{"record":{"id":"0b27c96e275ecf74","repo":"siyuan-note/siyuan","slug":"invalid-bazaar-index-package-s","errorCode":null,"errorMessage":"invalid bazaar index package: %s","messagePattern":"invalid bazaar index package: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/bazaar/index.go","lineNumber":235,"sourceCode":"\t\t}\n\t\tif \"\" == strings.TrimSpace(ret.meta.Generation) || 1 > ret.meta.PublishedAt {\n\t\t\treturn nil, errors.New(\"invalid bazaar index generation metadata\")\n\t\t}\n\t\tif bazaarIndexSchema < ret.meta.Schema {\n\t\t\tret.meta.RatingsAvailable = false\n\t\t} else {\n\t\t\tif !hasPackages {\n\t\t\t\treturn nil, errors.New(\"incomplete bazaar index metadata\")\n\t\t\t}\n\t\t\tif err = json.Unmarshal(packagesRaw, &ret.packages); nil != err {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tif nil == ret.packages {\n\t\t\t\treturn nil, errors.New(\"invalid bazaar index packages\")\n\t\t\t}\n\t\t\tfor packageName, pkg := range ret.packages {\n\t\t\t\tif !IsValidPackageName(packageName) || nil == pkg || !isValidBazaarRepo(pkg.Repo) || 0 > pkg.Downloads {\n\t\t\t\t\treturn nil, fmt.Errorf(\"invalid bazaar index package: %s\", packageName)\n\t\t\t\t}\n\t\t\t\tif nil != pkg.Rating {\n\t\t\t\t\trating, valid := normalizePackageRating(pkg.Rating)\n\t\t\t\t\tif !valid {\n\t\t\t\t\t\treturn nil, fmt.Errorf(\"invalid bazaar package rating: %s\", packageName)\n\t\t\t\t\t}\n\t\t\t\t\tpkg.Rating = rating\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t} else if hasPackages {\n\t\treturn nil, errors.New(\"incomplete bazaar index metadata\")\n\t}\n\n\tif !hasMeta || 2 == ret.meta.Schema || bazaarIndexSchema < ret.meta.Schema {\n\t\tfor rawRepo, rawStats := range raw {\n\t\t\tif \"meta\" == rawRepo || \"packages\" == rawRepo {\n\t\t\t\tcontinue","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/8641553a1f07374001902d3ce773285db1292b2d/kernel/bazaar/index.go#L217-L253","documentation":"Each entry of the packages map must have a valid package name, a non-nil package object, a well-formed repo (owner/repo in the allowed bazaar set), and non-negative downloads. The first entry violating any of these aborts the whole parse with the offending package name embedded in the message — the index is treated as trusted data and one bad entry invalidates it entirely.","triggerScenarios":"parseBazaarIndex iterates ret.packages and hits an entry where the key fails IsValidPackageName, the value is null, pkg.Repo fails isValidBazaarRepo (wrong owner/repo format or unexpected host), or pkg.Downloads < 0.","commonSituations":"A package published with a renamed/invalid repo slug; negative download counts from a stats-corruption bug on the server; a null entry produced by a serialization bug; unicode or path-like names that fail the package-name validation.","solutions":["Identify the offending package from the message and fix its index entry server-side (correct repo string, non-negative downloads, non-null object)","Check the publisher's stats pipeline for how downloads could go negative and clamp at 0","Ensure every listed repo is a valid bazaar repo (correct owner/repo form accepted by isValidBazaarRepo)","If it is a test fixture problem, regenerate fixtures with valid names/repos"],"exampleFix":"// index entry, before\n\"my-plugin\": {\"repo\": \"wrong-owner/my-plugin\", \"downloads\": -3}\n// after\n\"my-plugin\": {\"repo\": \"owner/my-plugin\", \"downloads\": 0}","handlingStrategy":"validation","validationCode":"// validate each package entry before publishing\nfor name, pkg := range packages {\n    if !IsValidPackageName(name) || pkg == nil || !isValidBazaarRepo(pkg.Repo) || pkg.Downloads < 0 {\n        return fmt.Errorf(\"bad index entry: %s\", name)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n    var m string\n    if fmt.Sprint(err) != \"\" && strings.HasPrefix(fmt.Sprint(err), \"invalid bazaar index package:\") {\n        name := strings.TrimPrefix(fmt.Sprint(err), \"invalid bazaar index package: \")\n        // quarantine/name the offending package in monitoring\n    }\n    _ = m\n}","preventionTips":["Run the same validation (IsValidPackageName, isValidBazaarRepo, downloads >= 0) on the server before publishing","Clamp download counters at zero to prevent negative values from stats bugs","Keep the package registry (names, repo slugs) consistent with what isValidBazaarRepo accepts"],"tags":["marketplace","validation","data-integrity"],"backgroundTag":"invalid-argument-value","analyzedSha":"8641553a1f07374001902d3ce773285db1292b2d","analyzedAt":"2026-09-11T16:08:28.414Z","contentChangedAt":"2026-09-11T16:08:28.414Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}