{"record":{"id":"aeb3e6cd6e221710","repo":"jdx/mise","slug":"content-level-slsa-verification-only-supports-arch","errorCode":null,"errorMessage":"content-level SLSA verification only supports archive formats","messagePattern":"content-level SLSA verification only supports archive formats","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/file.rs","lineNumber":2661,"sourceCode":"        | ExtractionFormat::Tar\n        | ExtractionFormat::TarBr\n        | ExtractionFormat::TarLz4\n        | ExtractionFormat::TarSz => {\n            archive_content_files_tar(archive_path, format, strip_components)\n        }\n        ExtractionFormat::Zip => archive_content_files_zip(archive_path, strip_components),\n        ExtractionFormat::SevenZip => {\n            bail!(\"content-level SLSA verification does not support 7z archives\")\n        }\n        ExtractionFormat::Gz\n        | ExtractionFormat::Xz\n        | ExtractionFormat::Bz2\n        | ExtractionFormat::Zst\n        | ExtractionFormat::Br\n        | ExtractionFormat::Lz4\n        | ExtractionFormat::Sz\n        | ExtractionFormat::Raw => {\n            bail!(\"content-level SLSA verification only supports archive formats\")\n        }\n        ExtractionFormat::Rar => bail!(\"rar format not supported\"),\n    }\n}\n\nfn archive_content_files_tar(\n    archive_path: &Path,\n    format: ExtractionFormat,\n    strip_components: usize,\n) -> Result<Vec<ArchiveContent>> {\n    let tar = open_tar(format, archive_path)?;\n    let mut archive = Archive::new(tar);\n    let mut files = Vec::new();\n\n    for entry in archive.entries()? {\n        let mut entry = entry?;\n        let path = entry.path()?.into_owned();\n        let entry_type = entry.entry_type();","sourceCodeStart":2643,"sourceCodeEnd":2679,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/file.rs#L2643-L2679","documentation":"Content-level SLSA verification hashes files inside structured archives; bare compressed single files (gz, xz, bz2, zst, br, lz4, sz) and Raw downloads contain no archive member list, so they are rejected. Only real archive formats (tar.* and zip) are supported for content verification.","triggerScenarios":"Calling archive_content_files with format Gz/Xz/Bz2/Zst/Br/Lz4/Sz/Raw.","commonSituations":"Verifying a single-binary download compressed as .gz or served raw; packslip manifest pointing at a non-archive artifact.","solutions":["Use a packaged archive artifact (tar.gz/tar.xz/tar.bz2/tar.zst/zip) for content-level verification","Verify non-archive downloads via plain sha256 checksums instead of content verification","Remove SLSA content verification from configs targeting raw/compressed binaries"],"exampleFix":"// before\nurl = \"https://example.com/tool-linux-amd64.gz\"\n// after\nurl = \"https://example.com/tool-linux-amd64.tar.gz\"","handlingStrategy":"validation","validationCode":"const ARCHIVES = new Set([\"targz\",\"tarxz\",\"tarbz2\",\"tarzst\",\"tarbr\",\"tarlz4\",\"tarsz\",\"zip\"]);\nif (!ARCHIVES.has(format)) throw new Error(\"content verification needs an archive format, not \" + format);","typeGuard":"function isArchiveFormat(f) { return f.startsWith(\"tar\") || f === \"zip\"; }","tryCatchPattern":null,"preventionTips":["Use archives when enabling content verification","Verify raw binaries with plain sha256 instead","Audit packslip/manifests for non-archive assets"],"tags":["slsa","verification","archive","unsupported-format"],"backgroundTag":"incompatible-source-type","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}