{"record":{"id":"c325eb2ef7dc0e09","repo":"siyuan-note/siyuan","slug":"marketplace-package-manifest-not-found-or-invalid","errorCode":null,"errorMessage":"marketplace package manifest not found or invalid","messagePattern":"marketplace package manifest not found or invalid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/bazaar/install.go","lineNumber":175,"sourceCode":"\tdirs, err := os.ReadDir(unzipPath)\n\tif err != nil {\n\t\treturn\n\t}\n\n\tsrcPath := unzipPath\n\tif 1 == len(dirs) && dirs[0].IsDir() {\n\t\tsrcPath = filepath.Join(unzipPath, dirs[0].Name())\n\t}\n\n\t// 校验下载包自身声明的名称与请求安装的包名一致，防止把其他包的内容写入指定目录\n\t// https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj\n\tjsonFileName, ok := packageManifestNames[pkgType]\n\tif !ok {\n\t\treturn errors.New(\"invalid marketplace package type\")\n\t}\n\tpkg, parseErr := ParsePackageJSON(filepath.Join(srcPath, jsonFileName))\n\tif parseErr != nil || nil == pkg {\n\t\treturn errors.New(\"marketplace package manifest not found or invalid\")\n\t}\n\tif packageName != pkg.Name {\n\t\treturn fmt.Errorf(\"marketplace package name mismatch: expected [%s], got [%s]\", packageName, pkg.Name)\n\t}\n\n\tif err = filelock.Copy(srcPath, installPath); err != nil {\n\t\treturn\n\t}\n\treturn\n}\n\n// InstallLocalPackage 从已解压并验证的目录安装本地集市包。\nfunc InstallLocalPackage(sourcePath, installPath, pkgType, packageName string, update bool) (err error) {\n\tif err = os.MkdirAll(filepath.Dir(installPath), 0755); err != nil {\n\t\treturn\n\t}\n\n\tvar fallbackInstallTime time.Time","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/bazaar/install.go#L157-L193","documentation":"Returned by installPackage (kernel/bazaar/install.go:173-175) when ParsePackageJSON fails on the expected manifest file (e.g. plugin.json) inside the extracted package, or returns a nil result. This means the manifest JSON is either missing from the expected path, syntactically invalid, or structurally incomplete. It differs from error 131 (wrong pkgType) and error 133 (name mismatch) — here the file path was correct but the content is bad.","triggerScenarios":"The downloaded package zip is extracted, the correct manifest file name is computed from pkgType, but that file is missing from the expected location or contains invalid JSON / missing required fields.","commonSituations":"Corrupted download producing a partial zip; package author shipped a malformed manifest; the manifest file is in a subdirectory instead of the archive root or its single top-level directory; zip extraction produced an unexpected directory structure.","solutions":["Verify the package zip is well-formed by inspecting it manually before installing","Check that the manifest file (plugin.json, theme.json, etc.) exists at the archive root or in the single top-level directory","Report the issue to the package author if the manifest is genuinely malformed","Re-download the package — a corrupted download can produce this error"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"func verifyPackageManifest(srcPath, jsonFileName string) error {\n    pkg, err := bazaar.ParsePackageJSON(filepath.Join(srcPath, jsonFileName))\n    if err != nil || pkg == nil {\n        return fmt.Errorf(\"manifest %s is missing or invalid in the package\", jsonFileName)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Inspect the downloaded package zip structure before installing to confirm the manifest is at the expected location","Report malformed packages to their authors","Retry the download if the zip appears truncated or corrupt"],"tags":["bazaar","marketplace","install","manifest","validation","go"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}