brew-cask: nested archive depth exceeds {MAX_NESTED_CASK_ARC

Error message

brew-cask: nested archive depth exceeds {MAX_NESTED_CASK_ARCHIVES}

What it means

Some cask archives contain another single archive inside (zip-in-zip). mise unpacks nested archives iteratively up to MAX_NESTED_CASK_ARCHIVES levels. If after the maximum iterations the extract directory still contains exactly one archive file, mise concludes the nesting exceeds the limit and aborts rather than looping forever (a zip-bomb guard).

Source

Thrown at src/system/packages/brew/cask/fetch.rs:345

            .to_string();
        let nested = extract_dir.with_file_name(format!(
            ".{}-nested-{depth}",
            extract_dir
                .file_name()
                .and_then(|name| name.to_str())
                .unwrap_or("cask")
        ));
        file::remove_all(&nested)?;
        file::rename(&archive, &nested)?;
        file::remove_all(extract_dir)?;
        file::create_dir_all(extract_dir)?;
        let result = extract_nested_cask_archive(&nested, extract_dir, &filename, pr);
        let cleanup = file::remove_all(&nested);
        result?;
        cleanup?;
    }
    if single_nested_cask_archive(extract_dir)?.is_some() {
        bail!("brew-cask: nested archive depth exceeds {MAX_NESTED_CASK_ARCHIVES}");
    }
    Ok(())
}

pub(super) fn single_nested_cask_archive(root: &Path) -> Result<Option<PathBuf>> {
    let mut entries = std::fs::read_dir(root)?.filter(|entry| match entry {
        Ok(entry) => entry.file_name() != "__MACOSX",
        Err(_) => true,
    });
    let Some(entry) = entries.next().transpose()? else {
        return Ok(None);
    };
    if entries.next().is_some() || !entry.file_type()?.is_file() {
        return Ok(None);
    }
    let path = entry.path();
    let filename = entry.file_name();
    let filename = filename

View on GitHub (pinned to afd2eddd3a)

Solutions

Manually unpack the artifact to confirm its real nesting depth and check whether the cask points at the right file.
Find a flatter artifact URL for the cask (e.g. the direct app zip) and update the cask metadata.
If you maintain this code path and legitimate casks need more depth, raise MAX_NESTED_CASK_ARCHIVES deliberately.
Treat repeated occurrences as suspicious — verify the artifact against the cask's sha256 before trusting it.

Defensive patterns

Strategy: validation

Validate before calling

// check nesting depth of a downloaded artifact before relying on it
unzip -l app.zip            # inspect entries; flag nested .zip/.tar members
find extract_dir -name '*.zip' -o -name '*.tar.gz' | wc -l

Prevention

Unpack candidate artifacts manually and prefer flat archives in cask URLs.
Always verify sha256 so tampered/nested payloads are rejected earlier.
Treat repeated depth failures as a possible zip-bomb and investigate the source.

When it happens

Trigger: extract_nested_cask_archives, called from extract_archive, exhausts MAX_NESTED_CASK_ARCHIVES iterations and single_nested_cask_archive still finds one archive file in the extract dir — i.e. the artifact nests archives deeper than the configured maximum.

Common situations: An upstream artifact that ships a deeply nested zip-in-zip-in-zip; a malicious or misconfigured cask crafting a quasi-infinite nesting (zip-bomb); an extractor producing an archive instead of plain files at some level.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/f3e1225fd5dc7669. Report an issue: GitHub.