siyuan-note/siyuan · error

unsupported encrypted asset container version

Error message

unsupported encrypted asset container version

What it means

decryptAssetMetadata enforces container versioning: metadata must either be the legacy format (both Spec and ContainerID empty) or the current format (Spec == encryptedAssetSpec and ContainerID of encryptedAssetContainerIDSize). Anything else is an unrecognized container version and is rejected rather than silently downgraded.

Source

Thrown at kernel/model/crypto.go:2344

}

func parseEncryptedAssetMetadata(data []byte) (*encryptedAssetMetadata, error) {
	metadata := &encryptedAssetMetadata{}
	if err := json.Unmarshal(data, metadata); err != nil {
		return nil, err
	}
	var version struct {
		Spec        json.RawMessage `json:"spec"`
		ContainerID json.RawMessage `json:"containerID"`
	}
	if err := json.Unmarshal(data, &version); err != nil {
		return nil, err
	}
	// 仅认证元数据同时缺少两个版本字段时按旧容器读取，显式空值或不完整的新格式不能降级。
	if len(version.Spec) == 0 && len(version.ContainerID) == 0 {
		metadata.Spec = encryptedAssetLegacySpec
	} else if metadata.Spec != encryptedAssetSpec || len(metadata.ContainerID) != encryptedAssetContainerIDSize {
		return nil, errors.New("unsupported encrypted asset container version")
	}
	if metadata.OriginalName == "" || metadata.OriginalName == "." ||
		filepath.Base(metadata.OriginalName) != metadata.OriginalName || strings.ContainsAny(metadata.OriginalName, `/\`) {
		return nil, errors.New("invalid encrypted asset original name")
	}
	if metadata.Size < 0 {
		return nil, errors.New("invalid encrypted asset content metadata")
	}
	chunks := uint64(metadata.Size) / encryptedAssetChunkSize
	if metadata.Size%encryptedAssetChunkSize != 0 || metadata.Size == 0 {
		chunks++
	}
	if metadata.Chunks != chunks {
		return nil, errors.New("invalid encrypted asset chunk count")
	}
	return metadata, nil
}

View on GitHub (pinned to 8641553a1f)

Solutions

1. Upgrade the SiYuan kernel to the version that wrote this asset so it understands the newer container spec
2. If you intentionally downgraded, re-export/re-encrypt the assets with the older version first
3. Check metadata.Spec and metadata.ContainerID lengths after decryption to identify which format mismatched
4. Restore the asset from backup if the metadata was corrupted

Example fix

// before: old kernel reading newer containers
// unsupported encrypted asset container version
// after: bump constants to match writer
const encryptedAssetSpec = "siyuan-asset-v2" // match the version that produced the asset

// after decrypt, before use
if len(meta.Spec) > 0 && meta.Spec != encryptedAssetSpec {
    return errors.New("asset written by a newer version; upgrade required")
}

if err != nil && strings.Contains(err.Error(), "container version") {
    // inform user to upgrade the kernel; do not attempt downgrade reads
}

When it happens

Trigger: Decrypting an asset written by a newer SiYuan version whose spec string or container-ID length differs, or a corrupted/mutated metadata blob where Spec/ContainerID fields decrypt to unexpected values.

Common situations: Downgrading the kernel after the asset container format was bumped, syncing assets from a newer client to an older one, bit-rot or tampering altering the authenticated-then-parsed metadata.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• encrypted asset metadata is too large
• invalid encrypted asset format
• invalid encrypted asset metadata size
• invalid encrypted asset original name
• invalid encrypted asset content metadata

AI-assisted analysis of siyuan-note/siyuan@8641553a1f (2026-09-11). Data as JSON: /api/errors/a315563c5923e738. Report an issue: GitHub.