goharbor/harbor · error

failed to pull blob from registry: %w

Error message

failed to pull blob from registry: %w

What it means

Error "failed to pull blob from registry: %w" thrown in goharbor/harbor.

Source

Thrown at src/controller/artifact/processor/cnai/parser/base.go:80

}

// Parse is the common implementation for parsing layer.
func (b *base) Parse(_ context.Context, artifact *artifact.Artifact, layer *ocispec.Descriptor) (string, []byte, error) {
	if artifact == nil || layer == nil {
		return "", nil, fmt.Errorf("artifact or manifest cannot be nil")
	}

	// Reject early based on the manifest-declared size. This is only a cheap
	// pre-check: layer.Size is attacker-controlled and reflects the packed blob
	// size, which can be far smaller than the number of bytes materialized when
	// the content is decompressed/expanded (e.g. GNU tar sparse files).
	if layer.Size > defaultFileSizeLimit {
		return "", nil, errors.RequestEntityTooLargeError(errFileTooLarge)
	}

	_, stream, err := b.regCli.PullBlob(artifact.RepositoryName, layer.Digest.String())
	if err != nil {
		return "", nil, fmt.Errorf("failed to pull blob from registry: %w", err)
	}

	defer stream.Close()

	// Enforce the size limit against the actual bytes materialized, not just the
	// declared blob size, to prevent decompression/sparse-file bombs from
	// exhausting memory.
	content, err := decodeContent(layer.MediaType, stream, defaultFileSizeLimit)
	if err != nil {
		return "", nil, fmt.Errorf("failed to decode content: %w", err)
	}

	return contentTypeTextPlain, content, nil
}

// decodeContent decodes the content read from reader according to mediaType,
// enforcing that no more than limit bytes are materialized in memory.
func decodeContent(mediaType string, reader io.Reader, limit int64) ([]byte, error) {

View on GitHub (pinned to 7b2fd08cc5)

When it happens

Trigger: Thrown at src/controller/artifact/processor/cnai/parser/base.go:80 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/862e64023387e226. Report an issue: GitHub.