{"record":{"id":"45ffc6c10f4c50a2","repo":"astrid-runtime/astrid","slug":"name-exceeds-size-limit","errorCode":null,"errorMessage":"{name} exceeds size limit","messagePattern":"(.+?) exceeds size limit","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/init_signed_source.rs","lineNumber":281,"sourceCode":"        .user_agent(\"astrid-cli\")\n        .timeout(std::time::Duration::from_secs(30))\n        .build()?;\n    let response = client\n        .get(url)\n        .send()\n        .await\n        .with_context(|| format!(\"failed to fetch {name}\"))?;\n    if !response.status().is_success() {\n        bail!(\n            \"failed to fetch {name} from {url} (HTTP {})\",\n            response.status()\n        );\n    }\n    let mut bytes = Vec::new();\n    let mut response = response;\n    while let Some(chunk) = response.chunk().await? {\n        bytes.extend_from_slice(&chunk);\n        anyhow::ensure!(bytes.len() <= limit, \"{name} exceeds size limit\");\n    }\n    Ok(bytes)\n}\n\n/// Bind exact TOML bytes into the signed lock, then verify that lock.\nfn verify_signed_manifest(\n    home: &AstridHome,\n    manifest: &DistroManifest,\n    manifest_hash: &str,\n    lock: &DistroLock,\n    sig_hex: &str,\n    accept_new_key: bool,\n) -> anyhow::Result<HashMap<String, String>> {\n    if lock.manifest_hash.as_deref() != Some(manifest_hash) {\n        bail!(\n            \"signed Distro.toml does not match Distro.lock manifest_hash; refusing to resolve members\"\n        );\n    }","sourceCodeStart":263,"sourceCodeEnd":299,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/init_signed_source.rs#L263-L299","documentation":"fetch_url_bytes streams the HTTP response in chunks and enforces a hard cap (1 MiB for signed source members) after every chunk, throwing this error as soon as the accumulated bytes exceed `limit`. This bounds memory usage so a compromised or misconfigured distro mirror cannot make the CLI buffer an unbounded body.","triggerScenarios":"Any fetch through fetch_url_bytes (fetch_manifest_bytes or fetch_signed_member) where the server returns a body larger than the 1 MiB limit — e.g. fetching Distro.toml, Distro.lock, or the .sig file whose size exceeds 1048576 bytes.","commonSituations":"A mirror serving an HTML error page/redirect loop with a large body, a proxy injecting content, or a legitimate distro whose manifest/signature grew past 1 MiB (very large capsule sets).","solutions":["Check what the URL actually returns — an oversized HTML error page from a misconfigured mirror is the usual culprit; fix the mirror URL","If the signed manifest legitimately exceeds 1 MiB, serve/split it differently or host it locally and use the local-file path in fetch_signed_member, which has no size limit","Investigate proxies/intermediaries that inflate response bodies"],"exampleFix":"// before: oversized body from wrong URL\nlet url = \"https://example.com/\"; // returns big HTML page\n// after\nlet url = \"https://mirror.example.com/distro/Distro.lock\";","handlingStrategy":"validation","validationCode":"// HEAD the URL and check Content-Length before a full fetch\nlet len = client.head(url).send().await?\n    .headers().get(reqwest::header::CONTENT_LENGTH)\n    .and_then(|v| v.to_str().ok())\n    .and_then(|v| v.parse::<usize>().ok());\nif let Some(n) = len { anyhow::ensure!(n <= 1024*1024, \"{name} would exceed 1 MiB\"); }","typeGuard":null,"tryCatchPattern":"match fetch_url_bytes(url, name, LIMIT).await {\n    Err(e) if e.to_string().ends_with(\"exceeds size limit\") => {\n        eprintln!(\"{name} is larger than the 1 MiB cap; check the URL returns the real file, not an error page\");\n    }\n    r => r?,\n}","preventionTips":["Point sources at the exact file URL, not a directory or error page","Monitor manifest growth; if a distro approaches 1 MiB, split capsules into separate signed manifests","Check proxies/CDN for body-injecting interstitials"],"tags":["network","http","size-limit"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}