A tarball is a packaged archive file, usually ending in .tar, .tar.gz, or .tgz, that bundles one or more files for distribution. In software release workflows, tarballs are a common way to ship source code, binaries, and supporting metadata in a single downloadable artifact.
Tarballs matter in cyber security because they are often part of the trust chain for software delivery. Defenders may verify a tarball’s hash to check integrity and its digital signature to confirm provenance. If an attacker can modify the archive, they may inject malicious code, replace installers, or tamper with build inputs. For that reason, release archives are frequently signed and published alongside checksums, and users are taught to verify both before installation.