validation), Hunt (full

+# execution with cryptographic signature).

+# Specification: https://github.com/hyperpolymath/standards/blob/main/k9-svc/SPEC.adoc

+# MIME type: application/vnd.k9+nickel

+

+# K9 magic number: "K9!" at byte offset 0

+0 string K9! K9 Self-Validating Component

+!:mime application/vnd.k9+nickel

+!:ext k9

+

+# Detect security level from content following the magic number

+>&0 search/1024 security_level:\ 'Kennel K9 Self-Validating Component (Kennel level, data only)

+

+>&0 search/1024 security_level:\ 'Yard K9 Self-Validating Component (Yard level, validation)

+

+>&0 search/1024 security_level:\ 'Hunt K9 Self-Validating Component (Hunt level, executable)

+

+# K9 Nickel contract files (.k9.ncl) -- pedigree definition

+0 search/256 K9Pedigree K9 Nickel contract (pedigree definition)

+!:mime application/vnd.k9+nickel

+!:ext k9.ncl/ncl

+!:strength -10

+# $File: lua,v 1.10 2026/04/17 15:24:30 christos Exp $

+0 search/1/w #!\ /usr/libexec/flua Lua script text executable

+!:mime text/x-lua

+# $File: mail.news,v 1.34 2026/06/02 18:47:23 christos Exp $

+0 string Received: RFC 822 mail text

+# $File: mips,v 1.16 2026/04/19 20:17:41 christos Exp $

+>16 leshort 0

+>>0 use display-coff

+# $File: msdos,v 1.216 2026/03/11 20:05:18 christos Exp $

+>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text

+>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text

+>>(1.s+65539) byte x

+

+#------------------------------------------------------------------------------

+# $File: nix,v 1.1 2026/06/02 19:41:27 christos Exp $

+# nix: Nix Expression Language (.nix)

+#------------------------------------------------------------------------------

+

+# Detect via common function arguments or structural patterns at the start

+0 string {

+>1 search/500 stdenv Nix package definition

+#>1 search/500 mkDerivation Nix expression (mkDerivation)

+

+# Fallback: Detect if it's a generic Nix attribute set or function layout

+#0 search/100 stdenv.mkDerivation Nix expression (mkDerivation)

+# search/100 import <nixpkgs> Nix expression (script/default)

+# $File: ole2compounddocs,v 1.30 2026/04/17 14:43:18 christos Exp $

+!:mime application/hwp+zip

+

+#------------------------------------------------------------------------------

+# $File: partclone,v 1.1 2026/05/09 20:03:34 christos Exp $

+# partclone: file(1) magic for images generated by partclone(8)

+#

+# Format documentation: <https://github.com/Thomas-Tsai/partclone/blob/master/IMAGE_FORMATS.md>

+#------------------------------------------------------------------------------

+

+0 string partclone-image

+# version 0001

+>30 string 0001

+>>34 short 0

+>>>15 string/T >\0 Partclone image, version 0001, filesystem: %s

+>>>40 lequad >0 \b, total size %llu

+>>>36 lelong >0 \b, block size %u

+>>>56 lequad >0 \b, %llu/

+>>>48 lequad >0 \b%llu blocks used

+# version 0002

+>30 string 0002

+>>92 leshort 2

+>>>16 string/T >\0 Partclone image, version 0002, created by v%s

+>>>36 string/T >\0 \b, filesystem: %s

+>>>34 leshort 0xC0DE

+>>>>52 lequad >0 \b, total size %llu

+>>>>84 lelong >0 \b, block size %u

+>>>>76 lequad >0 \b, %llu/

+>>>>60 lequad >0 \b%llu blocks used

+>>>34 leshort 0xDEC0

+>>>>52 bequad >0 \b, total size %llu

+>>>>84 belong >0 \b, block size %u

+>>>>76 bequad >0 \b, %llu/

+>>>>60 bequad >0 \b%llu blocks used

+# $File: riff,v 1.53 2026/04/16 17:09:52 christos Exp $

+>8 string WEBP \b, WebP image

+# $File: ruby,v 1.11 2026/06/02 22:05:09 christos Exp $

+# $File: sun,v 1.30 2026/06/02 17:28:15 christos Exp $

+

+

+# Sun Icon - raster icon format from SunView/OpenWindows

+# Used on Sun workstations from the mid-1980s onwards.

+# ASCII format: C-style comment header with dimensions, followed by hex data.

+# Netpbm: sunicontopnm

+

+0 string /*\ Format_version=1 Sun icon image data

+!:mime image/x-sun-icon

+!:ext icon/ico

+# $File: tex,v 1.25 2026/06/02 18:16:34 christos Exp $

+0 search/b/1 \\input\ texinfo Texinfo source text

+0 search/b/1 This\ is\ Info\ file GNU Info text

+!:mime text/x-info

+0 search/b/10 INFO-DIR-SECTION GNU Info text

+!:mime text/x-info

+0 search/b/10 START-INFO-DIR-ENTRY GNU Info text

+# $File: virtual,v 1.23 2026/04/15 16:56:41 christos Exp $

+>0x1c lelong 0 \b, RAW (no compression)

+>0x1c lelong 1 \b, gzip compressed

+>0x1c lelong 2 \b, bzip2 compressed

+>0x1c lelong 3 \b, xz compressed

+>0x1c lelong 4 \b, lzop compressed

+# $File: windows,v 1.73 2026/04/20 14:53:18 christos Exp $

+>>1 regex/c \^([^\xd>]*|.*\\.hlp) MS Windows help file Content, based "%s"

+>>&0 regex/c \^autorun

+>>&0 regex/c \^(version|strings)] Windows setup INFormation

+>>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation

+>>&0 regex/1024c \^(\\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini

+>>&0 regex/c \^don't\ load] Windows CONTROL.INI

+>>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI

+>>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI

+>>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI

+>>&0 regex/c \^SafeList] Windows IOS.INI

+>>&0 regex/c \^boot\x20loader] Windows boot.ini

+>>&0 regex/c \^menu] MS-DOS CONFIG.SYS

+>>&0 regex/c \^Paths]\r\n MS-DOS MSDOS.SYS

+>>&0 regex/c \^options]\r\n Microsoft HTML Help Project

+>>&0 regex/c \^Windows\ (Latin|Cyrillic) Windows codepage translator

+>>&0 regex/c \^Shell]\r\n Windows Explorer Shell Command File

+>>&0 regex/c \^SCF]\r\n VIA setup configuration

+>>&0 regex/c \^Languages] InstallShield Language Identifier

+>>&0 regex/c \^TagInfo] TagInfo

+>>>>>>&-1 regex/T \^([A-Za-z0-9_\(\)\ ]+)\]\r Generic INItialization configuration [%-.40s

+

+# Magic file for OllyDbg 2.01 Module Info files (.udd)

+0 string Mod\x00 OllyDbg 2.0 Module Info File

+

+# COFF object files for OMNI VM

+# MSVC6.0 CVTRES.EXE can create COFF binary for OMNI by /MACHINE:OMNI flag

+0 leshort =0xace1

+>0 use display-coff

+# $File: wordprocessors,v 1.40 2026/04/16 19:12:15 christos Exp $

+

+

+# Atari 1st Word Plus files

+0 string \x1F0 1st Word Plus file

+# $File: Makefile.am,v 1.206 2026/06/02 19:41:27 christos Exp $

+$(MAGIC_FRAGMENT_DIR)/a2ml \

+$(MAGIC_FRAGMENT_DIR)/andrew \

+$(MAGIC_FRAGMENT_DIR)/atari \

+$(MAGIC_FRAGMENT_DIR)/k9 \

+$(MAGIC_FRAGMENT_DIR)/nix \

+$(MAGIC_FRAGMENT_DIR)/partclone \

+$(MAGIC_FRAGMENT_DIR)/ringdove \

+$(MAGIC_FRAGMENT_DIR)/rtf \

+$(MAGIC_FRAGMENT_DIR)/web \

+# Makefile.in generated by automake 1.18 from Makefile.am.

+# Copyright (C) 1994-2025 Free Software Foundation, Inc.

+am__rm_f = rm -f $(am__rm_f_notfound)

+am__rm_rf = rm -rf $(am__rm_f_notfound)

+ { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \

+ || { echo " ( cd '$$dir' && rm -f" $$files ")"; \

+ $(am__cd) "$$dir" && echo $$files | $(am__xargs_n) 40 $(am__rm_f); }; \

+am__rm_f_notfound = @am__rm_f_notfound@

+am__xargs_n = @am__xargs_n@

+# $File: Makefile.am,v 1.206 2026/06/02 19:41:27 christos Exp $

+$(MAGIC_FRAGMENT_DIR)/a2ml \

+$(MAGIC_FRAGMENT_DIR)/andrew \

+$(MAGIC_FRAGMENT_DIR)/atari \

+$(MAGIC_FRAGMENT_DIR)/k9 \

+$(MAGIC_FRAGMENT_DIR)/nix \

+$(MAGIC_FRAGMENT_DIR)/partclone \

+$(MAGIC_FRAGMENT_DIR)/ringdove \

+$(MAGIC_FRAGMENT_DIR)/rtf \

+$(MAGIC_FRAGMENT_DIR)/web \

+

+ -$(am__rm_f) $(CLEANFILES)

+ -$(am__rm_f) $(CONFIG_CLEAN_FILES)

+ -test . = "$(srcdir)" || $(am__rm_f) $(CONFIG_CLEAN_VPATH_FILES)

+

+# Tell GNU make to disable its built-in pattern rules.

+%:: %,v

+%:: RCS/%,v

+%:: RCS/%

+%:: s.%

+%:: SCCS/s.%

+# Common wrapper for a few potentially missing GNU and other programs.

+scriptversion=2024-12-03.03; # UTC

+# shellcheck disable=SC2006,SC2268 # we must support pre-POSIX shells

+

+# Copyright (C) 1996-2025 Free Software Foundation, Inc.

+aclocal autoconf autogen autoheader autom4te automake autoreconf

+bison flex help2man lex makeinfo perl yacc

+Report bugs to <bug-automake@gnu.org>.

+GNU Automake home page: <https://www.gnu.org/software/automake/>.

+General help using GNU software: <https://www.gnu.org/gethelp/>."

+ echo "missing (GNU Automake) $scriptversion"

+ aclocal|automake|autoreconf)

+ *)

+ :

+ ;;

+ autoheader_deps="'acconfig.h'"

+ automake_deps="'Makefile.am'"

+ aclocal_deps="'acinclude.m4'"

+ aclocal*)

+ echo "You should only need it if you modified $aclocal_deps or"

+ echo "$configure_deps."

+ ;;

+ echo "You should only need it if you modified $configure_deps."

+ ;;

+ autogen*)

+ echo "You should only need it if you modified a '.def' or '.tpl' file."

+ echo "You may want to install the GNU AutoGen package:"

+ echo "<$gnu_software_URL/autogen/>"

+ echo "You should only need it if you modified $autoheader_deps or"

+ echo "You should only need it if you modified $automake_deps or"

+ autom4te*)

+ ;;

+ autoreconf*)

+ echo "You should only need it if you modified $aclocal_deps or"

+ echo "$automake_deps or $autoheader_deps or $automake_deps or"

+ echo "$configure_deps."

+ lex*|flex*)

+ echo "You should only need it if you modified a '.l' file."

+ echo "You may want to install the Fast Lexical Analyzer package:"

+ echo "<$flex_URL>"

+ ;;

+ perl*)

+ echo "You should only need it to run GNU Autoconf, GNU Automake, "

+ echo " assorted other tools, or if you modified a Perl source file."

+ echo "You may want to install the Perl 5 language interpreter:"

+ echo "<$perl_URL>"

+ ;;

+ program_details "$normalized_program"

+# eval: (add-hook 'before-save-hook 'time-stamp nil t)

+# Makefile.in generated by automake 1.18 from Makefile.am.

+# Copyright (C) 1994-2025 Free Software Foundation, Inc.

+am__rm_f = rm -f $(am__rm_f_notfound)

+am__rm_rf = rm -rf $(am__rm_f_notfound)

+am__rm_f_notfound = @am__rm_f_notfound@

+am__xargs_n = @am__xargs_n@

+

+ -$(am__rm_f) $(CONFIG_CLEAN_FILES)

+ -test . = "$(srcdir)" || $(am__rm_f) $(CONFIG_CLEAN_VPATH_FILES)

+

+# Tell GNU make to disable its built-in pattern rules.

+%:: %,v

+%:: RCS/%,v

+%:: RCS/%

+%:: s.%

+%:: SCCS/s.%

+ self._close = _close

+ if self._close:

+ self._close(self._magic_t)

+ file_opts.h elfclass.h mygetopt.h cdf.c cdf_time.c readcdf.c cdf.h \

+ swap.c swap.h

+file_SOURCES = file.c seccomp.c landlock.c

+# Makefile.in generated by automake 1.18 from Makefile.am.

+# Copyright (C) 1994-2025 Free Software Foundation, Inc.

+am__rm_f = rm -f $(am__rm_f_notfound)

+am__rm_rf = rm -rf $(am__rm_f_notfound)

+ { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \

+ || { echo " ( cd '$$dir' && rm -f" $$files ")"; \

+ $(am__cd) "$$dir" && echo $$files | $(am__xargs_n) 40 $(am__rm_f); }; \

+ apptype.lo der.lo cdf.lo cdf_time.lo readcdf.lo swap.lo

+am_file_OBJECTS = file.$(OBJEXT) seccomp.$(OBJEXT) landlock.$(OBJEXT)

+ ./$(DEPDIR)/landlock.Po ./$(DEPDIR)/magic.Plo \

+ ./$(DEPDIR)/print.Plo ./$(DEPDIR)/readcdf.Plo \

+ ./$(DEPDIR)/readelf.Plo ./$(DEPDIR)/seccomp.Po \

+ ./$(DEPDIR)/softmagic.Plo ./$(DEPDIR)/swap.Plo

+am__rm_f_notfound = @am__rm_f_notfound@

+am__xargs_n = @am__xargs_n@

+ file_opts.h elfclass.h mygetopt.h cdf.c cdf_time.c readcdf.c cdf.h \

+ swap.c swap.h

+file_SOURCES = file.c seccomp.c landlock.c

+ cd "$(DESTDIR)$(bindir)" && $(am__rm_f) $$files

+ $(am__rm_f) $(bin_PROGRAMS)

+ test -z "$(EXEEXT)" || $(am__rm_f) $(bin_PROGRAMS:$(EXEEXT)=)

+ -$(am__rm_f) $(lib_LTLIBRARIES)

+ echo rm -f $${locs}; \

+ $(am__rm_f) $${locs}

+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/landlock.Po@am__quote@ # am--include-marker

+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/swap.Plo@am__quote@ # am--include-marker

+ @: >>$@

+

+ -$(am__rm_f) $(CLEANFILES)

+ -$(am__rm_f) $(CONFIG_CLEAN_FILES)

+ -test . = "$(srcdir)" || $(am__rm_f) $(CONFIG_CLEAN_VPATH_FILES)

+ -$(am__rm_f) $(BUILT_SOURCES)

+ -rm -f $(DEPDIR)/asctime_r.Plo

+ -rm -f ./$(DEPDIR)/landlock.Po

+ -rm -f ./$(DEPDIR)/swap.Plo

+ -rm -f $(DEPDIR)/asctime_r.Plo

+ -rm -f ./$(DEPDIR)/landlock.Po

+ -rm -f ./$(DEPDIR)/swap.Plo

+

+# Tell GNU make to disable its built-in pattern rules.

+%:: %,v

+%:: RCS/%,v

+%:: RCS/%

+%:: s.%

+%:: SCCS/s.%

+FILE_RCSID("@(#)$File: apprentice.c,v 1.376 2026/05/09 22:44:32 christos Exp $")

+#include "swap.h"

+ const char *, size_t, size_t, int);

+ { XX("leguid"), FILE_LEGUID, FILE_FMT_STR },

+ { XX("beguid"), FILE_BEGUID, FILE_FMT_STR },

+ case FILE_LEGUID:

+ case FILE_BEGUID:

+ case FILE_LEGUID:

+ case FILE_BEGUID:

+ case FILE_LEGUID:

+ case FILE_BEGUID:

+ switch (parse(ms, &me, fn, line, llen, lineno, action)) {

+ uint32_t i;

+ size_t mentrycount = 0;

+ if (mentrycount > UINT32_MAX / sizeof(**ma)) {

+ file_error(ms, 0, "too many magic entries (%zu)", mentrycount);

+ return -1;

+ }

+

+ case FILE_LEGUID:

+ case FILE_BEGUID:

+ const char *line, size_t llen, size_t lineno, int action)

+ const char *l = line, *el = line + llen;

+ if (l >= el)

+ return -1;

+ sizeof(me->mp[me->cont_count - 1].ext), "EXTENSION", ",!+-/@?_$&~.",

+ int rc = file_regcomp(ms, &rx, m->value.s,

+ REG_EXTENDED | REGEX_ICASE(m));

+ case FILE_BEGUID:

+ case FILE_LEGUID:

+ if (CAST(size_t, (p - origp)) > sizeof(m->value.s))

+ return NULL;

+ if (m->vallen + l > sizeof(m->value.s))

+ return NULL;

+ if (file_swap4(*ptr) != MAGICNO) {

+ version = file_swap4(ptr[1]);

+ map->nmagic[i] = file_swap4(ptr[i + 2]);

+ if (map->nmagic[i] > entries) {

+ file_error(ms, 0, "nmagic[%u] too large in `%s'", i,

+ dbname);

+ return -1;

+ }

+ m->flag = file_swap2(m->flag);

+ m->offset = file_swap4(CAST(uint32_t, m->offset));

+ m->in_offset = file_swap4(CAST(uint32_t, m->in_offset));

+ m->lineno = file_swap4(CAST(uint32_t, m->lineno));

+ m->str_range = file_swap4(m->str_range);

+ m->str_flags = file_swap4(m->str_flags);

+ m->value.q = file_swap8(m->value.q);

+ m->num_mask = file_swap8(m->num_mask);

+

+FILE_RCSID("@(#)$File: ascmagic.c,v 1.118 2026/06/02 19:58:38 christos Exp $")

+ if (ulen > SIZE_MAX / 6) {

+ goto done;

+ }

+ if (seen_cr && n_cr == 0 && n_crlf == 0)

+ n_cr++;

+

+/*- * Copyright (c) 2008 Christos Zoulas

+FILE_RCSID("@(#)$File: cdf.c,v 1.129 2026/06/02 17:57:22 christos Exp $")

+#define CDF_SAT_LIMIT (16 * 1024 * 1024)

+ if (ss != 0 && sat->sat_len > CDF_SAT_LIMIT / ss) {

+ errno = EFTYPE;

+ return -1;

+ }

+ if (b + sizeof(reclen) > eb)

+ break;

+FILE_RCSID("@(#)$File: cdf_time.c,v 1.26 2026/05/09 22:08:32 christos Exp $")

+ if (tm.tm_year > 9999)

+ goto out;

+

+ if (ts->tv_sec == -1)

+ goto out;

+out:

+ errno = EINVAL;

+ return -1;

+FILE_RCSID("@(#)$File: compress.c,v 1.162 2026/05/17 17:10:25 christos Exp $")

+ unsigned short x;

+ if (file_bigendian()) /* endianness test */

+ in = fmemopen(RCAST(void *, old), *n, "r");

+ free(*newch);

+ if (status != 0) {

+ compr[method].argv[0], strerror(status));

+FILE_RCSID("@(#)$File: der.c,v 1.29 2026/06/02 16:56:40 christos Exp $")

+ if (c == NULL || *p >= l)

+FILE_RCSID("@(#)$File: encoding.c,v 1.45 2026/06/02 17:19:02 christos Exp $")

+ if (buf == NULL)

+ return 0;

+FILE_RCSID("@(#)$File: file.c,v 1.222 2026/05/14 18:54:27 christos Exp $")

+#if defined(HAVE_LIBSECCOMP) || defined(HAVE_LINUX_LANDLOCK_H)

+#ifdef HAVE_LINUX_LANDLOCK_H

+ (void)fprintf(stdout, "Landlock support included\n");

+#endif

+#ifdef HAVE_LINUX_LANDLOCK_H

+ if (sandbox && enable_landlock(flags, action) == -1)

+ file_err(EXIT_FAILURE, "Landlock initialisation failed");

+#endif /* HAVE_LINUX_LANDLOCK_H */

+

+ if (sandbox && enable_sandbox(flags, action) == -1)

+ ssize_t mpar;

+ int par;

+ par = atoi(s + 1);

+ mpar = magic_getmaxparam(pm[i].tag);

+ if (par < 0 || par > mpar)

+ file_err(EXIT_FAILURE, "Out of bounds value %d for %s",

+ par, pm[i].name);

+ pm[i].value = par;

+ * @(#)$File: file.h,v 1.267 2026/05/17 17:10:25 christos Exp $

+#define VERSIONNO 21

+#define FILE_LEGUID 50

+#define FILE_BEGUID 51

+#define FILE_OFFSET 52

+#define FILE_BEVARINT 53

+#define FILE_LEVARINT 54

+#define FILE_MSDOSDATE 55

+#define FILE_LEMSDOSDATE 56

+#define FILE_BEMSDOSDATE 57

+#define FILE_MSDOSTIME 58

+#define FILE_LEMSDOSTIME 59

+#define FILE_BEMSDOSTIME 60

+#define FILE_OCTAL 61

+#define FILE_NAMES_SIZE 62 /* size of array to contain all names */

+#define REGEX_ICASE(m) (((m)->str_flags & STRING_IGNORE_CASE) ? REG_ICASE : 0)

+file_protected int file_print_leguid(char *, size_t, const uint64_t *);

+file_protected int file_print_beguid(char *, size_t, const uint64_t *);

+file_protected int file_bigendian(void);

+int enable_sandbox(int, int);

+#endif

+

+#ifdef HAVE_LINUX_LANDLOCK_H

+int enable_landlock(int, int);

+FILE_RCSID("@(#)$File: funcs.c,v 1.153 2026/05/25 14:07:05 christos Exp $")

+#include "swap.h"

+file_protected int

+file_bigendian(void)

+{

+ union {

+ unsigned short x;

+ unsigned char s[sizeof(unsigned short)];

+ } u;

+

+ u.x = 1;

+ return u.s[0] != 1;

+}

+

+ while (*p && isdigit((unsigned char)*p)) {

+ if (fw > 1024)

+ break;

+ }

+ int nm;

+ regmatch_t rm;

+ nm = file_regcomp(ms, &rx, pat, REG_EXTENDED);

+ if (nm != 0)

+ return -1;

+

+ while (file_regexec(ms, &rx, ms->o.buf, 1, &rm, 0) == 0) {

+ ms->o.buf[rm.rm_so] = '\0';

+ if (file_printf(ms, "%s%s", rep,

+ rm.rm_eo != 0 ? ms->o.buf + rm.rm_eo : "") == -1)

+ goto out;

+ nm++;

+ return nm;

+

+ if (file_bigendian()) {

+ g->data1 = file_swap4(g->data1);

+ g->data2 = file_swap2(g->data2);

+ g->data3 = file_swap2(g->data3);

+

+ }

+file_private int

+file_print_guid(char *str, size_t len, const struct guid *g)

+file_print_leguid(char *str, size_t len, const uint64_t *guid)

+{

+ const struct guid *g = CAST(const struct guid *,

+ CAST(const void *, guid));

+ return file_print_guid(str, len, g);

+}

+

+file_protected int

+file_print_beguid(char *str, size_t len, const uint64_t *guid)

+{

+ const struct guid *g = CAST(const struct guid *,

+ CAST(const void *, guid));

+ struct guid gg = *g;

+ gg.data1 = file_swap4(gg.data1);

+ gg.data2 = file_swap2(gg.data2);

+ gg.data3 = file_swap2(gg.data3);

+ return file_print_guid(str, len, &gg);

+}

+

+file_protected int

+ if (last == str)

+ return str;

+FILE_RCSID("@(#)$File: is_csv.c,v 1.16 2026/06/02 17:50:54 christos Exp $")

+ DPRINTF("nl=%zu nf=%zu tf=%zu\n", nl, nf, tf);

+ DPRINTF("tf=%zu>1 nl=%zu>=2\n", tf, nl);

+ return tf >= 1 && nl >= 2;

+FILE_RCSID("@(#)$File: is_tar.c,v 1.51 2026/06/02 17:05:51 christos Exp $")

+ while (digs > 0 && isspace(CAST(unsigned char, *where))) { /* Skip spaces */

+ digs--;

+ if (digs == 0)

+ return -1; /* All blank field */

+/*

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ * notice immediately at the beginning of the file, without modification,

+ * this list of conditions, and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ * notice, this list of conditions and the following disclaimer in the

+ * documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND

+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR

+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

+ * SUCH DAMAGE.

+ */

+/* Landlock sandbox: read anywhere, write only in $TMPDIR. */

+#include "file.h"

+

+#if HAVE_LINUX_LANDLOCK_H

+#include "magic.h"

+#include <linux/landlock.h>

+#include <sys/prctl.h>

+#include <sys/syscall.h>

+#include <sys/stat.h>

+#include <fcntl.h>

+#include <stdlib.h>

+#include <string.h>

+#include <errno.h>

+#include <unistd.h>

+

+/* glibc only got Landlock wrappers in 2.40, so call via syscall(2). */

+#ifndef landlock_create_ruleset

+static inline int

+landlock_create_ruleset(const struct landlock_ruleset_attr *attr,

+ size_t size, uint32_t flags)

+{

+ return CAST(int, syscall(__NR_landlock_create_ruleset, attr, size,

+ flags));

+}

+#endif

+

+#ifndef landlock_add_rule

+static inline int

+landlock_add_rule(int ruleset_fd, enum landlock_rule_type rule_type,

+ const void *rule_attr, uint32_t flags)

+{

+ return CAST(int, syscall(__NR_landlock_add_rule, ruleset_fd,

+ rule_type, rule_attr, flags));

+}

+#endif

+

+#ifndef landlock_restrict_self

+static inline int

+landlock_restrict_self(int ruleset_fd, uint32_t flags)

+{

+ return CAST(int, syscall(__NR_landlock_restrict_self, ruleset_fd,

+ flags));

+}

+#endif

+

+/* A missing path (e.g. unset $TMPDIR) is not fatal, just skipped. */

+static int

+landlock_allow_path(int ruleset_fd, const char *path, uint64_t allowed)

+{

+ struct landlock_path_beneath_attr pb;

+ int rv;

+

+ pb.allowed_access = allowed;

+ pb.parent_fd = open(path, O_PATH | O_CLOEXEC);

+ if (pb.parent_fd == -1)

+ return errno == ENOENT ? 0 : -1;

+ rv = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &pb, 0);

+ (void)close(pb.parent_fd);

+ return rv;

+}

+

+int

+enable_landlock(int flags, int action)

+{

+ struct landlock_ruleset_attr attr;

+ struct stat sb;

+ int ruleset_fd, abi, needs_write;

+ const char *tmpdir;

+

+ (void)flags;

+

+ /* Magic build modes write outside /tmp; just skip Landlock

+ for those. seccomp still applies. */

+ if (action == FILE_COMPILE || action == FILE_CHECK ||

+ action == FILE_LIST)

+ return 0;

+

+ /* Pipe input gets copied to a tempfile in /tmp. */

+ needs_write = fstat(STDIN_FILENO, &sb) == 0 && S_ISFIFO(sb.st_mode);

+

+ abi = CAST(int, syscall(__NR_landlock_create_ruleset, NULL, 0,

+ LANDLOCK_CREATE_RULESET_VERSION));

+ if (abi < 1)

+ return 0;

+

+ (void)memset(&attr, 0, sizeof(attr));

+ attr.handled_access_fs =

+ LANDLOCK_ACCESS_FS_EXECUTE |

+ LANDLOCK_ACCESS_FS_WRITE_FILE |

+ LANDLOCK_ACCESS_FS_READ_FILE |

+ LANDLOCK_ACCESS_FS_READ_DIR |

+ LANDLOCK_ACCESS_FS_REMOVE_DIR |

+ LANDLOCK_ACCESS_FS_REMOVE_FILE |

+ LANDLOCK_ACCESS_FS_MAKE_CHAR |

+ LANDLOCK_ACCESS_FS_MAKE_DIR |

+ LANDLOCK_ACCESS_FS_MAKE_REG |

+ LANDLOCK_ACCESS_FS_MAKE_SOCK |

+ LANDLOCK_ACCESS_FS_MAKE_FIFO |

+ LANDLOCK_ACCESS_FS_MAKE_BLOCK |

+ LANDLOCK_ACCESS_FS_MAKE_SYM;

+#ifdef LANDLOCK_ACCESS_FS_REFER

+ if (abi >= 2)

+ attr.handled_access_fs |= LANDLOCK_ACCESS_FS_REFER;

+#endif

+#ifdef LANDLOCK_ACCESS_FS_TRUNCATE

+ if (abi >= 3)

+ attr.handled_access_fs |= LANDLOCK_ACCESS_FS_TRUNCATE;

+#endif

+#ifdef LANDLOCK_ACCESS_NET_BIND_TCP

+ if (abi >= 4) {

+ attr.handled_access_net =

+ LANDLOCK_ACCESS_NET_BIND_TCP |

+ LANDLOCK_ACCESS_NET_CONNECT_TCP;

+ }

+#endif

+

+ ruleset_fd = landlock_create_ruleset(&attr, sizeof(attr), 0);

+ if (ruleset_fd == -1)

+ return -1;

+

+ if (landlock_allow_path(ruleset_fd, "/",

+ LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR) == -1)

+ goto fail;

+

+ if (needs_write) {

+ uint64_t tmp_access =

+ LANDLOCK_ACCESS_FS_READ_FILE |

+ LANDLOCK_ACCESS_FS_READ_DIR |

+ LANDLOCK_ACCESS_FS_WRITE_FILE |

+ LANDLOCK_ACCESS_FS_MAKE_REG |

+ LANDLOCK_ACCESS_FS_REMOVE_FILE;

+#ifdef LANDLOCK_ACCESS_FS_TRUNCATE

+ if (abi >= 3)

+ tmp_access |= LANDLOCK_ACCESS_FS_TRUNCATE;

+#endif

+ tmpdir = getenv("TMPDIR");

+ if (tmpdir == NULL || *tmpdir == '\0')

+ tmpdir = "/tmp";

+ if (landlock_allow_path(ruleset_fd, tmpdir, tmp_access) == -1)

+ goto fail;

+ }

+

+ if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1)

+ goto fail;

+ if (landlock_restrict_self(ruleset_fd, 0) == -1)

+ goto fail;

+

+ (void)close(ruleset_fd);

+ return 0;

+fail:

+ (void)close(ruleset_fd);

+ return -1;

+}

+

+#endif /* HAVE_LINUX_LANDLOCK_H */

+FILE_RCSID("@(#)$File: magic.c,v 1.128 2026/05/09 22:34:30 christos Exp $")

+file_private const char *get_default_magic(void);

+ char *home, *hmagicpath, *tmp_magic;

+ if (asprintf(&tmp_magic, "%s%c%s", hmagicpath, PATHSEP, MAGIC) < 0)

+ hmagicpath = default_magic;

+ default_magic = tmp_magic;

+ free(hmagicpath);

+ tmp_magic = default_magic;

+ free(tmp_magic);

+file_public ssize_t

+magic_getmaxparam(int param)

+{

+ switch (param) {

+ case MAGIC_PARAM_INDIR_MAX:

+ case MAGIC_PARAM_NAME_MAX:

+ case MAGIC_PARAM_ELF_PHNUM_MAX:

+ case MAGIC_PARAM_ELF_SHNUM_MAX:

+ case MAGIC_PARAM_ELF_SHSIZE_MAX:

+ case MAGIC_PARAM_ELF_NOTES_MAX:

+ case MAGIC_PARAM_REGEX_MAX:

+ return 0xffff;

+ case MAGIC_PARAM_BYTES_MAX:

+ case MAGIC_PARAM_ENCODING_MAX:

+ case MAGIC_PARAM_MAGWARN_MAX:

+ return 0x7fffffff;

+ default:

+ errno = EINVAL;

+ return -1;

+ }

+}

+

+ if (ms == NULL || val == NULL) {

+ errno = EFAULT;

+ }

+ if (ms == NULL || val == NULL) {

+ errno = EFAULT;

+ }

+ssize_t magic_getmaxparam(int);

+FILE_RCSID("@(#)$File: print.c,v 1.111 2026/04/19 19:56:49 christos Exp $")

+ case FILE_LEGUID:

+ (void) file_print_leguid(tbuf, sizeof(tbuf),

+ m->value.guid);

+ (void) fprintf(stderr, "%s", tbuf);

+ break;

+ case FILE_BEGUID:

+ (void) file_print_beguid(tbuf, sizeof(tbuf),

+FILE_RCSID("@(#)$File: readcdf.c,v 1.82 2026/06/02 17:33:48 christos Exp $")

+ "vnd.ms-msi",

+ "Microsoft Installer",

+FILE_RCSID("@(#)$File: readelf.c,v 1.206 2026/04/24 19:14:02 christos Exp $")

+ if (doff + argoff + 81 <= size) {

+ if (elf_printf(ms, ", from '%.80s'",

+ nbuf + doff + argoff) == -1)

+ return -1;

+ }

+ str = RCAST(const char *, nbuf);

+FILE_RCSID("@(#)$File: seccomp.c,v 1.37 2026/05/11 16:06:03 christos Exp $")

+#include "magic.h"

+#include <unistd.h>

+/* ENOSYS makes glibc try an older syscall instead of dying. */

+#define ERRNO_RULE(call) \

+ do \

+ if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOSYS), SCMP_SYS(call), 0) \

+ == -1) goto out; \

+ while (/*CONSTCOND*/0)

+enable_sandbox(int flags, int action)

+ struct stat sb;

+ int needs_write;

+

+ /* Writes are needed when building the magic file (-C, -c, -l)

+ or when stdin is a pipe and we copy it to a tempfile. */

+ needs_write = (action == FILE_COMPILE || action == FILE_CHECK ||

+ action == FILE_LIST);

+ if (!needs_write && fstat(STDIN_FILENO, &sb) == 0 &&

+ S_ISFIFO(sb.st_mode))

+ needs_write = 1;

+

+ /* Read-only opens are always fine. Writes are allowed when we

+ need them, otherwise return EACCES instead of killing. */

+ if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 1,

+ SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_WRONLY | O_RDWR, 0)) == -1)

+ goto out;

+ if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), 1,

+ SCMP_CMP(2, SCMP_CMP_MASKED_EQ, O_WRONLY | O_RDWR, 0)) == -1)

+ goto out;

+ {

+ uint32_t act = needs_write ? SCMP_ACT_ALLOW

+ : SCMP_ACT_ERRNO(EACCES);

+ if (seccomp_rule_add(ctx, act, SCMP_SYS(open), 1,

+ SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_WRONLY, O_WRONLY)) == -1)

+ goto out;

+ if (seccomp_rule_add(ctx, act, SCMP_SYS(open), 1,

+ SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_RDWR, O_RDWR)) == -1)

+ goto out;

+ if (seccomp_rule_add(ctx, act, SCMP_SYS(openat), 1,

+ SCMP_CMP(2, SCMP_CMP_MASKED_EQ, O_WRONLY, O_WRONLY)) == -1)

+ goto out;

+ if (seccomp_rule_add(ctx, act, SCMP_SYS(openat), 1,

+ SCMP_CMP(2, SCMP_CMP_MASKED_EQ, O_RDWR, O_RDWR)) == -1)

+ goto out;

+ }

+ if (needs_write) {

+ ALLOW_RULE(umask); /* used in file_pipe2file() */

+ ALLOW_RULE(unlinkat); /* used in file_pipe2file() */

+#ifdef __NR_unlink

+ ALLOW_RULE(unlink);

+#endif

+ }

+ if (flags & MAGIC_PRESERVE_ATIME) {

+ /* glibc 2.28+ uses utimes() via utimensat. */

+ ALLOW_RULE(utimensat);

+#ifdef __NR_utimes

+ ALLOW_RULE(utimes);

+#endif

+ }

+ /* Always allow writes. The kernel checks the fd, and restricting

+ here would just break stdout/stderr and the tempfile. */

+ /* Newer variants we don't use. ENOSYS lets glibc fall back. */

+ ERRNO_RULE(openat2);

+ ERRNO_RULE(faccessat2);

+ ERRNO_RULE(close_range);

+

+FILE_RCSID("@(#)$File: softmagic.c,v 1.370 2026/06/02 17:16:59 christos Exp $")

+ const struct buffer *, size_t, unsigned int, int, int, int, uint16_t *,

+file_private int magiccheck(struct magic_set *, struct magic *,

+ file_regex_t **);

+ size_t, size_t, int32_t *);

+static inline int

+offset_oob(size_t n, intmax_t o, size_t i)

+ {

+ if (o < 0)

+ return 1;

+ if ((uintmax_t)o > n)

+ return 1;

+ return i > n - (uintmax_t)o;

+}

+

+ (void)memset(&bb, 0, sizeof(bb));

+ magic[magindex + 1].cont_level != 0) {

+ }

+ if (msetoffset(ms, m, &bb, b, offset, cont_level) == -1) {

+ if (b->elen == FILE_BADSIZE)

+ continue;

+ else

+ goto flush;

+ }

+ switch (mget(ms, m, b, &bb, offset, cont_level,

+ switch (moffset(ms, m, bb.flen, offset,

+ &ms->c.li[cont_level].off)) {

+ if (msetoffset(ms, m, &bb, b, offset, cont_level)

+ == -1) {

+ if (b->elen == FILE_BADSIZE)

+ continue;

+ else

+ goto flush;

+ }