{"record":{"id":"896a4139874f815b","repo":"docker/cli","slug":"archive-format-is-invalid","errorCode":null,"errorMessage":"archive format is invalid","messagePattern":"archive format is invalid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/context/store/store.go","lineNumber":515,"sourceCode":"\nfunc parseMetadata(data []byte, name string) (Metadata, error) {\n\tvar meta Metadata\n\tif err := json.Unmarshal(data, &meta); err != nil {\n\t\treturn meta, err\n\t}\n\tif err := ValidateContextName(name); err != nil {\n\t\treturn Metadata{}, err\n\t}\n\tmeta.Name = name\n\treturn meta, nil\n}\n\nfunc importEndpointTLS(tlsData *ContextTLSData, tlsPath string, data []byte) error {\n\tparts := strings.SplitN(strings.TrimPrefix(tlsPath, \"tls/\"), \"/\", 2)\n\tif len(parts) != 2 {\n\t\t// TLS endpoints require archived file directory with 2 layers\n\t\t// i.e. tls/{endpointName}/{fileName}\n\t\treturn errors.New(\"archive format is invalid\")\n\t}\n\n\tepName := parts[0]\n\tfileName := parts[1]\n\tif _, ok := tlsData.Endpoints[epName]; !ok {\n\t\ttlsData.Endpoints[epName] = EndpointTLSData{\n\t\t\tFiles: map[string][]byte{},\n\t\t}\n\t}\n\ttlsData.Endpoints[epName].Files[fileName] = data\n\treturn nil\n}\n\ntype contextdir string\n\nfunc contextdirOf(name string) contextdir {\n\treturn contextdir(digest.FromString(name).Encoded())\n}","sourceCodeStart":497,"sourceCodeEnd":533,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/context/store/store.go#L497-L533","documentation":"Returned by importEndpointTLS when a TLS file path inside an archive, after stripping the 'tls/' prefix, does not split into exactly two parts (endpointName/fileName). Docker context TLS data must be stored as tls/{endpointName}/{fileName}; any other depth is rejected.","triggerScenarios":"An imported archive contains a TLS entry whose path is 'tls/cert.pem' (only one segment) or 'tls/a/b/c.pem' (three segments) instead of the required 'tls/{endpoint}/{file}' two-level structure.","commonSituations":"Manually archiving TLS files flat under tls/ without an endpoint subdirectory; merging two endpoints into one nested path; a tar/zip created by a non-Docker tool that flattens or re-nests the directory layout.","solutions":["Re-export the context with docker context export so the tls/endpoint/file layout is preserved.","Repackage the archive so every TLS entry matches the pattern tls/<endpointName>/<fileName> (exactly two path segments after tls/).","Remove misplaced TLS entries from the archive before importing."],"exampleFix":"// before: archive has tls/cert.pem (flat, invalid)\n// after:  archive must have tls/docker/cert.pem and tls/docker/key.pem\n//         mkdir -p tls/docker && mv tls/cert.pem tls/docker/","handlingStrategy":"validation","validationCode":"// Validate every tls/ entry has exactly endpoint/file structure\nfunc validateTLSEntries(names []string) error {\n\tfor _, n := range names {\n\t\tif !strings.HasPrefix(n, \"tls/\") { continue }\n\t\tparts := strings.SplitN(strings.TrimPrefix(n, \"tls/\"), \"/\", 2)\n\t\tif len(parts) != 2 || parts[0] == \"\" || parts[1] == \"\" {\n\t\t\treturn fmt.Errorf(\"archive format is invalid for %s\", n)\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Preserve the tls/<endpoint>/<file> layout when crafting context archives.","Re-export contexts with docker context export instead of packing TLS dirs manually.","Validate archive structure programmatically before store.Import."],"tags":["context","import","tls","archive","validation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}