What causes "marketplace package manifest not found or invalid" in siyuan-note/siyuan?

Verify the package zip is well-formed by inspecting it manually before installing

marketplace package manifest not found or invalid

Error message

marketplace package manifest not found or invalid

What it means

Returned by installPackage (kernel/bazaar/install.go:173-175) when ParsePackageJSON fails on the expected manifest file (e.g. plugin.json) inside the extracted package, or returns a nil result. This means the manifest JSON is either missing from the expected path, syntactically invalid, or structurally incomplete. It differs from error 131 (wrong pkgType) and error 133 (name mismatch) — here the file path was correct but the content is bad.

Source

Thrown at kernel/bazaar/install.go:175

	dirs, err := os.ReadDir(unzipPath)
	if err != nil {
		return
	}

	srcPath := unzipPath
	if 1 == len(dirs) && dirs[0].IsDir() {
		srcPath = filepath.Join(unzipPath, dirs[0].Name())
	}

	// 校验下载包自身声明的名称与请求安装的包名一致，防止把其他包的内容写入指定目录
	// https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj
	jsonFileName, ok := packageManifestNames[pkgType]
	if !ok {
		return errors.New("invalid marketplace package type")
	}
	pkg, parseErr := ParsePackageJSON(filepath.Join(srcPath, jsonFileName))
	if parseErr != nil || nil == pkg {
		return errors.New("marketplace package manifest not found or invalid")
	}
	if packageName != pkg.Name {
		return fmt.Errorf("marketplace package name mismatch: expected [%s], got [%s]", packageName, pkg.Name)
	}

	if err = filelock.Copy(srcPath, installPath); err != nil {
		return
	}
	return
}

// InstallLocalPackage 从已解压并验证的目录安装本地集市包。
func InstallLocalPackage(sourcePath, installPath, pkgType, packageName string, update bool) (err error) {
	if err = os.MkdirAll(filepath.Dir(installPath), 0755); err != nil {
		return
	}

	var fallbackInstallTime time.Time

View on GitHub (pinned to 251596fc0d)

Solutions

Verify the package zip is well-formed by inspecting it manually before installing
Check that the manifest file (plugin.json, theme.json, etc.) exists at the archive root or in the single top-level directory
Report the issue to the package author if the manifest is genuinely malformed
Re-download the package — a corrupted download can produce this error

Defensive patterns

Strategy: validation

Validate before calling

func verifyPackageManifest(srcPath, jsonFileName string) error {
    pkg, err := bazaar.ParsePackageJSON(filepath.Join(srcPath, jsonFileName))
    if err != nil || pkg == nil {
        return fmt.Errorf("manifest %s is missing or invalid in the package", jsonFileName)
    }
    return nil
}

Prevention

Inspect the downloaded package zip structure before installing to confirm the manifest is at the expected location
Report malformed packages to their authors
Retry the download if the zip appears truncated or corrupt

When it happens

Trigger: The downloaded package zip is extracted, the correct manifest file name is computed from pkgType, but that file is missing from the expected location or contains invalid JSON / missing required fields.

Common situations: Corrupted download producing a partial zip; package author shipped a malformed manifest; the manifest file is in a subdirectory instead of the archive root or its single top-level directory; zip extraction produced an unexpected directory structure.

Related errors

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/c325eb2ef7dc0e09. Report an issue: GitHub.