{"record":{"id":"ebad9f39f571eb49","repo":"astrid-runtime/astrid","slug":"distro-sig-exceeds-size-limit","errorCode":null,"errorMessage":"Distro.sig exceeds size limit","messagePattern":"Distro\\.sig exceeds size limit","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/init_signed_source.rs","lineNumber":208,"sourceCode":"        .is_file()\n        .then(|| normalize_authenticated_manifest_path(&source_path))\n        .transpose()?;\n    let source = local_manifest_path\n        .as_deref()\n        .and_then(Path::to_str)\n        .map_or_else(|| source.to_owned(), str::to_owned);\n    let (manifest_bytes, manifest) = fetch_manifest_bytes(&source, offline).await?;\n    let manifest_hash = manifest_hash(&manifest_bytes);\n    let lock_bytes = fetch_signed_member(&source, offline, \"Distro.lock\").await?;\n    anyhow::ensure!(\n        lock_bytes.len() <= 1024 * 1024,\n        \"Distro.lock exceeds 1 MB limit\"\n    );\n    let lock_text = std::str::from_utf8(&lock_bytes).context(\"Distro.lock is not valid UTF-8\")?;\n    let lock: DistroLock =\n        toml::from_str(lock_text).context(\"failed to parse signed Distro.lock\")?;\n    let sig_bytes = fetch_signed_member(&source, offline, \"Distro.sig\").await?;\n    anyhow::ensure!(\n        sig_bytes.len() <= 64 * 1024,\n        \"Distro.sig exceeds size limit\"\n    );\n    let sig_hex = std::str::from_utf8(&sig_bytes).context(\"Distro.sig is not valid UTF-8\")?;\n    let pinned_refs = verify_signed_manifest(\n        home,\n        &manifest,\n        &manifest_hash,\n        &lock,\n        sig_hex,\n        accept_new_key,\n    )?;\n\n    Ok(SignedDistroBundle {\n        manifest,\n        lock,\n        manifest_hash,\n        pinned_refs,","sourceCodeStart":190,"sourceCodeEnd":226,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/init_signed_source.rs#L190-L226","documentation":"The signature member Distro.sig is size-checked against 64 KB. A valid signature blob (hex-encoded signature) is tiny; anything larger cannot be a legitimate signature and is rejected before hex/UTF-8 parsing and signature verification.","triggerScenarios":"`fetch_signed_manifest` calls `fetch_signed_member(..., \"Distro.sig\")` and then `ensure!(sig_bytes.len() <= 64 * 1024, ...)`; bytes over 64 KB raise the error. Occurs when the sig path contains the wrong file or a mirror returns oversized content.","commonSituations":"Overwriting Distro.sig with a log or binary by mistake; upstream publishing a malformed sig member; confusion between local directory mode and remote fetch mode so the wrong file is read.","solutions":["Verify the file at the Distro.sig path is the actual hex signature and restore the correct one if overwritten","Re-fetch the signed source (manifest, lock, sig) from the maintainer's official location","Regenerate the signature with the maintainer signing tool if it was corrupted locally","Check the local source directory for accidental large files named Distro.sig"],"exampleFix":"# before\n$ head -c 100000 Distro.sig   # giant wrong file\n# after\n$ astrid distro sign > Distro.sig   # regenerate proper signature blob","handlingStrategy":"try-catch","validationCode":"fn sig_bytes_ok(bytes: &[u8]) -> bool { bytes.len() <= 64 * 1024 }","typeGuard":null,"tryCatchPattern":"match res {\n    Err(e) if e.to_string().contains(\"Distro.sig exceeds size limit\") => refetch_or_resign_source(),\n    other => other,\n}","preventionTips":["Never place non-signature files at the Distro.sig path","Re-fetch all signed members together from the official source","Regenerate signatures after any local corruption","Validate sig files (hex, small size) before distribution"],"tags":["cli","signature","size-limit","validation"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}