theonedev/onedev · error · ClientException

Invalid package metadata

Error message

Invalid package metadata

What it means

CargoPackHandler.publish parses the uploaded package metadata JSON; if it is unparseable (IOException) or not a JSON object, the publish is rejected with HTTP 400 'Invalid package metadata'. Indicates a malformed cargo publish payload.

Source

Thrown at server-plugin/server-plugin-pack-cargo/src/main/java/io/onedev/server/plugin/pack/cargo/CargoPackHandler.java:141

			if (!isPut)
				throw new ClientException(SC_METHOD_NOT_ALLOWED);
			setYanked(response, projectId, decodePath(pathSegments.get(3)), decodePath(pathSegments.get(4)), false);
		} else if (isGet) {
			serveIndex(response, projectId, pathSegments);
		} else {
			throw new ClientException(SC_METHOD_NOT_ALLOWED);
		}
	}

	private void publish(HttpServletRequest request, HttpServletResponse response, Long projectId, Long buildId) {
		var upload = readPublishBody(request);
		ObjectNode metadata;
		try {
			var metadataNode = objectMapper.readTree(upload.metadata);
			if (metadataNode instanceof ObjectNode)
				metadata = (ObjectNode) metadataNode;
			else
				throw new ClientException(SC_BAD_REQUEST, "Invalid package metadata");
		} catch (IOException e) {
			throw new ClientException(SC_BAD_REQUEST, "Invalid package metadata");
		}

		var name = metadata.path("name").asText(null);
		var version = metadata.path("vers").asText(null);
		if (StringUtils.isBlank(name))
			throw new ClientException(SC_BAD_REQUEST, "Package name not specified");
		if (StringUtils.isBlank(version))
			throw new ClientException(SC_BAD_REQUEST, "Package version not specified");
		if (!name.equals(name.toLowerCase()))
			throw new ClientException(SC_BAD_REQUEST, "Package name should be lower case");
		LockUtils.run(getLockName(projectId, name), () -> transactionService.run(() -> {
			var project = checkProject(projectId, true);
			var packBlobId = packBlobService.uploadBlob(projectId, upload.crateFile, null);
			var packBlob = packBlobService.load(packBlobId);
			var pack = packService.findByNameAndVersion(project, TYPE, name, version);
			if (pack == null) {

View on GitHub (pinned to d44925c47c)

Solutions

1. Check that the cargo client uploads a valid JSON metadata object.
2. Verify the publish body structure matches what the handler expects (metadata plus tarball).

When it happens

Trigger: Thrown at server-plugin/server-plugin-pack-cargo/src/main/java/io/onedev/server/plugin/pack/cargo/CargoPackHandler.java:141 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/a6ba289b8f60a8ec. Report an issue: GitHub.