{"record":{"id":"cd2e6db06bbb450c","repo":"astrid-runtime/astrid","slug":"distro-toml-exceeds-1-mb-limit","errorCode":null,"errorMessage":"Distro.toml exceeds 1 MB limit","messagePattern":"Distro\\.toml exceeds 1 MB limit","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/init_signed_source.rs","lineNumber":175,"sourceCode":"            std::fs::read(path).with_context(|| format!(\"failed to read {}\", path.display()))?;\n        return parse_manifest_bytes(bytes);\n    }\n\n    if offline {\n        bail!(\n            \"--offline: '{source}' is not a local file and network fetch is forbidden \\\n             (use a Distro.toml path or a .shuttle archive)\"\n        );\n    }\n\n    let url = super::resolve_distro_url(source)?;\n    eprintln!(\"Fetching Distro.toml...\");\n    let bytes = fetch_url_bytes(&url, \"Distro.toml\", 1024 * 1024).await?;\n    parse_manifest_bytes(bytes)\n}\n\nfn parse_manifest_bytes(bytes: Vec<u8>) -> anyhow::Result<(Vec<u8>, DistroManifest)> {\n    anyhow::ensure!(bytes.len() <= 1024 * 1024, \"Distro.toml exceeds 1 MB limit\");\n    let content = std::str::from_utf8(&bytes).context(\"Distro.toml is not valid UTF-8\")?;\n    let manifest = parse_manifest(content)?;\n    Ok((bytes, manifest))\n}\n\n/// Fetch the signed TOML, its maintainer lock, and existing lock signature.\nasync fn fetch_signed_manifest(\n    source: &str,\n    offline: bool,\n    accept_new_key: bool,\n    home: &AstridHome,\n) -> anyhow::Result<SignedDistroBundle> {\n    let source_path = PathBuf::from(source);\n    let local_manifest_path = source_path\n        .is_file()\n        .then(|| normalize_authenticated_manifest_path(&source_path))\n        .transpose()?;\n    let source = local_manifest_path","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/init_signed_source.rs#L157-L193","documentation":"Fetched Distro.toml bytes are size-checked against a 1 MB limit before parsing. The distro manifest must stay small enough to be safely fetched, hashed, and parsed; anything larger is rejected as suspicious or malformed. This guard runs in `parse_manifest_bytes` even when the fetch already applied its own limit.","triggerScenarios":"`parse_manifest_bytes` is called with bytes longer than 1,048,576 (fetch_url_bytes with cap 1024*1024, or direct invocation with oversized bytes), so `ensure!(bytes.len() <= 1024 * 1024)` fails.","commonSituations":"Pointing the distro source at the wrong (very large) file served as Distro.toml; a proxy/mirror returning an HTML error page or huge body; corrupt URL handler streaming beyond the cap.","solutions":["Verify the source URL/file actually serves the Distro.toml (small valid TOML), not an error page or wrong artifact","Check the distro source configuration (URL or local path) for typos","Inspect the served content size with curl/ls and fix the upstream artifact","If you genuinely need a larger manifest, restructure it (split into lock/members) rather than raising the limit"],"exampleFix":"# before\nsource = \"https://mirror.example/distro\"   # serves 3 MB HTML page\n# after\nsource = \"https://distro.example/latest\"  # serves valid Distro.toml < 1 MB","handlingStrategy":"try-catch","validationCode":"fn manifest_bytes_ok(bytes: &[u8]) -> bool { bytes.len() <= 1024 * 1024 }\n// check before invoking the fetch/parse path","typeGuard":null,"tryCatchPattern":"match res {\n    Err(e) if e.to_string().contains(\"exceeds 1 MB limit\") => verify_source_artifact(),\n    other => other,\n}","preventionTips":["Verify the source URL serves the real Distro.toml, not error pages","Check artifact sizes upstream before publishing","Keep manifests small; move bulk data into lock members","Add a pre-flight size check in CI for published manifests"],"tags":["cli","distro-toml","size-limit","validation"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}