{"record":{"id":"b3d384bdb26f3176","repo":"unslothai/unsloth","slug":"the-pinned-spec-name-archive-is-too-large","errorCode":null,"errorMessage":"The pinned {spec.name} archive is too large","messagePattern":"The pinned (.+?) archive is too large","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"studio/backend/utils/third_party_source.py","lineNumber":571,"sourceCode":"    request = urllib.request.Request(url, headers = {\"User-Agent\": \"Unsloth-Studio\"})\n    deadline = time.monotonic() + _ARCHIVE_DOWNLOAD_DEADLINE_SECONDS\n    try:\n        if time.monotonic() >= deadline:\n            raise RuntimeError(f\"Timed out downloading the pinned {spec.name} source archive\")\n        with urllib.request.urlopen(\n            request,\n            timeout = _ARCHIVE_SOCKET_TIMEOUT_SECONDS,\n        ) as response:\n            if time.monotonic() >= deadline:\n                raise RuntimeError(f\"Timed out downloading the pinned {spec.name} source archive\")\n            content_length = response.headers.get(\"Content-Length\")\n            if content_length is not None:\n                try:\n                    advertised_size = int(content_length)\n                except ValueError as error:\n                    raise RuntimeError(f\"Invalid {spec.name} archive response size\") from error\n                if advertised_size < 0 or advertised_size > _ARCHIVE_MAX_DOWNLOAD_BYTES:\n                    raise RuntimeError(f\"The pinned {spec.name} archive is too large\")\n            total = 0\n            read_chunk = getattr(response, \"read1\", None)\n            if not callable(read_chunk):\n                read_chunk = response.read\n            with destination.open(\"wb\") as handle:\n                while True:\n                    if time.monotonic() >= deadline:\n                        raise RuntimeError(\n                            f\"Timed out downloading the pinned {spec.name} source archive\"\n                        )\n                    chunk = read_chunk(1024 * 1024)\n                    if time.monotonic() >= deadline:\n                        raise RuntimeError(\n                            f\"Timed out downloading the pinned {spec.name} source archive\"\n                        )\n                    if not chunk:\n                        break\n                    total += len(chunk)","sourceCodeStart":553,"sourceCodeEnd":589,"githubUrl":"https://github.com/unslothai/unsloth/blob/203007d19051dcd2ae33876786d117c99f6b0368/studio/backend/utils/third_party_source.py#L553-L589","documentation":"Raised while downloading a pinned third-party source archive when the server's Content-Length header advertises a negative size or one exceeding _ARCHIVE_MAX_DOWNLOAD_BYTES. This is a pre-flight guard: the library refuses to start (or continue) a download that would exceed the configured byte budget. It exists to protect the host from oversized or malicious archives before any bytes are written to disk.","triggerScenarios":"A HEAD/GET response for spec.archive_url returns Content-Length > _ARCHIVE_MAX_DOWNLOAD_BYTES (or a parseable negative value). Happens when the pinned URL points to a bloated tarball, a wrong artifact, or a compromised/hostile mirror that lies about size.","commonSituations":"Bumping a dependency to a version whose source tarball is larger than the built-in cap; accidentally pinning archive_url to a full repository bundle or binary SDK instead of the slim source tarball; a proxy injecting a bogus Content-Length.","solutions":["Verify spec.archive_url points at the intended slim source tarball (e.g. the codeload GitHub tar.gz for the pinned revision), not a full bundle or release asset with binaries","Check the advertised size with curl -I <archive_url> and compare against the library's _ARCHIVE_MAX_DOWNLOAD_BYTES constant","If the larger archive is legitimately required, raise _ARCHIVE_MAX_DOWNLOAD_BYTES in your fork/config after confirming the digest still matches spec.source_tree_digest","If the size looks malicious or the URL was repointed, update the pin (revision + source_tree_digest) to a trusted URL"],"exampleFix":"// before\nPinnedSource(\n    name=\"foo\",\n    package=\"foo\",\n    revision=\"1a2b3c4d5e6f7890abcdef1234567890abcdef12\",\n    archive_url=\"https://example.com/foo-full-repo-bundle.tar.gz\",  # oversized artifact\n    source_tree_digest=\"...\",\n)\n\n// after\nPinnedSource(\n    name=\"foo\",\n    package=\"foo\",\n    revision=\"1a2b3c4d5e6f7890abcdef1234567890abcdef12\",\n    archive_url=\"https://codeload.github.com/org/foo/tar.gz/1a2b3c4d5e6f7890abcdef1234567890abcdef12\",\n    source_tree_digest=\"...\",\n)","handlingStrategy":"validation","validationCode":"import urllib.request\nfrom studio.backend.utils.third_party_source import _ARCHIVE_MAX_DOWNLOAD_BYTES\n\nreq = urllib.request.Request(spec.archive_url, method=\"HEAD\")\nwith urllib.request.urlopen(req, timeout=30) as r:\n    length = int(r.headers.get(\"Content-Length\", 0))\nassert 0 <= length <= _ARCHIVE_MAX_DOWNLOAD_BYTES, f\"archive too large: {length}\"","typeGuard":"def archive_size_ok(spec) -> bool:\n    if spec.archive_url is None:\n        return False\n    with urllib.request.urlopen(urllib.request.Request(spec.archive_url, method=\"HEAD\"), timeout=30) as r:\n        cl = r.headers.get(\"Content-Length\")\n    return cl is None or (cl.isdigit() and int(cl) <= _ARCHIVE_MAX_DOWNLOAD_BYTES)","tryCatchPattern":"try:\n    ensure_pinned_source(spec)\nexcept RuntimeError as e:\n    if \"archive is too large\" in str(e):\n        # fix the pin (wrong artifact) rather than retry","preventionTips":["Pin archive_url to canonical per-commit source tarballs (codeload), never to release bundles or repo snapshots","Record the expected archive byte size next to the pin and verify it in CI before deploying"],"tags":["network","download","size-limit","pinned-source","supply-chain"],"backgroundTag":null,"analyzedSha":"203007d19051dcd2ae33876786d117c99f6b0368","analyzedAt":"2026-08-15T02:48:39.846Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}