siyuan-note/siyuan · error

invalid encrypted asset content length

Error message

invalid encrypted asset content length

What it means

After all chunks are written, the reader must produce a uint32 terminator of 0 and the total bytes written must equal metadata.Size. This error means the stream ended early/late or the trailer is non-zero, so the decrypted content length does not match the declared size. The output is incomplete and must not be trusted.

Source

Thrown at kernel/model/crypto.go:2493

			zeroAndClear(plainChunk)
			return "", errors.New("invalid encrypted asset plaintext chunk size")
		}
		n, writeErr := writer.Write(plainChunk)
		written += int64(n)
		zeroAndClear(plainChunk)
		if writeErr != nil {
			return "", writeErr
		}
		if n != len(plainChunk) {
			return "", io.ErrShortWrite
		}
	}
	var terminator uint32
	if err = binary.Read(reader, binary.BigEndian, &terminator); err != nil {
		return "", err
	}
	if terminator != 0 || written != metadata.Size {
		return "", errors.New("invalid encrypted asset content length")
	}
	var trailing [1]byte
	if _, trailingErr := io.ReadFull(reader, trailing[:]); trailingErr != io.EOF {
		return "", errors.New("invalid trailing encrypted asset data")
	}
	return metadata.OriginalName, nil
}

// DecryptAsset 对应解密。
func DecryptAsset(boxID, diskName string, dek, ciphertext []byte) ([]byte, error) {
	plaintext, _, err := DecryptAssetWithName(boxID, diskName, dek, ciphertext)
	return plaintext, err
}

// notebookCryptoBackupPath 返回加密笔记本的独立 BoxCrypt 备份路径。
// 该文件在主 conf.json 丢失时用作"此笔记本是加密笔记本"的标识和降级恢复源。
// 与全局 NotebookCrypto 备份（<DataDir>/.siyuan/data-crypto-backup.json）配合使用，
// 全局备份存 MasterSalt/KEKVerifier，per-notebook 备份存 WrappedDEK/WrapNonce。

View on GitHub (pinned to 8641553a1f)

Solutions

1. Re-download or restore the asset; the file is incomplete or inconsistent
2. Check the encrypted file's total size against header + metadata + chunks + trailer to find where it diverges
3. If the source plaintext exists, re-encrypt it with the current version
4. Use sync history/versioning in SiYuan to recover a complete copy

w, err := model.DecryptAssetToWriter(box, disk, dek, f, out)
if err != nil {
    if strings.Contains(err.Error(), "content length") {
        os.Remove(outPath) // discard incomplete output
        return restoreFromBackup(disk)
    }
    return err
}

When it happens

Trigger: DecryptAssetToWriter finishes all metadata.Chunks chunks, then reads the trailer: terminator != 0 or written != metadata.Size — caused by truncated files, extra/missing chunks, or metadata whose Size field disagrees with the chunk data.

Common situations: An interrupted upload/download producing a short file; a file that gained or lost bytes in transfer; metadata edited externally with a wrong Size value.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• encrypted .sy [%s]: base id [%s] != root id [%s]
• invalid encrypted asset plaintext chunk size
• cannot rebuild encrypted indexes: %w
• encrypted document is a symbolic link [%s]
• encrypted document root ID does not match filename [%s]

AI-assisted analysis of siyuan-note/siyuan@8641553a1f (2026-09-11). Data as JSON: /api/errors/3de91918eb4b245f. Report an issue: GitHub.