content-level SLSA verification found no regular files in ar

Error message

content-level SLSA verification found no regular files in archive

What it means

After walking the whole archive, validate_archive_content_files requires at least one regular file. An archive whose entries are all directories (or one from which no file entries could be enumerated) fails because verifying 'nothing' is meaningless and would silently pass a broken provenance check.

Source

Thrown at src/file.rs:2555

    validate_archive_content_files(files)
}

fn sha256_reader(reader: &mut impl Read) -> Result<String> {
    let mut hasher = Sha256::new();
    let mut buf = [0; 8192];
    loop {
        let n = reader.read(&mut buf)?;
        if n == 0 {
            break;
        }
        hasher.update(&buf[..n]);
    }
    Ok(hex::encode(hasher.finalize()))
}

fn validate_archive_content_files(files: Vec<ArchiveContent>) -> Result<Vec<ArchiveContent>> {
    if files.is_empty() {
        bail!("content-level SLSA verification found no regular files in archive");
    }
    let mut names = std::collections::HashSet::new();
    for file in &files {
        if !names.insert(file.name.clone()) {
            bail!(
                "content-level SLSA verification found duplicate installed archive path: {}",
                file.name
            );
        }
    }
    Ok(files)
}

fn normalize_archive_content_path(path: &Path, strip_components: usize) -> Result<String> {
    let mut parts = Vec::new();
    for component in skip_curdir_components(path) {
        match component {
            std::path::Component::Normal(part) => parts.push(part.to_string_lossy().to_string()),

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

Inspect the downloaded artifact with tar -tzf or unzip -l and confirm it actually lists files
Fix the asset URL/pattern in the backend or aqua config so the real payload archive is downloaded
Verify the download size/checksum against the release to catch truncated downloads

Defensive patterns

Strategy: validation

Validate before calling

// sanity-check the artifact before verification
let f = ExtractionFormat::from_path(&archive)?;
if f.is_tar_archive() {
    let t = tar::Archive::new(File::open(&archive)?);
    let has_files = t.entries()?.filter_map(|e| e.ok())
        .any(|e| e.header().entry_type().is_file());
    anyhow::ensure!(has_files, "archive contains no regular files; wrong or truncated asset?");
}

Prevention

Verify downloaded asset size/checksum against the release before verification runs
List archives (tar -tzf / unzip -l) in CI when asset URLs are dynamic or matcher-driven

When it happens

Trigger: archive_content_files runs on an archive containing only directory entries, or on a truncated/garbage file that parsed but yielded zero file entries.

Common situations: The wrong asset was downloaded (an empty or metadata-only artifact, or a saved error page named .tar.gz); an asset matcher grabbed a placeholder artifact from a release.

Related errors

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/72968cabb444b87b. Report an issue: GitHub.