content-level SLSA verification does not support…

Error message

content-level SLSA verification does not support non-regular archive entry: {}

What it means

While hashing tar members for content-level SLSA verification, mise accepts directories (skipped) and regular files only. Any other entry type — devices, fifos, hardlinks treated as non-regular, etc. — triggers this error, because verification semantics are undefined for such entries.

Solutions

Repackage the archive so it contains only regular files and directories
Exclude the offending members when creating the tarball
Skip content-level verification for this artifact

Example fix

// before
tar -cf tool.tar /dev/special tool
// after
tar -cf tool.tar tool

Defensive patterns

Strategy: try-catch

Validate before calling

// inspect tar listing; fail if any entry type is not file/dir
for (const e of listTar(archive)) {
  if (e.type !== "file" && e.type !== "dir") throw new Error("non-regular entry: " + e.name);
}

Type guard

function isRegularEntry(e) { return e.type === "file" || e.type === "dir"; }

Try / catch

try { verifySlsa(a) } catch (e) { if (/non-regular archive entry/.test(e.message)) { rebuildArchive(a); } else throw e; }

Prevention

Build tarballs with only files and directories
Avoid archiving device nodes/fifos
Repackage third-party archives with special members

When it happens

Trigger: SLSA content verification over a tar archive containing special entries (device nodes, fifos, pax hardlink entries surfaced as non-regular types).

Common situations: Archives built from full system trees or with unusual packaging tools that embed non-file members.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/9d50b97b8f5cbe6f. Report an issue: GitHub.

Appendix: source

Thrown at src/file.rs:2684

fn archive_content_files_tar(
    archive_path: &Path,
    format: ExtractionFormat,
    strip_components: usize,
) -> Result<Vec<ArchiveContent>> {
    let tar = open_tar(format, archive_path)?;
    let mut archive = Archive::new(tar);
    let mut files = Vec::new();

    for entry in archive.entries()? {
        let mut entry = entry?;
        let path = entry.path()?.into_owned();
        let entry_type = entry.entry_type();
        if entry_type == EntryType::Directory {
            continue;
        }
        if entry_type != EntryType::File {
            bail!(
                "content-level SLSA verification does not support non-regular archive entry: {}",
                path.display()
            );
        }
        let name = normalize_archive_content_path(&path, strip_components)?;
        let sha256 = sha256_reader(&mut entry)?;
        files.push(ArchiveContent { name, sha256 });
    }

    validate_archive_content_files(files)
}

fn archive_content_files_zip(
    archive_path: &Path,
    strip_components: usize,
) -> Result<Vec<ArchiveContent>> {
    let f = File::open(archive_path)?;
    let mut archive = ZipArchive::new(f)

View on GitHub (pinned to 533346cc37)