What causes "malformed change path matcher: %s" in slimtoolkit/slim?

Use the full 3-field form: dump: : , e.g. dump:/tmp/out:'*.conf' or dump::'/etc/.*'.

malformed change path matcher: %s

Error message

malformed change path matcher: %s

What it means

parseChangePathMatchers in the xray command (pkg/app/master/command/xray/cli.go:480) parses --change-path matcher values. A value starting with 'dump:' must have the 3-part form 'dump:output:path_pattern' (SplitN on ':' into exactly 3 parts); values like 'dump:console' or 'dump:/tmp/out' (2 fields) return "malformed change path matcher: %s".

Source

Thrown at pkg/app/master/command/xray/cli.go:480

			}
		}

		matchers = append(matchers, &m)
	}

	return matchers, nil
}

func parseChangePathMatchers(values []string) ([]*dockerimage.ChangePathMatcher, error) {
	var matchers []*dockerimage.ChangePathMatcher

	for _, raw := range values {
		var m dockerimage.ChangePathMatcher

		if strings.HasPrefix(raw, "dump:") {
			parts := strings.SplitN(raw, ":", 3)
			if len(parts) != 3 {
				return nil, fmt.Errorf("malformed change path matcher: %s", raw)
			}

			m.Dump = true

			outTarget := strings.TrimSpace(parts[1])
			if len(outTarget) == 0 || outTarget == dockerimage.CDMDumpToConsole {
				m.DumpConsole = true
			} else {
				m.DumpDir = outTarget
			}

			m.PathPattern = parts[2]

			//"dump:output:path_ptrn"
			//"::path_ptrn"
			//"path_ptrn"
		} else {
			if !strings.HasPrefix(raw, ":") {

View on GitHub (pinned to 81940d17fa)

Solutions

Use the full 3-field form: dump:<output-dir-or-empty>:<path-pattern>, e.g. dump:/tmp/out:'*.conf' or dump::'/etc/.*'.
If the path pattern is empty, still include the trailing separator: 'dump:/tmp/out:'.
Note path matchers take one fewer field than data matchers (3, not 4) — don't mix the syntaxes.
Sanity check: the value must contain exactly 2 colons when prefixed with 'dump:'.

Example fix

// before
--change-path 'dump:/tmp/out'
// after
--change-path 'dump:/tmp/out:*.conf'

Defensive patterns

Strategy: validation

Validate before calling

// validate a dump-form change-path matcher before invoking the CLI
func validDumpPathMatcher(raw string) bool {
    if !strings.HasPrefix(raw, "dump:") {
        return true
    }
    return len(strings.SplitN(raw, ":", 3)) == 3
}

Try / catch

matchers, err := parseChangePathMatchers(values)
if err != nil {
    if strings.HasPrefix(err.Error(), "malformed change path matcher") {
        fmt.Fprintf(os.Stderr, "expected dump:out:path_pattern (2 colons): %v\n", err)
        os.Exit(2)
    }
    return err
}

Prevention

Path matcher dump form = 3 fields (2 colons): dump:out:path_pattern.
Don't copy data-matcher examples — their dump form has one extra field.
Include the pattern even when dumping, e.g. dump:/tmp/out:'*.conf'.
Use single quotes in shell to keep glob/regex characters intact.

When it happens

Trigger: Passing a --change-path value beginning with 'dump:' that lacks the trailing path-pattern field, e.g. 'dump:console' or 'dump:/tmp/out' — fewer than 3 colon-separated fields.

Common situations: Users assume 'dump:/tmp/out' is enough and forget the pattern field; translating data-matcher syntax (4 fields) to path-matcher syntax (3 fields) incorrectly; examples copied from data-matcher docs.

Understand the failure class

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

AI-assisted analysis of slimtoolkit/slim@81940d17fa (2026-08-31). Data as JSON: /api/errors/4417921e00367a53. Report an issue: GitHub.