ethercod3/doomsday: Small scripts for safe data transfer when simplicity, reproducibility, and a minimal dependency set matter. · GitHub

Small scripts for safe data transfer when simplicity, reproducibility, and a minimal dependency set matter.

Files such as *.rar, *.zip, *.7z, *.tar.gz, and *.txt should not be committed to Git. This is intentional: the repository should store scripts, not transferred data, checksums, or temporary artifacts.

Two commands must be available in PATH:

• nu - Nushell;
• 7z - 7-Zip.

Windows:

winget install Nushell.Nushell
winget install 7zip.7zip

macOS с Homebrew:

brew install nushell
brew install sevenzip

Linux:

# Debian/Ubuntu
sudo apt install nushell 7zip

# Arch Linux
sudo pacman -S nushell 7zip

Check the installation:

nu --version
7z

If 7z is not found, add the 7-Zip installation directory to PATH. On Windows, this is usually:

C:\Program Files\7-Zip

Create an encrypted archive:

nu scripts/encrypt_archive.nu input.zip output.7z "your-strong-password"

The script:

• removes the old destination file if it already exists;
• creates a new 7z archive;
• enables header encryption with -mhe=on;
• creates a checksum file next to the archive.

Example output:

output.7z
output.7z_2026-05-26_sha256.txt

Important

The script uses 7z a -t7z, so the actual output format is 7z. You can use any output file name, but the .7z extension is recommended so the name matches the contents.

nu scripts/encrypt_archive.nu <src> <dst> <key>

Parameters:

Example:

nu scripts/encrypt_archive.nu data.zip data_encrypted.7z "correct horse battery staple"

src and dst must be different files. The script intentionally stops if the input and output paths are the same.

After the archive is created, a file appears next to it:

<dst>_<date>_sha256.txt

It stores the archive name and its SHA-256 hash. This file lets the recipient verify that the archive was not damaged or replaced during transfer.

Check the hash manually in Nushell:

open output.7z --raw | hash sha256

Compare the result with the value in output.7z_YYYY-MM-DD_sha256.txt.

Before sending the archive, it is useful to confirm that it opens with the password you plan to share with the recipient:

7z t output.7z -p"your-strong-password"

Extract the archive:

7z x output.7z -p"your-strong-password"

If the password contains spaces or special characters, keep the quotes.

Build and run the container version:

docker compose --profile archive run --rm --build encrypt-archive input.zip output.7z "your-strong-password"

The same command through Task:

task encrypt_archive:run -- input.zip output.7z "your-strong-password"

-- separates task arguments from arguments passed to task itself.

The container mounts the project root at /workspace, so input and output paths are relative to the repository root.

CI builds the Docker image from docker/encrypt_archive/Dockerfile and runs the Nu script:

nu ci/smoke.nu

The smoke test creates a temporary test file, encrypts it with scripts/encrypt_archive.nu, verifies the SHA-256 file, runs 7z t, extracts the archive, and compares the extracted payload with the original.

You can run the same path locally as GitHub Actions:

docker build --file docker/encrypt_archive/Dockerfile --tag safe-archive-ci .
docker run --rm --entrypoint nu --volume "${PWD}:/workspace" --workdir /workspace safe-archive-ci ci/smoke.nu

Temporary files are created in .tmp/ci-smoke.

1. Prepare the source file or archive.
2. Create an encrypted 7z archive with scripts/encrypt_archive.nu.
3. Verify test opening with 7z t.
4. Send the encrypted archive and the SHA-256 file to the recipient.
5. Send the password separately from the archive, through another channel.
6. Ask the recipient to verify the hash before extraction.