siyuan-note/siyuan · error

invalid encrypted asset content metadata

Error message

invalid encrypted asset content metadata

What it means

decryptAssetMetadata found metadata.Size negative. Size must be a non-negative content length consistent with the chunk layout; a negative value means the metadata is internally inconsistent (it is authenticated via AAD, so this indicates corruption or a writer bug).

Source

Thrown at kernel/model/crypto.go:2351

	var version struct {
		Spec        json.RawMessage `json:"spec"`
		ContainerID json.RawMessage `json:"containerID"`
	}
	if err := json.Unmarshal(data, &version); err != nil {
		return nil, err
	}
	// 仅认证元数据同时缺少两个版本字段时按旧容器读取，显式空值或不完整的新格式不能降级。
	if len(version.Spec) == 0 && len(version.ContainerID) == 0 {
		metadata.Spec = encryptedAssetLegacySpec
	} else if metadata.Spec != encryptedAssetSpec || len(metadata.ContainerID) != encryptedAssetContainerIDSize {
		return nil, errors.New("unsupported encrypted asset container version")
	}
	if metadata.OriginalName == "" || metadata.OriginalName == "." ||
		filepath.Base(metadata.OriginalName) != metadata.OriginalName || strings.ContainsAny(metadata.OriginalName, `/\`) {
		return nil, errors.New("invalid encrypted asset original name")
	}
	if metadata.Size < 0 {
		return nil, errors.New("invalid encrypted asset content metadata")
	}
	chunks := uint64(metadata.Size) / encryptedAssetChunkSize
	if metadata.Size%encryptedAssetChunkSize != 0 || metadata.Size == 0 {
		chunks++
	}
	if metadata.Chunks != chunks {
		return nil, errors.New("invalid encrypted asset chunk count")
	}
	return metadata, nil
}

// DecryptAssetWithName 解密资源内容并返回原始名称。
func DecryptAssetWithName(boxID, diskName string, dek, ciphertext []byte) (plaintext []byte, originalName string, err error) {
	var output bytes.Buffer
	originalName, err = DecryptAssetToWriter(boxID, diskName, dek, bytes.NewReader(ciphertext), &output)
	if err != nil {
		return nil, "", err
	}

View on GitHub (pinned to 8641553a1f)

Solutions

1. Restore the asset from sync or backup — authenticated metadata should never be negative
2. Re-encrypt the original source file with the current kernel to regenerate valid metadata
3. Audit any third-party tool that generated the container to fix its size accounting

Example fix

// before: trusting size from external tool
meta.Size = int64(externalSize)
// after: validate on the writer side
if externalSize < 0 { return errors.New("invalid asset size") }
meta.Size = int64(externalSize)

if metadata.Size < 0 {
    return errors.New("asset metadata corrupted")
}

if err != nil && strings.Contains(err.Error(), "content metadata") {
    // restore from backup; authenticated metadata must not be negative
}

When it happens

Trigger: Decrypting a container whose authenticated metadata decrypted to a negative Size — from a corrupted metadata blob or a bug in the encrypting version that recorded the size.

Common situations: Bit-rot/storage corruption, assets written by buggy third-party tooling that bypassed the official writer, integer mishandling in an external generator of containers.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• invalid encrypted asset metadata size
• invalid encrypted asset chunk count
• source is not an encrypted asset
• encrypted asset metadata is too large
• invalid encrypted asset format

AI-assisted analysis of siyuan-note/siyuan@8641553a1f (2026-09-11). Data as JSON: /api/errors/b2235925a7752c5e. Report an issue: GitHub.