{"record":{"id":"d20638d3609487d0","repo":"jdx/mise","slug":"content-level-slsa-verification-stripped-all-compo","errorCode":null,"errorMessage":"content-level SLSA verification stripped all components from archive path: {}","messagePattern":"content-level SLSA verification stripped all components from archive path: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/file.rs","lineNumber":2586,"sourceCode":"\nfn normalize_archive_content_path(path: &Path, strip_components: usize) -> Result<String> {\n    let mut parts = Vec::new();\n    for component in skip_curdir_components(path) {\n        match component {\n            std::path::Component::Normal(part) => parts.push(part.to_string_lossy().to_string()),\n            std::path::Component::CurDir => {}\n            std::path::Component::ParentDir\n            | std::path::Component::RootDir\n            | std::path::Component::Prefix(_) => {\n                bail!(\n                    \"content-level SLSA verification rejected unsafe archive path: {}\",\n                    path.display()\n                )\n            }\n        }\n    }\n    if strip_components > parts.len() {\n        bail!(\n            \"content-level SLSA verification stripped all components from archive path: {}\",\n            path.display()\n        );\n    }\n    let parts = &parts[strip_components..];\n    if parts.is_empty() {\n        bail!(\n            \"content-level SLSA verification stripped all components from archive path: {}\",\n            path.display()\n        );\n    }\n    Ok(parts.join(\"/\"))\n}\n\n#[cfg(test)]\nmod tests {\n    use pretty_assertions::assert_eq;\n","sourceCodeStart":2568,"sourceCodeEnd":2604,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/file.rs#L2568-L2604","documentation":"normalize_archive_content_path strips strip_components leading directories from each entry name. If an entry has fewer components than the strip count - or exactly as many, leaving an empty remainder - the resulting path would be empty, so verification bails instead of producing a nameless provenance subject. A root-level file like README with strip_components = 1 is the typical case.","triggerScenarios":"Content-level SLSA verification with strip_components = 1 on a flat archive that contains root-level files (./README, LICENSE, or the binary itself at the top level).","commonSituations":"strip_components = 1 copied from a wrapped-tarball config while the tool's actual release is flat; mixed archives with both a wrapper directory and some root-level files.","solutions":["Set strip_components to 0 for flat archives","Use the wrapped-directory variant of the asset if the release ships both layouts","Fall back to artifact-level verification if the layout cannot be changed"],"exampleFix":"# before (flat tarball: binary at archive root)\nstrip_components = 1 # every entry would strip to nothing\n\n# after\nstrip_components = 0","handlingStrategy":"validation","validationCode":"// flat archives (files at top level) must use strip_components = 0\nlet min_depth = min_entry_component_depth(&archive, format)?;\nif strip_components >= min_depth {\n    anyhow::ensure!(strip_components == 0, \"strip_components={strip_components} empties every entry of this flat archive\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check the archive layout (tar -tzf | head) before choosing strip_components","Only strip when every entry sits under a single wrapper directory","Keep strip_components at 0 for flat release tarballs and zips"],"tags":["slsa","verification","strip-components","archive","rust","mise"],"backgroundTag":"strip-components-limit","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}