siyuan-note/siyuan · error
invalid marketplace package archive
Error message
invalid marketplace package archive
What it means
Returned by extractLocalPackageArchive (kernel/bazaar/local.go:90-92) when zip.OpenReader fails on the provided archive path. This means Go's archive/zip package could not open the file as a valid zip archive at all — the file may not be a zip, may be truncated, or uses an unsupported compression method. This check runs before any content/size validation.
Source
Thrown at kernel/bazaar/local.go:92
}
if manifestPath == "" {
err = errors.New("marketplace package manifest not found")
cleanup()
return
}
pkg, err = ParsePackageJSON(manifestPath)
if err != nil || pkg == nil {
err = errors.New("invalid marketplace package manifest")
cleanup()
}
return
}
func extractLocalPackageArchive(archivePath, destination string) error {
reader, err := zip.OpenReader(archivePath)
if err != nil {
return errors.New("invalid marketplace package archive")
}
defer reader.Close()
if len(reader.File) == 0 {
return errors.New("marketplace package archive is empty")
}
if len(reader.File) > maxLocalPackageFileCount {
return errors.New("marketplace package contains too many files")
}
var declaredTotal uint64
for _, item := range reader.File {
if item.UncompressedSize64 > maxLocalPackageFileSize {
return errors.New("marketplace package contains a file that is too large")
}
if ^uint64(0)-declaredTotal < item.UncompressedSize64 {
return errors.New("marketplace package is too large")
}View on GitHub (pinned to 251596fc0d)
Solutions
- Re-export or re-download the package as a standard .zip file
- Verify the file is a valid zip by opening it in an archive manager before uploading
- Ensure the file is not truncated — check the file size matches the source
- Avoid encrypted or non-standard zip variants; use standard deflate/store compression
Defensive patterns
Strategy: validation
Validate before calling
func isValidZipArchive(archivePath string) error {
r, err := zip.OpenReader(archivePath)
if err != nil {
return fmt.Errorf("not a valid zip archive: %w", err)
}
r.Close()
return nil
}
// Call before ExtractLocalPackage Prevention
- Verify the file is a standard .zip before uploading — not .tar.gz, .7z, or .rar
- Check the file is not truncated by comparing its size to the source
- Use standard zip compression (deflate or store) — avoid encrypted or Zip64 variants if possible
- Open the file in an archive manager to confirm integrity before uploading
When it happens
Trigger: Uploading a local marketplace package file that is not a valid zip archive — a tar.gz, a renamed non-zip file, a truncated download, or a corrupt archive.
Common situations: User selected a .tar.gz or .7z file instead of .zip; the file was renamed to .zip but is not actually a zip; the download/upload was interrupted leaving a partial file; the zip uses Zip64 or an encryption method that Go's reader rejects.
Related errors
- multiple marketplace package manifests found
- marketplace package manifest not found
- invalid marketplace package manifest
- marketplace package archive is empty
- invalid marketplace package type
AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12).
Data as JSON: /api/errors/b47193b8d7ae18cb.
Report an issue: GitHub.