{"record":{"id":"1b313607edcd9c7c","repo":"can1357/oh-my-pi","slug":"rpm-package-identity-has-a-malformed-lzma-pay","errorCode":null,"errorMessage":"RPM package '${identity}' has a malformed LZMA payload","messagePattern":"RPM package '(.+?)' has a malformed LZMA payload","errorType":"validation","errorClass":"ArchiveError","httpStatus":null,"severity":"error","filePath":"packages/utils/src/ar/rpm.ts","lineNumber":234,"sourceCode":"\t\t\t\t`RPM package '${identity}' uses unsupported payload compressor '${metadata.payloadCompressor ?? \"unknown\"}'`,\n\t\t\t);\n\t\t}\n\t}\n\n\tswitch (method) {\n\t\tcase \"gzip\":\n\t\tcase \"gz\":\n\t\t\treturn gzipDecompress(payload, maxOutput);\n\t\tcase \"bzip2\":\n\t\tcase \"bzip\":\n\t\t\treturn bzip2Decompress(payload, maxOutput);\n\t\tcase \"xz\":\n\t\t\treturn xzDecompress(payload, maxOutput);\n\t\tcase \"zstd\":\n\t\tcase \"zstdio\":\n\t\t\treturn zstdDecompress(payload, maxOutput);\n\t\tcase \"lzma\":\n\t\t\tif (!sniffLzmaAlone(payload)) throw new ArchiveError(`RPM package '${identity}' has a malformed LZMA payload`);\n\t\t\treturn lzmaAloneDecompress(payload, maxOutput);\n\t\tcase \"none\":\n\t\t\tif (!sniffCpio(payload))\n\t\t\t\tthrow new ArchiveError(`RPM package '${identity}' has an invalid uncompressed CPIO payload`);\n\t\t\treturn payload;\n\t\tdefault:\n\t\t\tthrow new ArchiveError(`RPM package '${identity}' uses unsupported payload compressor '${method}'`);\n\t}\n}\n\nasync function readRpmArchive(source: ByteSource, options: FormatReadOptions): Promise<ArchiveIndexEntry[]> {\n\tconst initial = await readExact(source, 0, RPM_LEAD_SIZE + RPM_HEADER_INTRO_SIZE, \"lead and signature header\");\n\tif (!sniffRpm(initial)) throw new ArchiveError(\"Invalid RPM package: bad lead magic\");\n\tconst major = initial[4]!;\n\tconst packageType = (initial[6]! << 8) | initial[7]!;\n\tif (major < 3 || packageType > 1) throw new ArchiveError(\"Unsupported RPM package lead version or type\");\n\tconst signatureType = (initial[78]! << 8) | initial[79]!;\n\tif (signatureType !== RPM_SIGNATURE_TYPE_HEADER) {","sourceCodeStart":216,"sourceCodeEnd":252,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/utils/src/ar/rpm.ts#L216-L252","documentation":"The method resolved to 'lzma' but the payload does not pass sniffLzmaAlone (the LZMA_ALONE header check), so decompressPayload refuses to hand the bytes to lzmaAloneDecompress. This guards against feeding a non-LZMA stream (or a corrupt one missing the 13-byte alone header) into the decoder.","triggerScenarios":"RPM with declared or sniffed method 'lzma' whose payload lacks a valid LZMA_ALONE header (magic 0x5D with plausible dictionary/size fields); raised immediately before lzmaAloneDecompress is called.","commonSituations":"Corrupt downloads where the payload's first bytes were lost or altered, packages whose declared compressor tag lies about the real format, or hand-repacked payloads stripped of the alone header.","solutions":["Verify the file checksum and re-download — an LZMA payload failing its own magic sniff is almost always corruption.","Inspect the first bytes of the payload region (hexdump) to see what format it actually is.","Convert the package with rpm2cpio to a supported uncompressed/cpio form before parsing.","If you produce these payloads, ensure they are emitted in LZMA_ALONE format (with the .lzma 13-byte header), not raw LZMA1 or LZMA2/xz."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// LZMA_ALONE payloads start with 0x5D and plausible props/dict-size\nasync function hasValidLzmaAloneHeader(path: string, payloadOffset: number): Promise<boolean> {\n  const b = new Uint8Array(await Bun.file(path).slice(payloadOffset, payloadOffset + 13).arrayBuffer());\n  return b[0] === 0x5d && b[1] === 0x00 && b[2] === 0x00;\n}","typeGuard":"function isLzmaAloneHeader(b: Uint8Array): boolean {\n  return b.length >= 13 && b[0] === 0x5d && (b[1] | b[2]) === 0;\n}","tryCatchPattern":"try {\n  return await readRpm(path);\n} catch (err) {\n  if (err instanceof ArchiveError && err.message.includes('malformed LZMA payload')) {\n    throw new Error('RPM payload corrupt or not LZMA_ALONE; re-download package');\n  }\n  throw err;\n}","preventionTips":["Checksum-verify RPM files before parsing.","When producing LZMA payloads, always emit the 13-byte LZMA_ALONE header.","Prefer xz over legacy lzma-alone payloads in your build pipeline."],"tags":["rpm","lzma","compression","malformed-payload"],"backgroundTag":"malformed-compression-payload","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}