astrid-runtime/astrid · error

Distro.lock exceeds 1 MB limit

Error message

Distro.lock exceeds 1 MB limit

What it means

The signed lock member Distro.lock is size-checked against 1 MB after being fetched as part of `fetch_signed_manifest`. Like the manifest, the lock must be small enough to parse and verify safely; oversized locks are rejected before TOML parsing.

Source

Thrown at crates/astrid-cli/src/commands/init_signed_source.rs:200

async fn fetch_signed_manifest(
    source: &str,
    offline: bool,
    accept_new_key: bool,
    home: &AstridHome,
) -> anyhow::Result<SignedDistroBundle> {
    let source_path = PathBuf::from(source);
    let local_manifest_path = source_path
        .is_file()
        .then(|| normalize_authenticated_manifest_path(&source_path))
        .transpose()?;
    let source = local_manifest_path
        .as_deref()
        .and_then(Path::to_str)
        .map_or_else(|| source.to_owned(), str::to_owned);
    let (manifest_bytes, manifest) = fetch_manifest_bytes(&source, offline).await?;
    let manifest_hash = manifest_hash(&manifest_bytes);
    let lock_bytes = fetch_signed_member(&source, offline, "Distro.lock").await?;
    anyhow::ensure!(
        lock_bytes.len() <= 1024 * 1024,
        "Distro.lock exceeds 1 MB limit"
    );
    let lock_text = std::str::from_utf8(&lock_bytes).context("Distro.lock is not valid UTF-8")?;
    let lock: DistroLock =
        toml::from_str(lock_text).context("failed to parse signed Distro.lock")?;
    let sig_bytes = fetch_signed_member(&source, offline, "Distro.sig").await?;
    anyhow::ensure!(
        sig_bytes.len() <= 64 * 1024,
        "Distro.sig exceeds size limit"
    );
    let sig_hex = std::str::from_utf8(&sig_bytes).context("Distro.sig is not valid UTF-8")?;
    let pinned_refs = verify_signed_manifest(
        home,
        &manifest,
        &manifest_hash,
        &lock,
        sig_hex,

View on GitHub (pinned to affd8760f4)

Solutions

1. Regenerate Distro.lock so it only contains the needed capsules and stays under 1 MB
2. Inspect the local signed-source directory: ensure the file at that path is the real Distro.lock
3. Re-download the distro from the official source if a mirror serves corrupt/oversized content
4. Split oversized lock content into multiple distros/members

Example fix

// before: hand-grown Distro.lock of 4 MB
$ astrid init-signed-source <src>
// after
$ astrid distro lock --trim   # regenerate a minimal signed lock
$ astrid init-signed-source <src>

fn lock_bytes_ok(bytes: &[u8]) -> bool { bytes.len() <= 1024 * 1024 }

match res {
    Err(e) if e.to_string().contains("Distro.lock exceeds 1 MB limit") => regenerate_minimal_lock(),
    other => other,
}

When it happens

Trigger: `fetch_signed_manifest` calls `fetch_signed_member(&source, offline, "Distro.lock")` and then `ensure!(lock_bytes.len() <= 1024 * 1024, ...)`; bytes exceeding 1 MB raise the error. Triggered by a local directory containing a bloated Distro.lock or an upstream serving oversized lock content.

Common situations: A lock auto-generated with thousands of entries; wrong file placed at the Distro.lock path; a mirror serving the wrong artifact; accidentally committing large generated data into the lock.

Understand the failure class

Background: "File too large" / "file size exceeds limit" errors: why libraries cap file sizes and how to fix them — this error's family across 46 libraries.

Related errors

• Distro.lock capsule '{capsule}' has an invalid BLAKE3 hash
• Distro.toml exceeds 1 MB limit
• Distro.sig exceeds size limit
• --retain-entries must be at least 1
• --retain-bytes must be greater than 0

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/a94b7797f65e812c. Report an issue: GitHub.