jdx/mise · error

encrypted file exceeds the size limit: {path}

Error message

encrypted file exceeds the size limit: {path}

What it means

After building the outer envelope (magic prefix + msgpack of path/mode/scheme/ciphertext), encode() enforces agecrypt::MAX_ENCRYPTED_BYTES. Encrypted blobs larger than this limit are rejected, keeping history objects within a size budget. This surfaces when a user tries to sync a very large file through encrypted dotfiles.

Source

Thrown at src/system/history/sync/files.rs:360

        bail!("unsupported encrypted file mode: {path}");
    }
    let inner = Plaintext {
        path: path.into(),
        mode: mode.into(),
        scheme: scheme.into(),
        content: Bytes(content.to_vec()),
    };
    let bytes = rmp_serde::to_vec_named(&inner)?;
    let outer = Envelope {
        path: path.into(),
        mode: mode.into(),
        scheme: scheme.into(),
        ciphertext: Bytes(agecrypt::encrypt_bytes(&bytes, recipients)?),
    };
    let mut encoded = MAGIC.to_vec();
    encoded.extend(rmp_serde::to_vec_named(&outer)?);
    if encoded.len() as u64 > agecrypt::MAX_ENCRYPTED_BYTES {
        bail!("encrypted file exceeds the size limit: {path}");
    }
    Ok(encoded)
}

#[cfg(test)]
mod tests {
    #[test]
    fn audit_reuses_verified_ancestry_but_rechecks_new_encryption_policy() {
        use crate::system::history::manifest::{Enrollment, Manifest};
        let tmp = tempfile::tempdir().unwrap();
        let repo = HistoryRepo::open_or_init_in(tmp.path()).unwrap().unwrap();
        let tree = repo
            .write_tree(&[(
                "100644".into(),
                repo.hash_blob(b"plain").unwrap(),
                "home/secret".into(),
            )])
            .unwrap();

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Exclude the large file from encrypted sync and store it elsewhere (git-lfs, cloud storage, artifact store).
2. Split the content into smaller files under the size limit.
3. Trim the file's content — e.g. keep only needed secrets, not full dumps.

Example fix

# before
dotfiles.sources = ["~/backups/db.dump"]
# after
dotfiles.sources = ["~/.gitconfig", "~/.ssh/config"]  # large files excluded

if content.len() as u64 + AGE_OVERHEAD > agecrypt::MAX_ENCRYPTED_BYTES {
    return Err(anyhow!("{path} too large to encrypt"));
}

match encrypt(path, mode, content, scheme, recipients) {
    Ok(bytes) => Ok(bytes),
    Err(e) if e.to_string().contains("exceeds the size limit") => {
        eprintln!("{path} too large; excluding from encrypted sync");
        Ok(())
    }
    Err(e) => Err(e),
}

When it happens

Trigger: Calling encrypt()/encode() on content whose resulting encoded envelope exceeds agecrypt::MAX_ENCRYPTED_BYTES (age overhead makes the output slightly larger than the plaintext).

Common situations: Syncing large binaries, VM images, databases, or media files as encrypted dotfiles; accumulating many secrets in one file.

Understand the failure class

Background: "File too large" / "file size exceeds limit" errors: why libraries cap file sizes and how to fix them — this error's family across 46 libraries.

Related errors

• plaintext exceeds the size limit
• compressed payload exceeds the size limit
• encrypted payload exceeds the size limit
• object exceeds the encrypted content size limit
• no age recipients to encrypt for

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/7fc040ad89bd003b. Report an issue: GitHub.