astrid-runtime/astrid · error

release contains too many assets

Error message

release contains too many assets

What it means

exact_asset_url enforces a hard cap (MAX_RELEASE_ASSETS) on the number of assets a release may contain, as a supply-chain guard so pathological or hostile releases cannot blow up matching logic. A release whose assets array exceeds the limit throws this error.

Source

Thrown at crates/astrid-cli/src/commands/self_update/mod.rs:309

    if method.manages_own_binary() {
        return UpdatePlan::DeferToManager {
            manager: method.label(),
            how: method.upgrade_command(channel),
        };
    }
    UpdatePlan::ApplyInPlace
}

/// Find exactly one release asset and return its browser download URL.
pub(super) fn exact_asset_url<'a>(
    release: &'a serde_json::Value,
    name: &str,
) -> anyhow::Result<&'a str> {
    let assets = release
        .get("assets")
        .and_then(serde_json::Value::as_array)
        .ok_or_else(|| anyhow::anyhow!("release has no asset list"))?;
    anyhow::ensure!(
        assets.len() <= MAX_RELEASE_ASSETS,
        "release contains too many assets"
    );
    let mut matches = assets
        .iter()
        .filter(|asset| asset.get("name").and_then(|value| value.as_str()) == Some(name));
    let asset = matches
        .next()
        .ok_or_else(|| anyhow::anyhow!("release has no asset '{name}'"))?;
    anyhow::ensure!(
        matches.next().is_none(),
        "release contains duplicate asset '{name}'"
    );
    asset
        .get("browser_download_url")
        .and_then(|value| value.as_str())
        .filter(|url| !url.is_empty())
        .ok_or_else(|| anyhow::anyhow!("release asset '{name}' has no download URL"))

View on GitHub (pinned to affd8760f4)

Solutions

1. Inspect the release on GitHub and remove excess/stray assets so it is within the cap.
2. Fix the publish workflow to upload only the intended artifacts per release.
3. If pointing at a fork via ASTRID_UPDATE_REPO, switch back to the official repo whose releases conform.
4. Verify the release is authentic (expected signer/tag) — an inflated asset list can indicate tampering.

// pre-check release size before update
const assets = release.assets ?? [];
if (assets.length > 50) throw new Error("release asset list suspiciously large");

When it happens

Trigger: A release fetched by tag contains more than MAX_RELEASE_ASSETS entries and any consumer calls exact_asset_url against it.

Common situations: Publishing pipelines accidentally attaching hundreds of artifacts to one release; a tampered or third-party release source (via ASTRID_UPDATE_REPO pointing elsewhere) with an inflated asset list.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• release contains duplicate asset '{name}'
• release has no asset list
• release has no asset '{name}'
• release asset '{name}' has no download URL
• release {resolved_ref} of {org}/{repo} ships no .capsule ass

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/181281cb69081281. Report an issue: GitHub.