{"record":{"id":"12e611117b1e6dd3","repo":"affaan-m/ECC","slug":"nasiko-manifest-layer-size-is-outside-the-allowed","errorCode":null,"errorMessage":"Nasiko manifest layer size is outside the allowed range.","messagePattern":"Nasiko manifest layer size is outside the allowed range\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"scripts/lib/nasiko-release.js","lineNumber":71,"sourceCode":"\nfunction assertDigest(bytes, expectedDigest, label) {\n  if (!SHA256_PATTERN.test(expectedDigest)) throw new Error(`${label} has an invalid expected digest.`);\n  const actual = digestBytes(bytes);\n  if (actual !== expectedDigest) throw new Error(`${label} digest mismatch: expected ${expectedDigest}, got ${actual}.`);\n}\n\nfunction validateManifest(bytes) {\n  let manifest;\n  try { manifest = JSON.parse(bytes.toString('utf8')); } catch (_error) { throw new Error('Nasiko manifest is not valid JSON.'); }\n  if (manifest.schemaVersion !== 2 || !Array.isArray(manifest.layers) || manifest.layers.length !== 1) {\n    throw new Error('Nasiko manifest must contain exactly one OCI layer.');\n  }\n  const layer = manifest.layers[0];\n  if (layer.mediaType !== 'application/gzip' || !SHA256_PATTERN.test(layer.digest)) {\n    throw new Error('Nasiko manifest layer is not a qualified gzip artifact.');\n  }\n  if (!Number.isSafeInteger(layer.size) || layer.size <= 0 || layer.size > MAX_ARCHIVE_BYTES) {\n    throw new Error('Nasiko manifest layer size is outside the allowed range.');\n  }\n  return { digest: layer.digest, size: layer.size };\n}\n\nfunction readTarString(block, offset, length) {\n  return block.subarray(offset, offset + length).toString('utf8').replace(/\\0.*$/, '');\n}\n\nfunction readTarOctal(block, offset, length) {\n  const field = block.subarray(offset, offset + length).toString('ascii');\n  const match = /^ *([0-7]+)[ \\0]*$/.exec(field);\n  if (!match) throw new Error('Unsafe Nasiko archive: invalid tar size field.');\n  const size = Number.parseInt(match[1], 8);\n  if (!Number.isSafeInteger(size) || size < 0) {\n    throw new Error('Unsafe Nasiko archive: invalid tar size field.');\n  }\n  return size;\n}","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/affaan-m/ECC/blob/8321021c54d670126ce3b2969d5deb880b4b0c2a/scripts/lib/nasiko-release.js#L53-L89","documentation":"validateManifest bounds the declared layer size: it must be a safe positive integer no larger than MAX_ARCHIVE_BYTES. The error is thrown when the size field is missing, non-numeric, zero/negative, or exceeds the configured limit — protecting the installer from absurd or corrupted size declarations before it allocates or downloads anything.","triggerScenarios":"layers[0].size is undefined/NaN/string in the manifest, is 0 or negative, or declares a value above MAX_ARCHIVE_BYTES (e.g. pointing at a huge image instead of the compact Nasiko artifact).","commonSituations":"Hand-edited manifest with a missing size key, publisher tool that omits size on some layers, accidentally targeting a full OS image, or a corrupted manifest transfer.","solutions":["Log manifest.layers[0] and confirm the size key exists and is a number.","Check the declared size against MAX_ARCHIVE_BYTES and confirm you selected the correct small release artifact, not a full container image.","Republish or re-export the manifest with a correct integer size field if you control the artifact.","If size is legitimately larger than the limit, the library cannot install it — use a different distribution path."],"exampleFix":"// before\nvalidateManifest(manifestBytes);\n// after\nconst layer = JSON.parse(manifestBytes.toString('utf8')).layers[0];\nif (!Number.isSafeInteger(layer.size) || layer.size <= 0) {\n  throw new Error(`manifest size invalid: ${JSON.stringify(layer.size)} — republish artifact`);\n}\nvalidateManifest(manifestBytes);","handlingStrategy":"validation","validationCode":"const layer = JSON.parse(manifestBytes.toString('utf8')).layers[0];\nif (!Number.isSafeInteger(layer.size) || layer.size <= 0 || layer.size > MAX_ARCHIVE_BYTES) throw new Error('layer.size out of allowed range');","typeGuard":"const hasValidSize = (l) => Number.isSafeInteger(l?.size) && l.size > 0;","tryCatchPattern":"try { installNasiko(opts); } catch (e) { if (e.message.includes('size is outside the allowed range')) console.error('declared size invalid or artifact too large'); throw e; }","preventionTips":["Never hand-edit manifest size fields; let the publisher tool compute them.","Check artifact size against the limit before publishing.","Prefer digest-pinned references to avoid resolving oversized wrong artifacts."],"tags":["validation","size-limit","oci"],"backgroundTag":"value-out-of-range","analyzedSha":"8321021c54d670126ce3b2969d5deb880b4b0c2a","analyzedAt":"2026-09-16T10:08:13.343Z","contentChangedAt":"2026-09-16T10:08:13.343Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}