jdx/mise · error · eyre::Report

content-level SLSA verification only supports archive format

Error message

content-level SLSA verification only supports archive formats

What it means

Content-level SLSA verification needs a list of inner files to hash and compare against provenance subjects, so single-file compression formats (Gz, Xz, Bz2, Zst, Br, Lz4, Sz) and Raw are rejected: there is no inner file list to verify. Only container formats (tar variants and zip) are accepted.

Source

Thrown at src/file.rs:2470

        | ExtractionFormat::Tar
        | ExtractionFormat::TarBr
        | ExtractionFormat::TarLz4
        | ExtractionFormat::TarSz => {
            archive_content_files_tar(archive_path, format, strip_components)
        }
        ExtractionFormat::Zip => archive_content_files_zip(archive_path, strip_components),
        ExtractionFormat::SevenZip => {
            bail!("content-level SLSA verification does not support 7z archives")
        }
        ExtractionFormat::Gz
        | ExtractionFormat::Xz
        | ExtractionFormat::Bz2
        | ExtractionFormat::Zst
        | ExtractionFormat::Br
        | ExtractionFormat::Lz4
        | ExtractionFormat::Sz
        | ExtractionFormat::Raw => {
            bail!("content-level SLSA verification only supports archive formats")
        }
        ExtractionFormat::Rar => bail!("rar format not supported"),
    }
}

fn archive_content_files_tar(
    archive_path: &Path,
    format: ExtractionFormat,
    strip_components: usize,
) -> Result<Vec<ArchiveContent>> {
    let tar = open_tar(format, archive_path)?;
    let mut archive = Archive::new(tar);
    let mut files = Vec::new();

    for entry in archive.entries()? {
        let mut entry = entry?;
        let path = entry.path()?.into_owned();
        let entry_type = entry.entry_type();

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

1. Verify single-file assets at artifact level (the file's own sha256 against provenance) instead of content level
2. Scope content-level verification to tools whose assets are archives
3. Switch the tool to an archive asset if artifact-level verification is not acceptable

let f = ExtractionFormat::from_path(&archive)?;
if !f.is_tar_archive() && f != ExtractionFormat::Zip {
    // single-file/raw asset: verify the file itself, not 'content files'
    let sha = sha256_file(&archive)?;
    verify_artifact_sha256(&sha)?;
}

fn supports_content_slsa(f: ExtractionFormat) -> bool {
    f.is_tar_archive() || f == ExtractionFormat::Zip // excludes Raw and single-file codecs
}

match archive_content_files(&archive, format, strip) {
    Ok(files) => verify_subjects(&files)?,
    Err(e) if e.to_string().contains("only supports archive formats") => {
        warn!("asset is not an archive; verifying at artifact level: {e:#}");
        verify_artifact_level(&archive)?;
    }
    Err(e) => return Err(e),
}

When it happens

Trigger: archive_content_files is called with a raw or single-file-compressed asset format, e.g. verifying a binary.gz or an uncompressed binary (Raw) at content level.

Common situations: Content-level verification enabled globally while some tools ship bare compressed binaries; verification settings too strict for single-binary releases.

Related errors

• content-level SLSA verification only supports strip_componen
• content-level SLSA verification does not support non-regular
• content-level SLSA verification does not support symlink arc
• content-level SLSA verification found no regular files in ar
• content-level SLSA verification found duplicate installed ar

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/aeb3e6cd6e221710. Report an issue: GitHub.