affaan-m/ECC · error

Nasiko manifest is not valid JSON.

Error message

Nasiko manifest is not valid JSON.

What it means

validateManifest in scripts/lib/nasiko-release.js runs JSON.parse over the manifest bytes downloaded from the registry after the manifest digest already matched. If parsing throws, the body is not valid JSON, so it can never be a valid OCI manifest. The digest having matched means the corruption happened on the producer side or in this script's expectations, not in transit.

Source

Thrown at scripts/lib/nasiko-release.js:62

  const normalized = normalizePlatform(platform, architecture);
  const qualification = QUALIFIED_RELEASES[version]?.[`${normalized.os}/${normalized.arch}`];
  if (!qualification) throw new Error(`Nasiko ${version} is not qualified for ${normalized.os}/${normalized.arch}.`);
  return { version, ...normalized, ...qualification, license: LICENSE, sourceUrl: SOURCE_URL };
}

function digestBytes(bytes) {
  return `sha256:${crypto.createHash('sha256').update(bytes).digest('hex')}`;
}

function assertDigest(bytes, expectedDigest, label) {
  if (!SHA256_PATTERN.test(expectedDigest)) throw new Error(`${label} has an invalid expected digest.`);
  const actual = digestBytes(bytes);
  if (actual !== expectedDigest) throw new Error(`${label} digest mismatch: expected ${expectedDigest}, got ${actual}.`);
}

function validateManifest(bytes) {
  let manifest;
  try { manifest = JSON.parse(bytes.toString('utf8')); } catch (_error) { throw new Error('Nasiko manifest is not valid JSON.'); }
  if (manifest.schemaVersion !== 2 || !Array.isArray(manifest.layers) || manifest.layers.length !== 1) {
    throw new Error('Nasiko manifest must contain exactly one OCI layer.');
  }
  const layer = manifest.layers[0];
  if (layer.mediaType !== 'application/gzip' || !SHA256_PATTERN.test(layer.digest)) {
    throw new Error('Nasiko manifest layer is not a qualified gzip artifact.');
  }
  if (!Number.isSafeInteger(layer.size) || layer.size <= 0 || layer.size > MAX_ARCHIVE_BYTES) {
    throw new Error('Nasiko manifest layer size is outside the allowed range.');
  }
  return { digest: layer.digest, size: layer.size };
}

function readTarString(block, offset, length) {
  return block.subarray(offset, offset + length).toString('utf8').replace(/\0.*$/, '');
}

function extractQualifiedTarGzip(archiveBytes, expectedName) {

View on GitHub (pinned to 06c5e118c4)

Solutions

  1. Inspect the actual manifest: `curl -sS https://registry.nasiko.dev/v2/nasiko/nasiko/manifests/v0.1.0 | head -c 400` to see what was returned
  2. Update the ECC checkout so the pinned manifestDigest matches the currently served artifact
  3. If you control releases, re-qualify the release and update both digests in QUALIFIED_RELEASES
  4. Report persistent mismatches upstream rather than skipping validation
Defensive patterns

Strategy: try-catch

Try / catch

try {
  await installNasiko({ version: 'v0.1.0' });
} catch (error) {
  if (/manifest is not valid JSON/.test(String(error.message))) {
    // Digest already matched, so the registry itself served non-JSON under the
    // pinned digest. Inspect the served manifest manually and update the pinned
    // digests/checkout; do not retry blindly.
  }
  throw error;
}

Prevention

When it happens

Trigger: The registry returns HTTP 200 with a non-JSON body whose sha256 still matches the pinned manifest digest: an upstream packaging change, a different artifact stored under the same digest in a mirror, or an incorrectly pinned digest in QUALIFIED_RELEASES.

Common situations: Upstream changed the manifest format (for example switching to an OCI artifact index) without a version bump in this script's pinned digests; private registry mirrors serving substituted content; maintainers re-generating artifacts with new formatting for the same tag.

Related errors

AI-assisted analysis of affaan-m/ECC@06c5e118c4 (2026-08-18). Data as JSON: /api/errors/d692388bc59aa6b8. Report an issue: GitHub.