iflytek/astron-agent · error

credential file is too large

Error message

credential file is too large

What it means

Credential files may be at most maxCredentialFileBytes bytes. readCredentialFile checks Stat().Size() before reading and rejects oversized files, bounding memory use and defending against a maliciously huge file mounted at the credential path.

Solutions

1. Trim the credential file to contain only the secret value (single line, within maxCredentialFileBytes)
2. Check the file size with `wc -c <path>` and compare against the limit
3. If the credential genuinely needs more bytes, verify the platform limit and use a shorter generated secret

Example fix

# before
/creds/TENANT_KEY = 40-line annotated notes (12 KB)
# after
printf '%s' "$TENANT_KEY_VALUE" > /creds/TENANT_KEY  # single short secret

info, err := os.Stat(path)
if err != nil {
    return err
}
if info.Size() > config.MaxCredentialFileBytes {
    return fmt.Errorf("%s is %d bytes, limit is %d", path, info.Size(), config.MaxCredentialFileBytes)
}

if _, err := config.LoadTenantBootstrapCredentials(ctx); err != nil {
    if strings.Contains(err.Error(), "too large") {
        logger.Fatal("credential file exceeds size limit; store only the secret value")
    }
    return err
}

When it happens

Trigger: credentialFromEnvironmentOrFile opens a *_FILE credential path whose size on disk exceeds maxCredentialFileBytes, so the pre-read size check fails.

Common situations: Operator pasted a multi-line certificate bundle or notes into the credential file instead of just the secret value, or accidentally mounted a large data file at the credential path.

Understand the failure class

Background: "File too large" / "file size exceeds limit" errors: why libraries cap file sizes and how to fix them — this error's family across 46 libraries.

Related errors

• Remote resource URL must not include user information
• TENANT_KEY and TENANT_SECRET must be distinct values
• credential file cannot be inspected
• credential file must be a regular non-symbolic-link file
• credential file cannot be read

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/e95813c79691b14d. Report an issue: GitHub.

Appendix: source

Thrown at core/tenant/config/bootstrap_credentials.go:123

func readCredentialFile(fileName string) (string, error) {
	file, err := openCredentialFileNoFollow(fileName)
	if err != nil {
		return "", err
	}
	defer func() {
		_ = file.Close()
	}()

	openedInfo, err := file.Stat()
	if err != nil {
		return "", errors.New("credential file cannot be inspected")
	}
	if !openedInfo.Mode().IsRegular() {
		return "", errors.New("credential file must be a regular non-symbolic-link file")
	}
	if openedInfo.Size() > maxCredentialFileBytes {
		return "", errors.New("credential file is too large")
	}

	data, err := io.ReadAll(io.LimitReader(file, maxCredentialFileBytes+1))
	if err != nil {
		return "", errors.New("credential file cannot be read")
	}
	if len(data) > maxCredentialFileBytes {
		return "", errors.New("credential file is too large")
	}
	return strings.TrimSpace(string(data)), nil
}

func validateCredential(name, value string) error {
	length := utf8.RuneCountInString(value)
	if !utf8.ValidString(value) || length < tenantCredentialMinLength || length > tenantCredentialMaxLength {
		return fmt.Errorf("%s must contain 32-50 valid UTF-8 characters", name)
	}
	for _, character := range value {

View on GitHub (pinned to 5e758547a8)