JuliusBrussee/caveman · error

githubapp: repository proof size mismatch

Error message

githubapp: repository proof size mismatch

What it means

Integrity check in GetFileContent(): the decoded byte length exceeds 64 KiB or does not equal the declared payload.Size — the fetched content does not match its metadata, so it is rejected rather than trusted.

Source

Thrown at shared/platform/githubapp/githubapp.go:335

	}
	var payload struct {
		Type     string `json:"type"`
		Encoding string `json:"encoding"`
		Content  string `json:"content"`
		Size     int64  `json:"size"`
	}
	if err := json.Unmarshal(raw, &payload); err != nil {
		return nil, fmt.Errorf("githubapp: decode repository proof: %w", err)
	}
	if payload.Type != "file" || payload.Encoding != "base64" || payload.Size < 0 || payload.Size > 64<<10 {
		return nil, fmt.Errorf("githubapp: repository proof has invalid type, encoding, or size")
	}
	decoded, err := base64.StdEncoding.DecodeString(strings.ReplaceAll(payload.Content, "\n", ""))
	if err != nil {
		return nil, fmt.Errorf("githubapp: decode repository proof content: %w", err)
	}
	if len(decoded) > 64<<10 || int64(len(decoded)) != payload.Size {
		return nil, fmt.Errorf("githubapp: repository proof size mismatch")
	}
	return decoded, nil
}

// DoToken issues an authenticated GitHub REST call with an installation token and
// returns the status + raw body for the caller to parse. It is the reusable
// primitive the worker's PR opener builds the Git Data API flow on, so every
// GitHub egress goes through the one SSRF-guarded client + fixed base host.
func (a *App) DoToken(ctx context.Context, token, method, path string, body any) (int, []byte, error) {
	return a.do(ctx, "Bearer "+token, method, path, body)
}

func (a *App) do(ctx context.Context, authorization, method, path string, body any) (int, []byte, error) {
	if !strings.HasPrefix(path, "/") || strings.HasPrefix(path, "//") || strings.Contains(path, "\\") {
		return 0, nil, fmt.Errorf("githubapp: request path must be a single-host absolute path")
	}
	base, err := url.Parse(a.baseURL)
	if err != nil || base.Scheme == "" || base.Host == "" || base.User != nil {

View on GitHub (pinned to 766dce6b13)

Solutions

1. Re-fetch the file to rule out a transient inconsistent response
2. If persistent, treat as tampering/corruption of the proof and regenerate it

When it happens

Trigger: Thrown at shared/platform/githubapp/githubapp.go:335 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/25d49a03c5278ea0. Report an issue: GitHub.