content-level SLSA verification stripped all components from

Error message

content-level SLSA verification stripped all components from archive path: {}

What it means

normalize_archive_content_path strips strip_components leading directories from each entry name. If an entry has fewer components than the strip count - or exactly as many, leaving an empty remainder - the resulting path would be empty, so verification bails instead of producing a nameless provenance subject. A root-level file like README with strip_components = 1 is the typical case.

Source

Thrown at src/file.rs:2586

fn normalize_archive_content_path(path: &Path, strip_components: usize) -> Result<String> {
    let mut parts = Vec::new();
    for component in skip_curdir_components(path) {
        match component {
            std::path::Component::Normal(part) => parts.push(part.to_string_lossy().to_string()),
            std::path::Component::CurDir => {}
            std::path::Component::ParentDir
            | std::path::Component::RootDir
            | std::path::Component::Prefix(_) => {
                bail!(
                    "content-level SLSA verification rejected unsafe archive path: {}",
                    path.display()
                )
            }
        }
    }
    if strip_components > parts.len() {
        bail!(
            "content-level SLSA verification stripped all components from archive path: {}",
            path.display()
        );
    }
    let parts = &parts[strip_components..];
    if parts.is_empty() {
        bail!(
            "content-level SLSA verification stripped all components from archive path: {}",
            path.display()
        );
    }
    Ok(parts.join("/"))
}

#[cfg(test)]
mod tests {
    use pretty_assertions::assert_eq;

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

Set strip_components to 0 for flat archives
Use the wrapped-directory variant of the asset if the release ships both layouts
Fall back to artifact-level verification if the layout cannot be changed

Example fix

# before (flat tarball: binary at archive root)
strip_components = 1 # every entry would strip to nothing

# after
strip_components = 0

Defensive patterns

Strategy: validation

Validate before calling

// flat archives (files at top level) must use strip_components = 0
let min_depth = min_entry_component_depth(&archive, format)?;
if strip_components >= min_depth {
    anyhow::ensure!(strip_components == 0, "strip_components={strip_components} empties every entry of this flat archive");
}

Prevention

Check the archive layout (tar -tzf | head) before choosing strip_components
Only strip when every entry sits under a single wrapper directory
Keep strip_components at 0 for flat release tarballs and zips

When it happens

Trigger: Content-level SLSA verification with strip_components = 1 on a flat archive that contains root-level files (./README, LICENSE, or the binary itself at the top level).

Common situations: strip_components = 1 copied from a wrapped-tarball config while the tool's actual release is flat; mixed archives with both a wrapper directory and some root-level files.

Related errors

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/d20638d3609487d0. Report an issue: GitHub.