Improving .deb

A big problem with Zip, IMO, is that the metadata for archived files is stored twice--in an index and as a header to each file. Which one do you use and trust? This creates a dilemma for metadata parsers and especially security scanners.

If you don't mind the uncleanliness and potential security issues of such redundant metadata, one can create an index for tar files, including compressed tar files. I've experimented with this (for both tar and tar+gzip), though nothing releasable. The upside is that adding an index could be done in a backward compatible manner--just another object in the outer archive that could be ignored.