{"record":{"id":"e2859399224a542a","repo":"jdx/mise","slug":"content-level-slsa-verification-only-supports-stri","errorCode":null,"errorMessage":"content-level SLSA verification only supports strip_components values of 0 or 1","messagePattern":"content-level SLSA verification only supports strip_components values of 0 or 1","errorType":"validation","errorClass":"eyre::Report","httpStatus":null,"severity":"error","filePath":"src/file.rs","lineNumber":2444,"sourceCode":"#[derive(Debug, Clone)]\npub struct ArchiveContent {\n    pub name: String,\n    pub sha256: String,\n}\n\n/// Return the regular files in an archive after applying strip-components.\n///\n/// This is intentionally stricter than extraction: content-level provenance is\n/// only safe when every installed regular file is covered, so ambiguous archive\n/// entries (links, unsafe paths, stripped-away file names, unsupported formats)\n/// fail closed instead of being ignored.\npub fn archive_content_files(\n    archive_path: &Path,\n    format: ExtractionFormat,\n    strip_components: usize,\n) -> Result<Vec<ArchiveContent>> {\n    if strip_components > 1 {\n        bail!(\"content-level SLSA verification only supports strip_components values of 0 or 1\");\n    }\n\n    match format {\n        ExtractionFormat::TarGz\n        | ExtractionFormat::TarXz\n        | ExtractionFormat::TarBz2\n        | ExtractionFormat::TarZst\n        | ExtractionFormat::Tar\n        | ExtractionFormat::TarBr\n        | ExtractionFormat::TarLz4\n        | ExtractionFormat::TarSz => {\n            archive_content_files_tar(archive_path, format, strip_components)\n        }\n        ExtractionFormat::Zip => archive_content_files_zip(archive_path, strip_components),\n        ExtractionFormat::SevenZip => {\n            bail!(\"content-level SLSA verification does not support 7z archives\")\n        }\n        ExtractionFormat::Gz","sourceCodeStart":2426,"sourceCodeEnd":2462,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/file.rs#L2426-L2462","documentation":"archive_content_files hashes every regular file in an archive for content-level SLSA provenance verification, and its path normalization (normalize_archive_content_path) only strips 0 or 1 leading components. A larger strip_components would make provenance subject-name matching ambiguous, so verification fails closed per the function's documented stricter-than-extraction contract.","triggerScenarios":"Content-level SLSA verification runs while the tool's install options carry strip_components of 2 or more (e.g. strip_components: 2 in mise.toml or an aqua registry entry), so archive_content_files is called with strip_components > 1.","commonSituations":"A tool's archive nests the payload two directories deep and config compensates with strip 2; enabling stricter SLSA verification on existing configs that already used strip_components >= 2.","solutions":["Reduce strip_components to 0 or 1 by using an archive layout with at most one wrapping directory","Fall back to artifact-level (whole-archive) verification for that tool if the layout cannot change","Repackage the asset without double nesting if you control the release"],"exampleFix":"# before\n[tools]\nmytool = { version = '1.0', strip_components = 2 }\n\n# after\n[tools]\nmytool = { version = '1.0', strip_components = 1 }","handlingStrategy":"validation","validationCode":"if slsa_content_verification_enabled && opts.strip_components > 1 {\n    anyhow::bail!(\"content-level SLSA needs strip_components <= 1; fix the tool's archive layout or use artifact-level verification\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep strip_components at 0 or 1 for tools under content-level SLSA verification","Prefer assets with a single wrapper directory so stripping deeper is never needed","Enable content-level verification only after confirming each tool's archive layout complies"],"tags":["slsa","verification","strip-components","archive","rust","mise"],"backgroundTag":"slsa-verification-unsupported","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}