jdx/mise · error

content-level SLSA verification only supports archive…

Error message

content-level SLSA verification only supports archive formats

What it means

Content-level SLSA verification hashes files inside structured archives; bare compressed single files (gz, xz, bz2, zst, br, lz4, sz) and Raw downloads contain no archive member list, so they are rejected. Only real archive formats (tar.* and zip) are supported for content verification.

Solutions

1. Use a packaged archive artifact (tar.gz/tar.xz/tar.bz2/tar.zst/zip) for content-level verification
2. Verify non-archive downloads via plain sha256 checksums instead of content verification
3. Remove SLSA content verification from configs targeting raw/compressed binaries

Example fix

// before
url = "https://example.com/tool-linux-amd64.gz"
// after
url = "https://example.com/tool-linux-amd64.tar.gz"

const ARCHIVES = new Set(["targz","tarxz","tarbz2","tarzst","tarbr","tarlz4","tarsz","zip"]);
if (!ARCHIVES.has(format)) throw new Error("content verification needs an archive format, not " + format);

function isArchiveFormat(f) { return f.startsWith("tar") || f === "zip"; }

When it happens

Trigger: Calling archive_content_files with format Gz/Xz/Bz2/Zst/Br/Lz4/Sz/Raw.

Common situations: Verifying a single-binary download compressed as .gz or served raw; packslip manifest pointing at a non-archive artifact.

Understand the failure class

Background: "is not a compatible type" / "cannot merge" errors: when a value's type doesn't match what the library requires — this error's family across 65 libraries.

Related errors

• content-level SLSA verification does not support…
• content-level SLSA verification found duplicate installed…
• content-level SLSA verification found no regular files in…
• content-level SLSA verification only supports…
• brew-cask: : unsupported archive type for

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/aeb3e6cd6e221710. Report an issue: GitHub.

Appendix: source

Thrown at src/file.rs:2661

        | ExtractionFormat::Tar
        | ExtractionFormat::TarBr
        | ExtractionFormat::TarLz4
        | ExtractionFormat::TarSz => {
            archive_content_files_tar(archive_path, format, strip_components)
        }
        ExtractionFormat::Zip => archive_content_files_zip(archive_path, strip_components),
        ExtractionFormat::SevenZip => {
            bail!("content-level SLSA verification does not support 7z archives")
        }
        ExtractionFormat::Gz
        | ExtractionFormat::Xz
        | ExtractionFormat::Bz2
        | ExtractionFormat::Zst
        | ExtractionFormat::Br
        | ExtractionFormat::Lz4
        | ExtractionFormat::Sz
        | ExtractionFormat::Raw => {
            bail!("content-level SLSA verification only supports archive formats")
        }
        ExtractionFormat::Rar => bail!("rar format not supported"),
    }
}

fn archive_content_files_tar(
    archive_path: &Path,
    format: ExtractionFormat,
    strip_components: usize,
) -> Result<Vec<ArchiveContent>> {
    let tar = open_tar(format, archive_path)?;
    let mut archive = Archive::new(tar);
    let mut files = Vec::new();

    for entry in archive.entries()? {
        let mut entry = entry?;
        let path = entry.path()?.into_owned();
        let entry_type = entry.entry_type();

View on GitHub (pinned to 533346cc37)