{"record":{"id":"a94b7797f65e812c","repo":"astrid-runtime/astrid","slug":"distro-lock-exceeds-1-mb-limit","errorCode":null,"errorMessage":"Distro.lock exceeds 1 MB limit","messagePattern":"Distro\\.lock exceeds 1 MB limit","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/init_signed_source.rs","lineNumber":200,"sourceCode":"async fn fetch_signed_manifest(\n    source: &str,\n    offline: bool,\n    accept_new_key: bool,\n    home: &AstridHome,\n) -> anyhow::Result<SignedDistroBundle> {\n    let source_path = PathBuf::from(source);\n    let local_manifest_path = source_path\n        .is_file()\n        .then(|| normalize_authenticated_manifest_path(&source_path))\n        .transpose()?;\n    let source = local_manifest_path\n        .as_deref()\n        .and_then(Path::to_str)\n        .map_or_else(|| source.to_owned(), str::to_owned);\n    let (manifest_bytes, manifest) = fetch_manifest_bytes(&source, offline).await?;\n    let manifest_hash = manifest_hash(&manifest_bytes);\n    let lock_bytes = fetch_signed_member(&source, offline, \"Distro.lock\").await?;\n    anyhow::ensure!(\n        lock_bytes.len() <= 1024 * 1024,\n        \"Distro.lock exceeds 1 MB limit\"\n    );\n    let lock_text = std::str::from_utf8(&lock_bytes).context(\"Distro.lock is not valid UTF-8\")?;\n    let lock: DistroLock =\n        toml::from_str(lock_text).context(\"failed to parse signed Distro.lock\")?;\n    let sig_bytes = fetch_signed_member(&source, offline, \"Distro.sig\").await?;\n    anyhow::ensure!(\n        sig_bytes.len() <= 64 * 1024,\n        \"Distro.sig exceeds size limit\"\n    );\n    let sig_hex = std::str::from_utf8(&sig_bytes).context(\"Distro.sig is not valid UTF-8\")?;\n    let pinned_refs = verify_signed_manifest(\n        home,\n        &manifest,\n        &manifest_hash,\n        &lock,\n        sig_hex,","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/init_signed_source.rs#L182-L218","documentation":"The signed lock member Distro.lock is size-checked against 1 MB after being fetched as part of `fetch_signed_manifest`. Like the manifest, the lock must be small enough to parse and verify safely; oversized locks are rejected before TOML parsing.","triggerScenarios":"`fetch_signed_manifest` calls `fetch_signed_member(&source, offline, \"Distro.lock\")` and then `ensure!(lock_bytes.len() <= 1024 * 1024, ...)`; bytes exceeding 1 MB raise the error. Triggered by a local directory containing a bloated Distro.lock or an upstream serving oversized lock content.","commonSituations":"A lock auto-generated with thousands of entries; wrong file placed at the Distro.lock path; a mirror serving the wrong artifact; accidentally committing large generated data into the lock.","solutions":["Regenerate Distro.lock so it only contains the needed capsules and stays under 1 MB","Inspect the local signed-source directory: ensure the file at that path is the real Distro.lock","Re-download the distro from the official source if a mirror serves corrupt/oversized content","Split oversized lock content into multiple distros/members"],"exampleFix":"// before: hand-grown Distro.lock of 4 MB\n$ astrid init-signed-source <src>\n// after\n$ astrid distro lock --trim   # regenerate a minimal signed lock\n$ astrid init-signed-source <src>","handlingStrategy":"try-catch","validationCode":"fn lock_bytes_ok(bytes: &[u8]) -> bool { bytes.len() <= 1024 * 1024 }","typeGuard":null,"tryCatchPattern":"match res {\n    Err(e) if e.to_string().contains(\"Distro.lock exceeds 1 MB limit\") => regenerate_minimal_lock(),\n    other => other,\n}","preventionTips":["Regenerate locks to include only needed capsules","Don't commit generated/bulk data into Distro.lock","Verify the local signed-source directory holds the genuine members","Check published artifact sizes in CI"],"tags":["cli","distro-lock","size-limit","validation"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}