siyuan-note/siyuan · error

marketplace package name mismatch: expected [%s], got [%s]

Error message

marketplace package name mismatch: expected [%s], got [%s]

What it means

Returned by installPackage (kernel/bazaar/install.go:177-178) when the manifest's name field does not match the packageName argument. This is a security check (GHSA-rpx2-p6hp-x5gj) to prevent a confusion attack where a downloaded package declares a different name than expected, which could cause its contents to be written to another package's directory. The error message includes both the expected and actual names.

Source

Thrown at kernel/bazaar/install.go:178

	}

	srcPath := unzipPath
	if 1 == len(dirs) && dirs[0].IsDir() {
		srcPath = filepath.Join(unzipPath, dirs[0].Name())
	}

	// 校验下载包自身声明的名称与请求安装的包名一致，防止把其他包的内容写入指定目录
	// https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj
	jsonFileName, ok := packageManifestNames[pkgType]
	if !ok {
		return errors.New("invalid marketplace package type")
	}
	pkg, parseErr := ParsePackageJSON(filepath.Join(srcPath, jsonFileName))
	if parseErr != nil || nil == pkg {
		return errors.New("marketplace package manifest not found or invalid")
	}
	if packageName != pkg.Name {
		return fmt.Errorf("marketplace package name mismatch: expected [%s], got [%s]", packageName, pkg.Name)
	}

	if err = filelock.Copy(srcPath, installPath); err != nil {
		return
	}
	return
}

// InstallLocalPackage 从已解压并验证的目录安装本地集市包。
func InstallLocalPackage(sourcePath, installPath, pkgType, packageName string, update bool) (err error) {
	if err = os.MkdirAll(filepath.Dir(installPath), 0755); err != nil {
		return
	}

	var fallbackInstallTime time.Time
	if info, statErr := os.Stat(installPath); statErr == nil {
		fallbackInstallTime = info.ModTime()
	}

View on GitHub (pinned to 251596fc0d)

Solutions

1. Ensure packageName matches the name field in the package's manifest exactly
2. Update to the latest package metadata from the bazaar to get the correct name
3. If the package was renamed, use the new name from the marketplace listing
4. Verify the repoURL points to the correct repository

func verifyPackageNameMatch(srcPath, jsonFileName, expectedName string) error {
    pkg, err := bazaar.ParsePackageJSON(filepath.Join(srcPath, jsonFileName))
    if err != nil || pkg == nil {
        return fmt.Errorf("cannot read manifest to verify name")
    }
    if pkg.Name != expectedName {
        return fmt.Errorf("package name mismatch: expected %q, manifest says %q", expectedName, pkg.Name)
    }
    return nil
}

When it happens

Trigger: Calling InstallPackage where packageName does not match the "name" field in the package's manifest JSON (e.g. plugin.json).

Common situations: Package was renamed by the author but the marketplace listing or local cache still references the old name; repoURL was changed to point at a fork with a different name; inconsistent packageName passed by the calling code; user manually edited the manifest name field.

Related errors

• marketplace package install path already exists
• marketplace package manifest not found or invalid
• invalid marketplace package type
• install local marketplace package failed: %w; rollback faile
• multiple marketplace package manifests found

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/9bcc967426ea3f66. Report an issue: GitHub.