aaif-goose/goose · error

Failed to parse bundle: {e}

Error message

Failed to parse bundle: {e}

What it means

During `goose update`, the SLSA attestation bundle fetched for the release archive is fed into sigstore's Bundle::from_json. This error means that JSON did not deserialize into a valid DSSE bundle — the data is malformed, truncated, or not a bundle at all (e.g. an HTML error page from a proxy or a corrupted download).

Source

Thrown at crates/goose-cli/src/commands/update.rs:168

    if let Some(value) = token.and_then(authorization_header_value) {
        req = req.header(AUTHORIZATION, value);
    }

    req.send().await.context("Failed to fetch attestations")
}

// Verify a single attestation bundle against the artifact digest and workflow.
fn verify_bundle(
    bundle_json: &serde_json::Value,
    artifact_digest: Sha256Hash,
    policy: &VerificationPolicy,
    trusted_root: &TrustedRoot,
    workflow: &str,
) -> Result<()> {
    let bundle_str = serde_json::to_string(bundle_json)?;
    let bundle = Bundle::from_json(&bundle_str)
        .map_err(|e| anyhow::anyhow!("Failed to parse bundle: {e}"))?;

    let result = sigstore_verify::verify(artifact_digest, &bundle, policy, trusted_root)
        .map_err(|e| anyhow::anyhow!("{e}"))?;

    let identity = result
        .identity
        .as_deref()
        .ok_or_else(|| anyhow::anyhow!("No identity in certificate"))?;

    let expected = format!("/.github/workflows/{workflow}");
    if !identity.contains(&expected) {
        bail!("Workflow mismatch: expected {workflow}, got {identity}");
    }

    Ok(())
}

/// Returns `Ok(())` when the downloaded archive has verified provenance.

View on GitHub (pinned to 3810898a74)

Solutions

1. Re-run `goose update` — transient corruption is the most common cause
2. Check whether a proxy/antivirus intercepts api.github.com and excludes it from TLS inspection
3. Update goose via your package manager to get a version that understands the current bundle format
4. If it reproduces on a clean network, report the release — the attestation itself may be broken

let value: serde_json::Value = serde_json::from_str(&bundle_str)
    .with_context(|| "attestation is not valid JSON; likely a corrupted/proxied download")?;
if value.get("mediaType").and_then(|m| m.as_str()).is_none() {
    anyhow::bail!("response lacks DSSE mediaType; not an attestation bundle");
}

match verify_provenance(&archive, tag).await {
    Err(e) if e.to_string().contains("Failed to parse bundle") => {
        // re-download the release + attestation once, then fail closed
        let (archive2, tag2) = redownload(tag).await?;
        verify_provenance(&archive2, &tag2).await
    }
    other => other,
}

When it happens

Trigger: Release asset download interrupted/currupted (truncated JSON); a corporate proxy or antivirus rewriting the attestation response; a release published with a malformed or new bundle format this goose version cannot parse.

Common situations: Flaky networks mid-update; TLS-intercepting middleboxes; goose version lagging behind a provenance format change in the release pipeline.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• {e}
• Sigstore verification failed: {} Aborting update due to sec
• No identity in certificate
• HTTP error! status: ${response.status}
• Failed to fetch OIDC config: ${configResp.status}

AI-assisted analysis of aaif-goose/goose@3810898a74 (2026-08-16). Data as JSON: /api/errors/fecf5679bd13e3ff. Report an issue: GitHub.