{"record":{"id":"b908512080ee9a0f","repo":"k3s-io/k3s","slug":"error-extracting-zstd-compressed-body-v","errorCode":null,"errorMessage":"error extracting zstd-compressed body: %v","messagePattern":"error extracting zstd-compressed body: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/untar/untar.go","lineNumber":44,"sourceCode":"\n// Untar reads the zstd-compressed tar file from r and writes it into dir.\nfunc Untar(r io.Reader, dir string) error {\n\treturn untar(r, dir)\n}\n\nfunc untar(r io.Reader, dir string) (err error) {\n\tt0 := time.Now()\n\tnFiles := 0\n\tmadeDir := map[string]bool{}\n\tdefer func() {\n\t\ttd := time.Since(t0)\n\t\tif err != nil {\n\t\t\tlogrus.Printf(\"error extracting tarball into %s after %d files, %d dirs, %v: %v\", dir, nFiles, len(madeDir), td, err)\n\t\t}\n\t}()\n\tzr, err := zstd.NewReader(r, zstd.WithDecoderMaxMemory(tarfile.MaxDecoderMemory))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error extracting zstd-compressed body: %v\", err)\n\t}\n\tdefer zr.Close()\n\ttr := tar.NewReader(zr)\n\tloggedChtimesError := false\n\tfor {\n\t\tf, err := tr.Next()\n\t\tif err == io.EOF {\n\t\t\tbreak\n\t\t}\n\t\tif err != nil {\n\t\t\tlogrus.Printf(\"tar reading error: %v\", err)\n\t\t\treturn fmt.Errorf(\"tar error: %v\", err)\n\t\t}\n\t\tif !validRelPath(f.Name) {\n\t\t\treturn fmt.Errorf(\"tar contained invalid name error %q\", f.Name)\n\t\t}\n\t\trel := filepath.FromSlash(f.Name)\n\t\tabs := filepath.Join(dir, rel)","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/untar/untar.go#L26-L62","documentation":"On first boot (or upgrade) k3s extracts the data-dir payload embedded in the binary (data.Asset -> untar.Untar at cmd/k3s/main.go:303). The payload is a zstd-compressed tarball; k3s zstd.Newreader is created with a hard decode-memory cap (tarfile.MaxDecoderMemory). This error means the zstd stream itself could not be initialized: the data is not valid zstd, is truncated, or would require more than the decoder memory cap.","triggerScenarios":"Startup calls untar() and zstd.NewReader(r, WithDecoderMaxMemory(...)) fails: the embedded build asset is corrupt (truncated or bit-flipped binary), the binary was modified/repacked improperly, or the compressed stream declares window sizes exceeding the decoder limit.","commonSituations":"A k3s binary downloaded partially or corrupted in transit; binaries rebuilt/repacked with a modified or incompatible embedded data blob; filesystem-level corruption on the binary's storage; extremely uncommon on official release artifacts.","solutions":["Verify the binary checksum against the release's sha256sums file; re-download and replace on mismatch.","Check disk/filesystem health on the node (dmesg for I/O errors) if checksums pass locally but corruption recurs.","If building from source, ensure the embedded data asset generation completed (make) before the final link.","After replacing the binary, clear any half-extracted '<data-dir>-tmp' leftovers and restart k3s."],"exampleFix":"# before\ncurl -LO https://.../k3s  # interrupted transfer\n./k3s server  # error extracting zstd-compressed body\n\n# after\nsha256sum -c sha256sums.txt  # or re-download\n./k3s server","handlingStrategy":"validation","validationCode":"// Verify the binary before first start\n// sha256sum k3s; compare with official sha256sums.txt for the release\nif !checksumMatches(\"k3s\", wantSHA) {\n    log.Fatal(\"k3s binary checksum mismatch - redownload\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Checksum-verify every k3s binary download in CI/CD and provisioning","Download over reliable links and re-verify after transfer","Do not strip/patch the k3s binary - the embedded payload must stay intact"],"tags":["zstd","tar","startup","integrity"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}