{"record":{"id":"08a7dfa0b1fea1c5","repo":"astrid-runtime/astrid","slug":"capsule-content-digest-does-not-match-its-signed-p","errorCode":null,"errorMessage":"capsule content digest does not match its signed provenance","messagePattern":"capsule content digest does not match its signed provenance","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-build/src/artifact.rs","lineNumber":372,"sourceCode":"fn verify_records(\n    records: Vec<ContentRecord>,\n    envelope: Option<&[u8]>,\n) -> anyhow::Result<ArtifactVerification> {\n    let content_digest = digest_records(records)?;\n    let Some(bytes) = envelope else {\n        return Ok(ArtifactVerification::Unsigned { content_digest });\n    };\n    let envelope: ProvenanceEnvelope =\n        serde_json::from_slice(bytes).context(\"invalid capsule provenance envelope\")?;\n    if envelope.schema_version != SCHEMA_VERSION || envelope.algorithm != ALGORITHM {\n        bail!(\n            \"unsupported capsule provenance schema {} / algorithm '{}'\",\n            envelope.schema_version,\n            envelope.algorithm\n        );\n    }\n    if envelope.content_digest != content_digest {\n        bail!(\"capsule content digest does not match its signed provenance\");\n    }\n    envelope\n        .signer\n        .verify(\n            &signature_message(&envelope.content_digest),\n            &envelope.signature,\n        )\n        .context(\"capsule provenance signature verification failed\")?;\n    Ok(ArtifactVerification::Signed(VerifiedProvenance {\n        content_digest,\n        signer: envelope.signer,\n        signature: envelope.signature,\n    }))\n}\n\nfn rewrite_with_provenance(archive_path: &Path, envelope: &[u8]) -> anyhow::Result<()> {\n    let parent = archive_path.parent().unwrap_or_else(|| Path::new(\".\"));\n    let mut staged = tempfile::NamedTempFile::new_in(parent)","sourceCodeStart":354,"sourceCodeEnd":390,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-build/src/artifact.rs#L354-L390","documentation":"Fired by verify_records when the BLAKE3 content digest recomputed from archive entries differs from the digest covered by the envelope's signature. The capsule's contents were modified after signing (or the signature is invalid/corrupt).","triggerScenarios":"Thrown at crates/astrid-build/src/artifact.rs:372 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-download the capsule from the trusted publisher; do not install this copy","Rebuild and re-sign the capsule if you are the author","Check for transmission corruption or tampering"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}