can1357/oh-my-pi · error · ArchiveError

Unsupported RPM package lead version or type

Error message

Unsupported RPM package lead version or type

What it means

The lead magic is valid, but the lead's major version (byte 4) is below 3 or the package type (big-endian u16 at offset 6) is greater than 1. The library only supports RPM v3+ binary/source packages (type 0 = binary, 1 = source); anything else — e.g. ancient RPM v1/v2 files or GPG signature blobs — is rejected.

Source

Thrown at packages/utils/src/ar/rpm.ts:250

			return zstdDecompress(payload, maxOutput);
		case "lzma":
			if (!sniffLzmaAlone(payload)) throw new ArchiveError(`RPM package '${identity}' has a malformed LZMA payload`);
			return lzmaAloneDecompress(payload, maxOutput);
		case "none":
			if (!sniffCpio(payload))
				throw new ArchiveError(`RPM package '${identity}' has an invalid uncompressed CPIO payload`);
			return payload;
		default:
			throw new ArchiveError(`RPM package '${identity}' uses unsupported payload compressor '${method}'`);
	}
}

async function readRpmArchive(source: ByteSource, options: FormatReadOptions): Promise<ArchiveIndexEntry[]> {
	const initial = await readExact(source, 0, RPM_LEAD_SIZE + RPM_HEADER_INTRO_SIZE, "lead and signature header");
	if (!sniffRpm(initial)) throw new ArchiveError("Invalid RPM package: bad lead magic");
	const major = initial[4]!;
	const packageType = (initial[6]! << 8) | initial[7]!;
	if (major < 3 || packageType > 1) throw new ArchiveError("Unsupported RPM package lead version or type");
	const signatureType = (initial[78]! << 8) | initial[79]!;
	if (signatureType !== RPM_SIGNATURE_TYPE_HEADER) {
		throw new ArchiveError(`Unsupported RPM signature type ${signatureType}; only header signatures are supported`);
	}
	const leadNameEnd = initial.subarray(10, 76).indexOf(0);
	const leadNameBytes = initial.subarray(10, leadNameEnd < 0 ? 76 : 10 + leadNameEnd);
	let leadName = "unknown package";
	try {
		const decoded = new TextDecoder("utf-8", { fatal: true }).decode(leadNameBytes);
		if (decoded) leadName = decoded;
	} catch {}

	const signatureIntro = parseHeaderIntro(initial.subarray(RPM_LEAD_SIZE), options, "signature");
	const signatureEnd = RPM_LEAD_SIZE + signatureIntro.totalSize;
	const mainHeaderOffset = align(signatureEnd, 8);
	const signatureBodyAndPadding = await readExact(
		source,
		RPM_LEAD_SIZE + RPM_HEADER_INTRO_SIZE,

View on GitHub (pinned to 9690622007)

Solutions

  1. Obtain a modern rebuild of the package (rpm v3/v4 format); v1/v2 packages cannot be read here.
  2. Convert old packages on a legacy system or in a container: rpm2cpio the file there and repack as a current RPM.
  3. Confirm with `file <path>` that the artifact is really a binary/source RPM and not an .hdr or metadata blob.
  4. If this is your build pipeline emitting a wrong packageType, fix the rpmbuild invocation.
Defensive patterns

Strategy: validation

Validate before calling

async function rpmLeadVersionAndType(path: string): Promise<{ major: number; type: number } | null> {
  const b = new Uint8Array(await Bun.file(path).slice(0, 8).arrayBuffer());
  if (b.length < 8) return null;
  return { major: b[4]!, type: (b[6]! << 8) | b[7]! };
}
// require major >= 3 && type <= 1 before reading

Type guard

function isSupportedRpmLead(head: Uint8Array): boolean {
  const major = head[4] ?? 0;
  const type = ((head[6] ?? 0) << 8) | (head[7] ?? 0);
  return major >= 3 && type <= 1;
}

Try / catch

try {
  return await readRpm(path);
} catch (err) {
  if (err instanceof ArchiveError && err.message.includes('lead version or type')) {
    throw new Error('Only RPM v3+ binary/source packages are supported; convert legacy packages first');
  }
  throw err;
}

Prevention

When it happens

Trigger: Reading an RPM whose lead byte 4 is 1 or 2 (pre-1997 rpm versions), or whose packageType field is neither 0 nor 1 (e.g. type 2+, non-package artifacts carrying RPM lead magic).

Common situations: Working with archival RPMs from RHEL 4-era or older distributions, artifacts like .mst/.hdr metadata files, or mislabeled files that happen to start with RPM lead bytes.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/b2373577c993fdd5. Report an issue: GitHub.