{"record":{"id":"9d50b97b8f5cbe6f","repo":"jdx/mise","slug":"content-level-slsa-verification-does-not-support-n","errorCode":null,"errorMessage":"content-level SLSA verification does not support non-regular archive entry: {}","messagePattern":"content-level SLSA verification does not support non-regular archive entry: (.+?)","errorType":"exception","errorClass":"eyre::Report","httpStatus":null,"severity":"error","filePath":"src/file.rs","lineNumber":2493,"sourceCode":"\nfn archive_content_files_tar(\n    archive_path: &Path,\n    format: ExtractionFormat,\n    strip_components: usize,\n) -> Result<Vec<ArchiveContent>> {\n    let tar = open_tar(format, archive_path)?;\n    let mut archive = Archive::new(tar);\n    let mut files = Vec::new();\n\n    for entry in archive.entries()? {\n        let mut entry = entry?;\n        let path = entry.path()?.into_owned();\n        let entry_type = entry.entry_type();\n        if entry_type == EntryType::Directory {\n            continue;\n        }\n        if entry_type != EntryType::File {\n            bail!(\n                \"content-level SLSA verification does not support non-regular archive entry: {}\",\n                path.display()\n            );\n        }\n        let name = normalize_archive_content_path(&path, strip_components)?;\n        let sha256 = sha256_reader(&mut entry)?;\n        files.push(ArchiveContent { name, sha256 });\n    }\n\n    validate_archive_content_files(files)\n}\n\nfn archive_content_files_zip(\n    archive_path: &Path,\n    strip_components: usize,\n) -> Result<Vec<ArchiveContent>> {\n    let f = File::open(archive_path)?;\n    let mut archive = ZipArchive::new(f)","sourceCodeStart":2475,"sourceCodeEnd":2511,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/file.rs#L2475-L2511","documentation":"While hashing tar entries for content-level SLSA verification, any entry that is neither a regular file nor a directory (symlink, hardlink, FIFO, device node) is rejected. Links let an archive reference content outside itself, which provenance cannot hash meaningfully, so verification fails closed per the documented stricter-than-extraction contract.","triggerScenarios":"A tarball containing symlink or hardlink entries (e.g. libfoo.so -> libfoo.so.1, or usr/bin/x -> x.gnu alternatives links) is installed while content-level verification is enabled.","commonSituations":"Library release tarballs shipping .so symlink chains; tarballs built by tools that deduplicate identical files into hardlinks; GNU-style packages with alternatives symlinks.","solutions":["Use an asset variant without link entries, or fall back to artifact-level verification for that tool","If you produce the artifact, repack with links dereferenced (tar -h / --dereference)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// pre-scan the tarball for link entries before enabling content verification\nlet mut tar = tar::Archive::new(flate2::read::GzDecoder::new(std::fs::File::open(&archive)?));\nfor entry in tar.entries()? {\n    let entry = entry?;\n    let t = entry.header().entry_type();\n    anyhow::ensure!(\n        t.is_file() || t.is_dir(),\n        \"archive contains a link entry ({}); content-level SLSA will fail closed\",\n        entry.path()?.display()\n    );\n}","typeGuard":null,"tryCatchPattern":"match archive_content_files(&archive, format, strip) {\n    Ok(files) => verify_subjects(&files)?,\n    Err(e) if e.to_string().contains(\"non-regular archive entry\") => {\n        warn!(\"archive contains links; falling back to artifact-level verification: {e:#}\");\n        verify_artifact_level(&archive)?;\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Prefer link-free assets (static binaries, dereferenced archives) for verified installs","Build release tarballs with --dereference so no symlinks/hardlinks survive","Keep artifact-level verification as the documented fallback for link-containing archives"],"tags":["slsa","verification","tar","symlink","archive","rust","mise"],"backgroundTag":"archive-symlink-entry","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}