How to comment extractor in developer workflows
- Step 1Grab the artifact — Download the build artifact or JAR from your CI, registry, or PR. No need to extract it — the comment lives in the EOCD at the end of the file.
- Step 2Drop it in the tool — Open /archive-tools/comment-extractor and drop the file. ZIP containers like
.jar/.war/.apkwork directly;.tar.gz/.7zwill report no comment because they lack an EOCD. - Step 3Read the stamp — The tool returns the comment text plus
Comment lengthandHas commentmetrics, and offers a<artifact>-comment.txtdownload. - Step 4Diff a before/after artifact — If a PR changes archive contents, run Archive Diff over the old and new artifacts to see exactly which entries changed — more useful than the comment for content review.
- Step 5Make builds reproducible — For reproducible builds, normalise timestamps with the Timestamp Normalizer (default epoch 1980-01-01), then attach a SHA-256 manifest with the Checksum Generator so CI can verify byte-identical rebuilds.
- Step 6Edit the stamp when needed — To set or remove the comment (e.g. inject the build ID at release time), use the ZIP Comment Editor — the reader here does not write.
ZIP containers you can read a comment from
All of these are ZIP under the hood, so the EOCD global comment applies. Whether a comment is actually present depends on the build tool.
| Extension | What it is | Comment readable? |
|---|---|---|
| .zip | Plain ZIP | Yes (if present) |
| .jar / .war / .aar | Java archives (ZIP) | Yes — Maven sometimes stamps a build note |
| .apk | Android package (ZIP) | Yes (if the build wrote one) |
| .nupkg | NuGet package (ZIP) | Yes (if present) |
| .docx / .xlsx / .pptx | Office Open XML (ZIP) | Yes (rarely populated) |
| .tar.gz / .7z / .rar | Not ZIP | No — returns no comment |
Reader vs editor vs sibling tools
The Comment Extractor reads; other tools write or analyse deeper.
| Task | Tool | Route |
|---|---|---|
| Read the global comment | Comment Extractor | /archive-tools/comment-extractor |
| Set or remove the comment | ZIP Comment Editor | /archive-tools/zip-comment-editor |
| Per-entry metadata | Archive Metadata Extractor | /archive-tools/archive-metadata-extractor |
| Compare two artifacts | Archive Diff | /archive-tools/archive-diff |
| Reproducible timestamps | Timestamp Normalizer | /archive-tools/timestamp-normalizer |
| SHA-256 manifest | Checksum Generator | /archive-tools/checksum-generator |
Cookbook
Developer-shaped reads. The output is always the plain comment string, or the no-comment notice.
Read a build stamp from a CI artifact
Triage a failed deploy by reading the artifact's build stamp — no branch checkout, no extraction.
Input: service-deploy.zip Output file: service-deploy-comment.txt build=8123 commit=c4d7e90 branch=release/2.5 built=2026-06-11 → matches the failing pipeline run; investigate c4d7e90
Read a Maven JAR's comment without unzipping
A .jar is a ZIP, so the EOCD comment reads directly. Useful when a transitive dependency's provenance is unclear.
Input: lib-core-3.2.1.jar Output file: lib-core-3.2.1-comment.txt Maven build 2026-04-19 (reactor: lib-core) → confirms the artifact's build context
Artifact with no stamp
Plenty of build tools never write a comment. The tool tells you so plainly, so you do not waste time looking for one.
Input: frontend-bundle.zip Output file: frontend-bundle-comment.txt (this archive has no global comment) → stamp not used by this pipeline; check CI metadata instead
Wrong format: a tar.gz artifact
A .tar.gz is gzip-wrapped tar, not ZIP — no EOCD, so no comment. Switch to the right inspection tool.
Input: release.tar.gz Output file: release-comment.txt (this archive has no global comment) → tar.gz has no ZIP comment; list contents with /archive-tools/archive-metadata-extractor
Reproducible-build chain
Read the stamp, normalise timestamps, then hash — the combination gives a byte-identical artifact your CI can verify across machines.
1) Comment Extractor → app-comment.txt: build=8123 ... 2) Timestamp Normalizer → all entries set to 1980-01-01 3) Checksum Generator → SHA-256 manifest for CI to verify → same input now rebuilds byte-identical across machines
Edge cases and what actually happens
Artifact is tar.gz / 7z, not ZIP
ExpectedOnly ZIP containers have an EOCD comment. A .tar.gz, .7z, or .rar artifact returns (this archive has no global comment). Use the Archive Metadata Extractor to list those instead.
JAR/APK with no comment
NeutralWhether a JAR or APK carries a comment depends on the build tool — many never write one. No comment is the normal case, not a failure; check CI metadata for provenance if the stamp is absent.
Need to set the comment, not read it
Wrong toolThis tool is read-only. To inject a build ID or remove a stamp, use the ZIP Comment Editor, which writes a new EOCD comment (or clears it with an empty string).
Comment over 65,535 bytes
Spec limitThe EOCD comment-length field is 16-bit, so the comment caps at 65,535 bytes. If your build tries to stuff a full SBOM into the comment, it will be truncated — store large provenance as a file inside the archive instead.
Per-entry comment expected
Out of scopeThis reads only the single global comment. Entry-level comments (per-file notes) are not returned; use the Archive Metadata Extractor for those.
No JAD API for CI
Use a scriptThere is no programmatic JAD endpoint. For CI automation, read the comment with unzip -z or a Node ZIP library; use JAD for the fast manual read in a browser. This is a deliberate scope boundary, not a bug.
Artifact exceeds the tier size limit
RejectedFree tier rejects files over 50 MB before reading, since the file loads into browser memory. Large game or media bundles may need Pro (500 MB) or higher. The comment itself is tiny.
Mojibake in the stamp
Encoding noteIf a build tool wrote the comment in a non-UTF-8 encoding, you may see replacement characters. The tool always decodes as UTF-8 (non-fatal); fix the upstream build to write UTF-8 if it matters.
Office file (.docx/.xlsx) comment
Usually emptyOffice Open XML files are ZIPs, so the field exists, but Office apps almost never populate the global comment. Expect (this archive has no global comment) for typical documents.
Frequently asked questions
Can I read the comment from a .jar or .apk?
Yes. JARs, WARs, APKs, NuGet packages, and Office files are all ZIP containers, so the EOCD global comment applies. Drop the file directly — no rename to .zip needed in most browsers.
Does it work on .tar.gz or .7z artifacts?
No. Those are not ZIP, so they have no EOCD comment and the tool returns no comment. Use the Archive Metadata Extractor for tar/7z metadata.
Is there an API to automate this in CI?
Not currently. JAD's Comment Extractor is a browser UI tool. For CI, read the comment with unzip -z or a Node ZIP library; use JAD for fast manual reads without an install.
How do I add or change the build stamp?
Use the ZIP Comment Editor at /archive-tools/zip-comment-editor. It writes a new EOCD comment (max 65,535 bytes) or removes the existing one with an empty string. The Comment Extractor only reads.
What's the output format?
A plain-text file, <artifact>-comment.txt (MIME text/plain), containing the comment string or (this archive has no global comment). No JSON/CSV wrapper.
How long can the build stamp be?
Up to 65,535 bytes (16-bit length field). For anything larger, like a full SBOM, store it as a file inside the archive rather than in the comment.
Can I make my artifact reproducible?
Yes — read the stamp here, normalise timestamps with the Timestamp Normalizer (default epoch 1980-01-01), then emit a SHA-256 manifest with the Checksum Generator for CI to verify byte-identical rebuilds.
Does reading the comment change the artifact?
No. The tool reads the EOCD record only and never writes back. The file you dropped is untouched.
Can I batch many artifacts?
Free tier reads one file per run. Pro allows up to 20, Pro-Media up to 100, Developer unlimited. For bulk archive reporting, the Batch Compression Report tool accepts many archives at once.
Why does my Office document show no comment?
Office Open XML files are ZIPs and technically support the field, but Office apps essentially never populate the global comment, so you will see the no-comment notice.
What metrics does the tool show?
Comment length (size of the comment) and Has comment (true/false). Both come straight from reading the EOCD comment-length field and the decoded text.
Is my artifact uploaded to read it?
No. Everything runs in your browser tab — the artifact's bytes never reach a server, which is helpful for files pulled from internal registries.
Privacy first
Every JAD Archive tool runs entirely in your browser using fflate, @zip.js/zip.js, and the libarchive WASM bridge. Your archives never leave your device — verified by zero outbound network requests during processing.