golang/go · error

downloaded zip file too large

Error message

downloaded zip file too large

What it means

codeRepo.Zip streams the downloaded archive through an io.LimitedReader capped at MaxZipFile (500 MiB, defined in codehost.go). If lr.N drops to zero the source produced more than the cap and the transfer is aborted as too large. The limit is a hard cap meant to prevent a malicious or accidental oversized module from exhausting disk.

Source

Thrown at src/cmd/go/internal/modfetch/coderepo.go:1124

	subdir = strings.Trim(subdir, "/")

	// Spool to local file.
	f, err := os.CreateTemp("", "go-codehost-")
	if err != nil {
		dl.Close()
		return err
	}
	defer os.Remove(f.Name())
	defer f.Close()
	maxSize := int64(codehost.MaxZipFile)
	lr := &io.LimitedReader{R: dl, N: maxSize + 1}
	if _, err := io.Copy(f, lr); err != nil {
		dl.Close()
		return err
	}
	dl.Close()
	if lr.N <= 0 {
		return fmt.Errorf("downloaded zip file too large")
	}
	size := (maxSize + 1) - lr.N
	if _, err := f.Seek(0, 0); err != nil {
		return err
	}

	// Translate from zip file we have to zip file we want.
	zr, err := zip.NewReader(f, size)
	if err != nil {
		return err
	}

	var files []modzip.File
	if subdir != "" {
		subdir += "/"
	}
	haveLICENSE := false
	topPrefix := ""

View on GitHub (pinned to b6b368adc5)

Solutions

1. Reduce module size upstream: remove vendored binaries, .git history is irrelevant but committed blobs matter; split into a separate module or use //go:build constraints to exclude heavy files.
2. Switch to a lighter dependency or a version predating the bloat.
3. If you must host large assets, keep them out of the Go module tree (e.g. an assets submodule the Go module does not import).

Example fix

// upstream: remove oversized committed file
//   git rm -r --cached vendor/assets
//   echo /vendor/assets >> .gitignore
// commit and tag a new release, then `go get` the new tag

// Check archive size against the same cap the go command enforces before
// hosting/publishing a module.
const maxZipFile = int64(500) << 20 // codehost.MaxZipFile
func zipSizeOK(p string) (bool, error) {
    fi, err := os.Stat(p)
    if err != nil { return false, err }
    return fi.Size() <= maxZipFile, nil
}

When it happens

Trigger: A module archive over 500 MiB streamed from the origin or proxy. The download completes against the LimitedReader but N reaches zero, so the guard fires before any unzip.

Common situations: Repositories that vendor large binaries, datasets, media, or node_modules; archives with vendored test fixtures; a fork that accidentally committed build artifacts.

Related errors

• ReadZip: encoded file exceeds allowed size
• gzip.Write: Extra data is too large
• invalid file name: %v
• file too large (%d bytes > %d bytes)
• missing top-level directory prefix

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/90e2bddb467788d7. Report an issue: GitHub.