{"record":{"id":"7fc040ad89bd003b","repo":"jdx/mise","slug":"encrypted-file-exceeds-the-size-limit-path","errorCode":null,"errorMessage":"encrypted file exceeds the size limit: {path}","messagePattern":"encrypted file exceeds the size limit: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/history/sync/files.rs","lineNumber":360,"sourceCode":"        bail!(\"unsupported encrypted file mode: {path}\");\n    }\n    let inner = Plaintext {\n        path: path.into(),\n        mode: mode.into(),\n        scheme: scheme.into(),\n        content: Bytes(content.to_vec()),\n    };\n    let bytes = rmp_serde::to_vec_named(&inner)?;\n    let outer = Envelope {\n        path: path.into(),\n        mode: mode.into(),\n        scheme: scheme.into(),\n        ciphertext: Bytes(agecrypt::encrypt_bytes(&bytes, recipients)?),\n    };\n    let mut encoded = MAGIC.to_vec();\n    encoded.extend(rmp_serde::to_vec_named(&outer)?);\n    if encoded.len() as u64 > agecrypt::MAX_ENCRYPTED_BYTES {\n        bail!(\"encrypted file exceeds the size limit: {path}\");\n    }\n    Ok(encoded)\n}\n\n#[cfg(test)]\nmod tests {\n    #[test]\n    fn audit_reuses_verified_ancestry_but_rechecks_new_encryption_policy() {\n        use crate::system::history::manifest::{Enrollment, Manifest};\n        let tmp = tempfile::tempdir().unwrap();\n        let repo = HistoryRepo::open_or_init_in(tmp.path()).unwrap().unwrap();\n        let tree = repo\n            .write_tree(&[(\n                \"100644\".into(),\n                repo.hash_blob(b\"plain\").unwrap(),\n                \"home/secret\".into(),\n            )])\n            .unwrap();","sourceCodeStart":342,"sourceCodeEnd":378,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/system/history/sync/files.rs#L342-L378","documentation":"After building the outer envelope (magic prefix + msgpack of path/mode/scheme/ciphertext), encode() enforces agecrypt::MAX_ENCRYPTED_BYTES. Encrypted blobs larger than this limit are rejected, keeping history objects within a size budget. This surfaces when a user tries to sync a very large file through encrypted dotfiles.","triggerScenarios":"Calling encrypt()/encode() on content whose resulting encoded envelope exceeds agecrypt::MAX_ENCRYPTED_BYTES (age overhead makes the output slightly larger than the plaintext).","commonSituations":"Syncing large binaries, VM images, databases, or media files as encrypted dotfiles; accumulating many secrets in one file.","solutions":["Exclude the large file from encrypted sync and store it elsewhere (git-lfs, cloud storage, artifact store).","Split the content into smaller files under the size limit.","Trim the file's content — e.g. keep only needed secrets, not full dumps."],"exampleFix":"# before\ndotfiles.sources = [\"~/backups/db.dump\"]\n# after\ndotfiles.sources = [\"~/.gitconfig\", \"~/.ssh/config\"]  # large files excluded","handlingStrategy":"validation","validationCode":"if content.len() as u64 + AGE_OVERHEAD > agecrypt::MAX_ENCRYPTED_BYTES {\n    return Err(anyhow!(\"{path} too large to encrypt\"));\n}","typeGuard":null,"tryCatchPattern":"match encrypt(path, mode, content, scheme, recipients) {\n    Ok(bytes) => Ok(bytes),\n    Err(e) if e.to_string().contains(\"exceeds the size limit\") => {\n        eprintln!(\"{path} too large; excluding from encrypted sync\");\n        Ok(())\n    }\n    Err(e) => Err(e),\n}","preventionTips":["Check file sizes before adding sources to encrypted sync.","Keep large binaries in dedicated storage (git-lfs, object storage), not dotfile sync.","Periodically audit encrypted sources for files that grew past the limit."],"tags":["encryption","size-limit","payload"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}