can1357/oh-my-pi · error · ArchiveError

RPM package '${identity}' has a malformed LZMA payload

Error message

RPM package '${identity}' has a malformed LZMA payload

What it means

The method resolved to 'lzma' but the payload does not pass sniffLzmaAlone (the LZMA_ALONE header check), so decompressPayload refuses to hand the bytes to lzmaAloneDecompress. This guards against feeding a non-LZMA stream (or a corrupt one missing the 13-byte alone header) into the decoder.

Source

Thrown at packages/utils/src/ar/rpm.ts:234

				`RPM package '${identity}' uses unsupported payload compressor '${metadata.payloadCompressor ?? "unknown"}'`,
			);
		}
	}

	switch (method) {
		case "gzip":
		case "gz":
			return gzipDecompress(payload, maxOutput);
		case "bzip2":
		case "bzip":
			return bzip2Decompress(payload, maxOutput);
		case "xz":
			return xzDecompress(payload, maxOutput);
		case "zstd":
		case "zstdio":
			return zstdDecompress(payload, maxOutput);
		case "lzma":
			if (!sniffLzmaAlone(payload)) throw new ArchiveError(`RPM package '${identity}' has a malformed LZMA payload`);
			return lzmaAloneDecompress(payload, maxOutput);
		case "none":
			if (!sniffCpio(payload))
				throw new ArchiveError(`RPM package '${identity}' has an invalid uncompressed CPIO payload`);
			return payload;
		default:
			throw new ArchiveError(`RPM package '${identity}' uses unsupported payload compressor '${method}'`);
	}
}

async function readRpmArchive(source: ByteSource, options: FormatReadOptions): Promise<ArchiveIndexEntry[]> {
	const initial = await readExact(source, 0, RPM_LEAD_SIZE + RPM_HEADER_INTRO_SIZE, "lead and signature header");
	if (!sniffRpm(initial)) throw new ArchiveError("Invalid RPM package: bad lead magic");
	const major = initial[4]!;
	const packageType = (initial[6]! << 8) | initial[7]!;
	if (major < 3 || packageType > 1) throw new ArchiveError("Unsupported RPM package lead version or type");
	const signatureType = (initial[78]! << 8) | initial[79]!;
	if (signatureType !== RPM_SIGNATURE_TYPE_HEADER) {

View on GitHub (pinned to 9690622007)

Solutions

  1. Verify the file checksum and re-download — an LZMA payload failing its own magic sniff is almost always corruption.
  2. Inspect the first bytes of the payload region (hexdump) to see what format it actually is.
  3. Convert the package with rpm2cpio to a supported uncompressed/cpio form before parsing.
  4. If you produce these payloads, ensure they are emitted in LZMA_ALONE format (with the .lzma 13-byte header), not raw LZMA1 or LZMA2/xz.
Defensive patterns

Strategy: validation

Validate before calling

// LZMA_ALONE payloads start with 0x5D and plausible props/dict-size
async function hasValidLzmaAloneHeader(path: string, payloadOffset: number): Promise<boolean> {
  const b = new Uint8Array(await Bun.file(path).slice(payloadOffset, payloadOffset + 13).arrayBuffer());
  return b[0] === 0x5d && b[1] === 0x00 && b[2] === 0x00;
}

Type guard

function isLzmaAloneHeader(b: Uint8Array): boolean {
  return b.length >= 13 && b[0] === 0x5d && (b[1] | b[2]) === 0;
}

Try / catch

try {
  return await readRpm(path);
} catch (err) {
  if (err instanceof ArchiveError && err.message.includes('malformed LZMA payload')) {
    throw new Error('RPM payload corrupt or not LZMA_ALONE; re-download package');
  }
  throw err;
}

Prevention

When it happens

Trigger: RPM with declared or sniffed method 'lzma' whose payload lacks a valid LZMA_ALONE header (magic 0x5D with plausible dictionary/size fields); raised immediately before lzmaAloneDecompress is called.

Common situations: Corrupt downloads where the payload's first bytes were lost or altered, packages whose declared compressor tag lies about the real format, or hand-repacked payloads stripped of the alone header.

Understand the failure class

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/1b313607edcd9c7c. Report an issue: GitHub.