{"record":{"id":"72968cabb444b87b","repo":"jdx/mise","slug":"content-level-slsa-verification-found-no-regular-f","errorCode":null,"errorMessage":"content-level SLSA verification found no regular files in archive","messagePattern":"content-level SLSA verification found no regular files in archive","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/file.rs","lineNumber":2746,"sourceCode":"    validate_archive_content_files(files)\n}\n\nfn sha256_reader(reader: &mut impl Read) -> Result<String> {\n    let mut hasher = Sha256::new();\n    let mut buf = [0; 8192];\n    loop {\n        let n = reader.read(&mut buf)?;\n        if n == 0 {\n            break;\n        }\n        hasher.update(&buf[..n]);\n    }\n    Ok(hex::encode(hasher.finalize()))\n}\n\nfn validate_archive_content_files(files: Vec<ArchiveContent>) -> Result<Vec<ArchiveContent>> {\n    if files.is_empty() {\n        bail!(\"content-level SLSA verification found no regular files in archive\");\n    }\n    let mut names = std::collections::HashSet::new();\n    for file in &files {\n        if !names.insert(file.name.clone()) {\n            bail!(\n                \"content-level SLSA verification found duplicate installed archive path: {}\",\n                file.name\n            );\n        }\n    }\n    Ok(files)\n}\n\nfn normalize_archive_content_path(path: &Path, strip_components: usize) -> Result<String> {\n    let mut parts = Vec::new();\n    for component in skip_curdir_components(path) {\n        match component {\n            std::path::Component::Normal(part) => parts.push(part.to_string_lossy().to_string()),","sourceCodeStart":2728,"sourceCodeEnd":2764,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/file.rs#L2728-L2764","documentation":"During content-level SLSA provenance verification, mise extracts the archive and hashes each regular file it finds. `validate_archive_content_files` is given the list of regular files extracted from the archive; if that list is empty there is nothing to verify, so verification fails closed rather than silently passing an empty archive.","triggerScenarios":"Content-level SLSA verification (e.g. `mise install` of a tool whose backend verifies SLSA provenance by contents) where the archive, after extraction and strip-components processing, yields zero regular files — e.g. an archive containing only directories/symlinks, a wrong archive format, or a strip_components setting that strips away everything.","commonSituations":"A packslip/SLSA manifest points at the wrong artifact; the upstream project changed its release archive layout; a misconfigured `strip_components` in the backend recipe removes the top-level directory containing all files; downloading a stub/redirect HTML page saved as the archive.","solutions":["Check the downloaded archive with `tar tf <file>` to confirm it actually contains regular files at the expected depth","Verify the registry/backend entry's archive path and strip_components match the upstream release layout","Re-run the install after clearing the mise cache (`mise cache clear`) in case a truncated download was cached","If upstream changed archive layout, update the aqua/packslink recipe or pin to a version that still ships the expected layout"],"exampleFix":"// registry recipe before: strips away the only top-level dir that held the files\nstrip_components = 2\n// after: keep the level containing regular files\nstrip_components = 1","handlingStrategy":"validation","validationCode":"tar -tf tool.tar.gz | awk -F/ 'NF>1' | head  # confirm regular files exist below the stripped prefix","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify archives with `tar tf` before relying on a new registry/backend recipe","Keep strip_components no larger than the archive's real nesting depth","Clear the mise cache after changing recipes so stale archives are not reused"],"tags":["slsa","archive","verification","supply-chain"],"backgroundTag":"empty-result-set","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}