Stamp

Overview

Stamp prepares an SD card or USB drive in one step: it formats the card as FAT32 and copies the contents of a zip file you choose onto it. It forces FAT32 even on cards larger than 32 GB, which most stock formatters, such as GParted’s default dialog and the Windows Format tool, refuse or cap.

There are three native apps:

Linux: a GTK4 and libadwaita app with a command-line mode, built for Ubuntu on GNOME first, with packages for Ubuntu and Debian, Fedora and Arch Linux
macOS: a SwiftUI app for macOS 14 and later
Windows: a WPF app for Windows 10 and 11

Stamp is open source under the MIT license. Each GitHub release ships a .deb, an .rpm, a signed and notarized macOS .dmg and a self-contained Windows .exe that needs no .NET install. Arch users build the stamp-sd package from the repository’s PKGBUILD.

Safety first

Formatting is destructive, and the most common failure of tools like this is wiping the wrong disk, so safety was a requirement from the start:

The disk that holds the running system is never listed and can never be selected, with no override.
Formatting is confirmed in one short summary dialog. A drive that isn’t flagged as removable adds an explicit risk checkbox to that dialog.
Every device and zip choice, every command and its outcome is written to a log file.
On macOS and Windows, the zip is checked and extracted before the card is erased, so a broken zip never costs a wipe.
On Windows, the disk is scanned again before formatting and refused if its size, model or serial number changed since you confirmed.

How it works

Linux: device listing and mounting go through lsblk and udisks2. The one step udisks2 can’t do, forcing FAT32 with mkfs.vfat -F 32, runs in a small privileged helper through pkexec. The helper validates its input on its own and runs only four commands.
No password for removable drives on Linux: a PolicyKit rule lets the helper format removable drives in the active session without a password prompt. The helper refuses anything else, and a separate, password-protected copy handles the non-removable override.
macOS: everything goes through diskutil, so no privileged helper is needed. Files are copied without extended attributes, and the hidden files macOS adds to FAT volumes are removed before the card is ejected.
Windows: Windows’ own tools refuse FAT32 above 32 GB, so Stamp writes the FAT32 structures itself: the boot sector, FSInfo, both FATs and the root directory. diskpart only creates the partition table. The formatter is plain C#, tested by formatting disk images and checking them with fsck.fat and mtools. Raw disk access needs administrator rights, so the app asks once with a UAC prompt when it starts.
Core logic without a UI: on every platform, the formatting, safety and copy logic is a separate library with no UI code, so it can be unit tested without a display.

Stack

Linux: Python, GTK4 and libadwaita through PyGObject, udisks2, PolicyKit, parted, mkfs.vfat, rsync; .deb and .rpm packages built with nfpm, and an Arch PKGBUILD
macOS: Swift and SwiftUI as a Swift package, diskutil, Developer ID signing and notarization
Windows: C#, .NET 8, WPF, diskpart

Quality

87 pytest tests for the Linux app, 42 XCTest tests for the macOS app and 29 xUnit tests for the Windows formatter and logic
A GitHub Actions workflow, run on demand, tests all three apps and builds every package. It installs the Linux packages in Ubuntu 22.04 and 24.04, Debian 12 and Fedora containers to check their dependencies, builds the Arch package in an Arch container, and runs the real Windows format path against a 40 GB virtual disk.