Why Does the Archive Engine Commonly Fail to Extract Linux OS Image Files?

We have frequently received reports indicating that the Archive engine fails to extract content from Linux Docker image files or Linux installer ISO files. Upon investigation, we identified a consistent pattern among the reported failures.

These Linux-based operating systems often include programming language toolchains such as Golang, Python, …. These tools typically contain internal test archive files used for validation purposes. For instance, Golang provides such test data as shown here: - The Go Programming Language

These test archives are usually located in directories named “test” or “testdata.” Notably, many of these archive files are intentionally malformed or corrupted to validate error handling within the tools themselves.

As a result, when the Archive engine attempts to process these files, extraction failures occur—this behavior is expected and consistent with the purpose of the files.

Golang test files located at /usr/local/go/src/archive/tar/testdata

Recommended Actions:

Use 3rd party extraction tools, such as 7z, to confirm the files have problems when extracting.

Scan it with MetaScan (and Adaptive Sandbox if possible) to confirm that the files are not malicious.

1. Allowlist by Hash Add the known test archive files to the allowlist based on their hashes. This ensures they are recognized and skipped during scanning.

Or

2. Adjust Archive Extraction Settings Navigate to the workflow configuration (Workflow > [Name] > Archive) and do not enable the Invalid file structure and Extracted partially options Disabling these options will prevent the system from blocking these files.