{"record":{"id":"aeb3e6cd6e221710","repo":"jdx/mise","slug":"content-level-slsa-verification-only-supports-arch","errorCode":null,"errorMessage":"content-level SLSA verification only supports archive formats","messagePattern":"content-level SLSA verification only supports archive formats","errorType":"exception","errorClass":"eyre::Report","httpStatus":null,"severity":"error","filePath":"src/file.rs","lineNumber":2470,"sourceCode":"        | ExtractionFormat::Tar\n        | ExtractionFormat::TarBr\n        | ExtractionFormat::TarLz4\n        | ExtractionFormat::TarSz => {\n            archive_content_files_tar(archive_path, format, strip_components)\n        }\n        ExtractionFormat::Zip => archive_content_files_zip(archive_path, strip_components),\n        ExtractionFormat::SevenZip => {\n            bail!(\"content-level SLSA verification does not support 7z archives\")\n        }\n        ExtractionFormat::Gz\n        | ExtractionFormat::Xz\n        | ExtractionFormat::Bz2\n        | ExtractionFormat::Zst\n        | ExtractionFormat::Br\n        | ExtractionFormat::Lz4\n        | ExtractionFormat::Sz\n        | ExtractionFormat::Raw => {\n            bail!(\"content-level SLSA verification only supports archive formats\")\n        }\n        ExtractionFormat::Rar => bail!(\"rar format not supported\"),\n    }\n}\n\nfn archive_content_files_tar(\n    archive_path: &Path,\n    format: ExtractionFormat,\n    strip_components: usize,\n) -> Result<Vec<ArchiveContent>> {\n    let tar = open_tar(format, archive_path)?;\n    let mut archive = Archive::new(tar);\n    let mut files = Vec::new();\n\n    for entry in archive.entries()? {\n        let mut entry = entry?;\n        let path = entry.path()?.into_owned();\n        let entry_type = entry.entry_type();","sourceCodeStart":2452,"sourceCodeEnd":2488,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/file.rs#L2452-L2488","documentation":"Content-level SLSA verification needs a list of inner files to hash and compare against provenance subjects, so single-file compression formats (Gz, Xz, Bz2, Zst, Br, Lz4, Sz) and Raw are rejected: there is no inner file list to verify. Only container formats (tar variants and zip) are accepted.","triggerScenarios":"archive_content_files is called with a raw or single-file-compressed asset format, e.g. verifying a binary.gz or an uncompressed binary (Raw) at content level.","commonSituations":"Content-level verification enabled globally while some tools ship bare compressed binaries; verification settings too strict for single-binary releases.","solutions":["Verify single-file assets at artifact level (the file's own sha256 against provenance) instead of content level","Scope content-level verification to tools whose assets are archives","Switch the tool to an archive asset if artifact-level verification is not acceptable"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"let f = ExtractionFormat::from_path(&archive)?;\nif !f.is_tar_archive() && f != ExtractionFormat::Zip {\n    // single-file/raw asset: verify the file itself, not 'content files'\n    let sha = sha256_file(&archive)?;\n    verify_artifact_sha256(&sha)?;\n}","typeGuard":"fn supports_content_slsa(f: ExtractionFormat) -> bool {\n    f.is_tar_archive() || f == ExtractionFormat::Zip // excludes Raw and single-file codecs\n}","tryCatchPattern":"match archive_content_files(&archive, format, strip) {\n    Ok(files) => verify_subjects(&files)?,\n    Err(e) if e.to_string().contains(\"only supports archive formats\") => {\n        warn!(\"asset is not an archive; verifying at artifact level: {e:#}\");\n        verify_artifact_level(&archive)?;\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Verify single-binary assets by their own sha256, not by archive content listing","Scope content-level verification settings to tools that ship real archives"],"tags":["slsa","verification","archive","compression","rust","mise"],"backgroundTag":"slsa-verification-unsupported","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}