feat: Add support for Ubuntu/Debian apport .crash files (#102)

Parse apport crash files (Debian control syntax with base64-encoded
gzip core dumps) as a coredump source. Text fields are mapped to
COREDUMP_* fields and the CoreDump is extracted lazily via a streaming
base64+gzip pipeline into a memfd.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: basil

Cargo.lock

@@ -14,7 +14,9 @@ categories = ["command-line-utilities", "development-tools::debugging"]
 uninlined_format_args = "warn"
 
 [dependencies]
+base64 = "0.22"
 cpp_demangle = "0.5"
+flate2 = "1.1"
 foreign-types = "0.5"
 lexopt = "0.3"
 libc = "0.2"

Cargo.toml

@@ -307,6 +307,12 @@ retrieved from the `systemd-coredump(8)` journal entry; use
 `coredumpctl list <name> -F COREDUMP_FILENAME` to find the path and pass it to
 any of these tools.
 
+Ubuntu/Debian apport `.crash` files are also supported. These files use Debian
+control syntax with base64-encoded gzip core dumps. Text fields from the crash
+file are mapped to the corresponding `COREDUMP_*` fields and the core dump is
+extracted lazily on first access. Pass the `.crash` file path as the core
+operand to any of the tools listed above.
+
 ## Current State
 
 The following table lists all Solaris/illumos ptools and their status in this

README.md

@@ -54,8 +54,9 @@ const CORE_OPERANDS: &[(&str, &str)] = &[
     ("pid", "Process ID list."),
     (
         "core",
-        "Process core file, as produced by systemd-coredump(8). The core file \
-         does not need to exist on disk; if it has been removed, the \
+        "Process core file, as produced by systemd-coredump(8), or an \
+         Ubuntu/Debian apport .crash file. For systemd core files, the \
+         file does not need to exist on disk; if it has been removed, the \
          corresponding systemd journal entry will be used instead. See \
          NOTES below.",
     ),
@@ -69,7 +70,12 @@ const CORE_NOTES: &str = "When a core file has been removed by systemd-tmpfiles(
                            longer exists on disk, and process metadata will be retrieved \
                            from the journal entry instead. Use coredumpctl(1) to obtain \
                            the path of a missing core file, e.g., \
-                           coredumpctl list <name> -F COREDUMP_FILENAME.";
+                           coredumpctl list <name> -F COREDUMP_FILENAME.\n\n\
+                           Ubuntu/Debian apport .crash files are also supported. These \
+                           files use Debian control syntax with base64-encoded gzip core \
+                           dumps. Text fields (such as ProcCmdline, ProcEnviron, and \
+                           ExecutablePath) are mapped to COREDUMP_* fields, and the core \
+                           dump is extracted on first access.";
 
 fn build_date() -> String {
     let days = (SystemTime::now()
@@ -610,7 +616,10 @@ $ plgrp -a 0-2 101398
                     "Process ID, optionally followed by a slash and a thread ID \
                      to display a single thread.",
                 ),
-                ("core", "Process core file"),
+                (
+                    "core",
+                    "Process core file, or an Ubuntu/Debian apport .crash file.",
+                ),
             ],
             examples: &[],
             exit_status: DEFAULT_EXIT_STATUS,