{"record":{"id":"fecf5679bd13e3ff","repo":"aaif-goose/goose","slug":"failed-to-parse-bundle-e","errorCode":null,"errorMessage":"Failed to parse bundle: {e}","messagePattern":"Failed to parse bundle: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/goose-cli/src/commands/update.rs","lineNumber":168,"sourceCode":"\n    if let Some(value) = token.and_then(authorization_header_value) {\n        req = req.header(AUTHORIZATION, value);\n    }\n\n    req.send().await.context(\"Failed to fetch attestations\")\n}\n\n// Verify a single attestation bundle against the artifact digest and workflow.\nfn verify_bundle(\n    bundle_json: &serde_json::Value,\n    artifact_digest: Sha256Hash,\n    policy: &VerificationPolicy,\n    trusted_root: &TrustedRoot,\n    workflow: &str,\n) -> Result<()> {\n    let bundle_str = serde_json::to_string(bundle_json)?;\n    let bundle = Bundle::from_json(&bundle_str)\n        .map_err(|e| anyhow::anyhow!(\"Failed to parse bundle: {e}\"))?;\n\n    let result = sigstore_verify::verify(artifact_digest, &bundle, policy, trusted_root)\n        .map_err(|e| anyhow::anyhow!(\"{e}\"))?;\n\n    let identity = result\n        .identity\n        .as_deref()\n        .ok_or_else(|| anyhow::anyhow!(\"No identity in certificate\"))?;\n\n    let expected = format!(\"/.github/workflows/{workflow}\");\n    if !identity.contains(&expected) {\n        bail!(\"Workflow mismatch: expected {workflow}, got {identity}\");\n    }\n\n    Ok(())\n}\n\n/// Returns `Ok(())` when the downloaded archive has verified provenance.","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/aaif-goose/goose/blob/3810898a7447ec3299be72e223d3570a7aabf0ab/crates/goose-cli/src/commands/update.rs#L150-L186","documentation":"During `goose update`, the SLSA attestation bundle fetched for the release archive is fed into sigstore's Bundle::from_json. This error means that JSON did not deserialize into a valid DSSE bundle — the data is malformed, truncated, or not a bundle at all (e.g. an HTML error page from a proxy or a corrupted download).","triggerScenarios":"Release asset download interrupted/currupted (truncated JSON); a corporate proxy or antivirus rewriting the attestation response; a release published with a malformed or new bundle format this goose version cannot parse.","commonSituations":"Flaky networks mid-update; TLS-intercepting middleboxes; goose version lagging behind a provenance format change in the release pipeline.","solutions":["Re-run `goose update` — transient corruption is the most common cause","Check whether a proxy/antivirus intercepts api.github.com and excludes it from TLS inspection","Update goose via your package manager to get a version that understands the current bundle format","If it reproduces on a clean network, report the release — the attestation itself may be broken"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"let value: serde_json::Value = serde_json::from_str(&bundle_str)\n    .with_context(|| \"attestation is not valid JSON; likely a corrupted/proxied download\")?;\nif value.get(\"mediaType\").and_then(|m| m.as_str()).is_none() {\n    anyhow::bail!(\"response lacks DSSE mediaType; not an attestation bundle\");\n}","typeGuard":null,"tryCatchPattern":"match verify_provenance(&archive, tag).await {\n    Err(e) if e.to_string().contains(\"Failed to parse bundle\") => {\n        // re-download the release + attestation once, then fail closed\n        let (archive2, tag2) = redownload(tag).await?;\n        verify_provenance(&archive2, &tag2).await\n    }\n    other => other,\n}","preventionTips":["Re-fetch the attestation once on parse failure — corruption is more common than malice","Exclude github release domains from TLS-intercepting proxies","Keep goose current so bundle-format support matches the release pipeline"],"tags":["sigstore","update","supply-chain","json","network"],"backgroundTag":null,"analyzedSha":"3810898a7447ec3299be72e223d3570a7aabf0ab","analyzedAt":"2026-08-16T10:14:26.282Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}