Comparisons

Hashing

filepack serves the same purpose as programs like shasum, which hash files and output a text file containing file hashes and paths, which can later be used with the same program to verify that the files have not changed.

They output hashes and paths one per line, separated by whitespace, and mainly differ in which hash function they use.

Some examples, with links to implementations and the hash functions they use:

CRC-32 is not a cryptographic hash function and cannot be used to detect intentional modifications. Similarly, SHA-1 was thought to be a cryptographic hash function, but is now known to be insecure.

filepack and b3sum both use BLAKE3, a fast, general-purpose cryptographic hash function.

Signing

filepack can also create and verify signatures. Other signing and verification utilities include:

Content-addressed Distribution

filepack packages are Merkle trees over their contents, which allows them to be used for content-addressed storage and distribution. Compared to BitTorrent and IPFS, Filepack does not yet have a peer-to-peer distribution network, although the data model is compatible with one.

BitTorrent

Filepack packages are similar to BitTorrent torrents.

Version 1 torrents use the SHA-1 hash function, which is vulnerable to collisions. Files do not have consistent hashes between torrents.

Version 2 torrents use the SHA-256 hash function with a Merkle tree construction that does give files consistent hashes between torrents.

Version 1 torrents are currently far more widely adopted than version 2 torrents.

Torrents are not composable. A torrent may contain .torrent files, but may not natively contain other torrents.

Compared to BitTorrent, Filepack uses BLAKE3, a fast, modern cryptographic hash function with built-in Merkle tree construction. Files are consistently hashed regardless of the package they appear in. Packages are composable. Package fingerprints identify the root directory of the package, which may itself contain packages in subdirectories.

Filepack uses a more consistent content-addressing scheme. All objects, including files and directories, are identified by BLAKE3 hash, which is itself a Merkle tree, allowing any object to be incrementally streamed and verified. By contrast, a BitTorrent infohash is not a tree hash, so the info dictionary object it identifies cannot be downloaded using the same piece bartering algorithm as the files in the torrent.

Filepack packages are directories of files, so packages can be transported using BitTorrent. Additionally, Filepack metadata identifies assets by relative path, so Filepack metadata can be used in torrents independently of Filepack hashing or manifests.

IPFS

Filepack and IPFS use a similar data model, where directories and files are both identified by hash.

IPFS is notoriously complex, supports a wide variety of hash functions, public-key cryptography algorithms, and peer to peer transport and addressing schemes.

Compared to IPFS, Filepack is far simpler. Filepack uses a single hash function, BLAKE3, and a single public-key cryptography implementation, Ed25519. Additionally, Filepack can be used for hashing, signing, and verification without depending on the network.

Iroh

Iroh is a peer-to-peer networking stack that uses BLAKE3 for content addressing.

Filepack and Iroh are largely orthogonal. Iroh is used for transport of flat blobs and does not define a directory encoding.