{"record":{"id":"e2859399224a542a","repo":"jdx/mise","slug":"content-level-slsa-verification-only-supports-stri","errorCode":null,"errorMessage":"content-level SLSA verification only supports strip_components values of 0 or 1","messagePattern":"content-level SLSA verification only supports strip_components values of 0 or 1","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/file.rs","lineNumber":2635,"sourceCode":"#[derive(Debug, Clone)]\npub(crate) struct ArchiveContent {\n    pub name: String,\n    pub sha256: String,\n}\n\n/// Return the regular files in an archive after applying strip-components.\n///\n/// This is intentionally stricter than extraction: content-level provenance is\n/// only safe when every installed regular file is covered, so ambiguous archive\n/// entries (links, unsafe paths, stripped-away file names, unsupported formats)\n/// fail closed instead of being ignored.\npub(crate) fn archive_content_files(\n    archive_path: &Path,\n    format: ExtractionFormat,\n    strip_components: usize,\n) -> Result<Vec<ArchiveContent>> {\n    if strip_components > 1 {\n        bail!(\"content-level SLSA verification only supports strip_components values of 0 or 1\");\n    }\n\n    match format {\n        ExtractionFormat::TarGz\n        | ExtractionFormat::TarXz\n        | ExtractionFormat::TarBz2\n        | ExtractionFormat::TarZst\n        | ExtractionFormat::Tar\n        | ExtractionFormat::TarBr\n        | ExtractionFormat::TarLz4\n        | ExtractionFormat::TarSz => {\n            archive_content_files_tar(archive_path, format, strip_components)\n        }\n        ExtractionFormat::Zip => archive_content_files_zip(archive_path, strip_components),\n        ExtractionFormat::SevenZip => {\n            bail!(\"content-level SLSA verification does not support 7z archives\")\n        }\n        ExtractionFormat::Gz","sourceCodeStart":2617,"sourceCodeEnd":2653,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/file.rs#L2617-L2653","documentation":"archive_content_files, used for content-level SLSA provenance verification (hashing archive members), only supports strip_components of 0 or 1 because path normalization is implemented only for those cases. Values above 1 are rejected up front. This is a deliberate limitation of the verification feature, not a generic extraction limit.","triggerScenarios":"Invoking SLSA content verification on an archive configured with strip_components >= 2.","commonSituations":"packslip/aqua-style configs copied from setups that used strip_components=2 for extraction; registry entries with deeply nested binaries.","solutions":["Change strip_components to 0 or 1 for the verified asset","Skip content-level verification for this asset (fall back to plain checksum verification)","Repackage the artifact so one-level stripping suffices"],"exampleFix":"// before\nstrip_components = 2\n// after\nstrip_components = 1","handlingStrategy":"validation","validationCode":"if (config.strip_components > 1) throw new Error(\"SLSA content verification requires strip_components 0 or 1\");","typeGuard":"function validForSlsaVerify(c) { return c.strip_components <= 1; }","tryCatchPattern":null,"preventionTips":["Keep verified assets at one nesting level","Keep SLSA verification and strip_components settings reviewed together","Document the 0/1 limit in project packaging guides"],"tags":["slsa","verification","archive","config"],"backgroundTag":"value-out-of-range","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}