siyuan-note/siyuan · error

invalid marketplace package type

Error message

invalid marketplace package type

What it means

Returned by installPackage (kernel/bazaar/install.go:169-171) when the pkgType argument is not found in the packageManifestNames map. This map is built by inverting localPackageManifests, which defines exactly five valid types: plugins, themes, icons, templates, widgets. An unknown type string means the code cannot determine which manifest file name to look for in the extracted package.

Source

Thrown at kernel/bazaar/install.go:171

		logging.LogErrorf("write file [%s] failed: %s", installPath, err)
		return
	}

	dirs, err := os.ReadDir(unzipPath)
	if err != nil {
		return
	}

	srcPath := unzipPath
	if 1 == len(dirs) && dirs[0].IsDir() {
		srcPath = filepath.Join(unzipPath, dirs[0].Name())
	}

	// 校验下载包自身声明的名称与请求安装的包名一致，防止把其他包的内容写入指定目录
	// https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj
	jsonFileName, ok := packageManifestNames[pkgType]
	if !ok {
		return errors.New("invalid marketplace package type")
	}
	pkg, parseErr := ParsePackageJSON(filepath.Join(srcPath, jsonFileName))
	if parseErr != nil || nil == pkg {
		return errors.New("marketplace package manifest not found or invalid")
	}
	if packageName != pkg.Name {
		return fmt.Errorf("marketplace package name mismatch: expected [%s], got [%s]", packageName, pkg.Name)
	}

	if err = filelock.Copy(srcPath, installPath); err != nil {
		return
	}
	return
}

// InstallLocalPackage 从已解压并验证的目录安装本地集市包。
func InstallLocalPackage(sourcePath, installPath, pkgType, packageName string, update bool) (err error) {
	if err = os.MkdirAll(filepath.Dir(installPath), 0755); err != nil {

View on GitHub (pinned to 251596fc0d)

Solutions

1. Use one of the five valid pkgType values: plugins, themes, icons, templates, widgets
2. Validate pkgType against localPackageManifests values before calling InstallPackage
3. Check the API documentation or kernel/bazaar/local.go:39-45 for the canonical type list

Example fix

// before
bazaar.InstallPackage(repoURL, repoHash, installPath, systemID, "plugin", pkgName, false)
// after
bazaar.InstallPackage(repoURL, repoHash, installPath, systemID, "plugins", pkgName, false)

var validPackageTypes = map[string]bool{"plugins": true, "themes": true, "icons": true, "templates": true, "widgets": true}

func validatePackageType(pkgType string) error {
    if !validPackageTypes[pkgType] {
        return fmt.Errorf("invalid package type %q: must be one of plugins, themes, icons, templates, widgets", pkgType)
    }
    return nil
}

func isValidPackageType(pkgType string) bool {
    switch pkgType {
    case "plugins", "themes", "icons", "templates", "widgets":
        return true
    }
    return false
}

When it happens

Trigger: Calling InstallPackage with a pkgType value that is not one of: "plugins", "themes", "icons", "templates", "widgets".

Common situations: Passing a singular form like "plugin" instead of "plugins"; passing a type from an outdated or future API version; typo in the pkgType string; custom code that derives pkgType from user input without validation.

Related errors

• marketplace package manifest not found or invalid
• marketplace package install path already exists
• marketplace package name mismatch: expected [%s], got [%s]
• install local marketplace package failed: %w; rollback faile
• multiple marketplace package manifests found

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/4a359c657c6c14e5. Report an issue: GitHub.