What causes "Crate archive exceeds maximum size: " in theonedev/onedev?

Shrink the crate: add exclude/include rules in Cargo.toml so assets aren't packaged

theonedev/onedev · error · ClientException

Crate archive exceeds maximum size:

Error message

Crate archive exceeds maximum size:

What it means

Thrown by CargoPackHandler.readPublishBody when the crate archive (.crate) length read from the publish request body is negative or exceeds MAX_CRATE_SIZE. The server rejects the upload with HTTP 406 before buffering the archive. This prevents huge uploads from exhausting memory.

Source

Thrown at server-plugin/server-plugin-pack-cargo/src/main/java/io/onedev/server/plugin/pack/cargo/CargoPackHandler.java:322

			dep.set("registry", publishDep.path("registry"));
			if (!explicitName.isMissingNode() && !explicitName.isNull())
				dep.put("package", publishDep.path("name").asText());
			else
				dep.putNull("package");
			indexDeps.add(dep);
		}
		return indexDeps;
	}

	private PublishBody readPublishBody(HttpServletRequest request) {
		try (var is = request.getInputStream()) {
			var metadataLength = readIntLE(is);
			if (metadataLength < 0 || metadataLength > MAX_METADATA_SIZE)
				throw new ClientException(SC_NOT_ACCEPTABLE, "Package metadata exceeds maximum size: " + MAX_METADATA_SIZE);
			var metadata = readBytes(is, metadataLength);
			var crateLength = readIntLE(is);
			if (crateLength < 0 || crateLength > MAX_CRATE_SIZE)
				throw new ClientException(SC_NOT_ACCEPTABLE, "Crate archive exceeds maximum size: " + MAX_CRATE_SIZE);
			var crateFile = readBytes(is, crateLength);
			return new PublishBody(metadata, crateFile);
		} catch (IOException e) {
			throw new RuntimeException(e);
		}
	}

	private int readIntLE(InputStream is) throws IOException {
		var b1 = is.read();
		var b2 = is.read();
		var b3 = is.read();
		var b4 = is.read();
		if ((b1 | b2 | b3 | b4) < 0)
			throw new EOFException();
		return b1 | b2 << 8 | b3 << 16 | b4 << 24;
	}

	private byte[] readBytes(InputStream is, int length) throws IOException {

View on GitHub (pinned to d44925c47c)

Solutions

Shrink the crate: add exclude/include rules in Cargo.toml so assets aren't packaged
Raise MAX_CRATE_SIZE in CargoPackHandler if big crates are legitimate
Run `cargo package --list` to see what is being packaged and trim it
Verify no proxy is altering the request stream between cargo and the server

Example fix

// Cargo.toml
// before
[package]
# no excludes
// after
[package]
exclude = ["assets/*", "tests/fixtures/*"]

Defensive patterns

Strategy: validation

Validate before calling

const size = require('fs').statSync('target/package/<crate>.crate').size;
if (size > 512*1024*1024) throw new Error('crate too large for registry: ' + size);

Try / catch

try { execSync('cargo publish'); } catch (e) { if (/Crate archive exceeds maximum size/.test(e.message)) { /* add excludes to Cargo.toml and retry */ } }

Prevention

Add exclude patterns for assets/tests in Cargo.toml
Run `cargo package --list` to audit contents
Check build artifacts aren't being packaged
Raise MAX_CRATE_SIZE only if legitimately needed

When it happens

Trigger: `cargo publish` of a crate whose .crate tarball is larger than MAX_CRATE_SIZE, or a client sending a malformed length prefix so the read length is bogus.

Common situations: Crates bundling large assets in the package; accidental inclusion of build artifacts because `include`/`exclude` is not configured in Cargo.toml; reverse proxies with different body limits causing truncation.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/e960adb7a0e2a4e6. Report an issue: GitHub.