{"record":{"id":"0b2721af248e21e4","repo":"astrid-runtime/astrid","slug":"signed-channel-release-metadata-blake3-is-invalid","errorCode":null,"errorMessage":"signed channel release metadata BLAKE3 is invalid","messagePattern":"signed channel release metadata BLAKE3 is invalid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/update_channel.rs","lineNumber":531,"sourceCode":"    ensure!(\n        pointer.release.tag == format!(\"v{version}\"),\n        \"signed channel release tag does not match its version\"\n    );\n    ensure!(\n        is_commit(&pointer.release.source_commit),\n        \"signed channel source commit is invalid\"\n    );\n    if let Some(commit) = nightly_commit {\n        ensure!(\n            commit == pointer.release.source_commit,\n            \"nightly channel version does not embed its source commit\"\n        );\n    }\n    ensure!(\n        pointer.release.metadata_asset == format!(\"astrid-{version}-release.toml\"),\n        \"signed channel release metadata asset is invalid\"\n    );\n    ensure!(\n        is_lower_hex_64(&pointer.release.metadata_blake3),\n        \"signed channel release metadata BLAKE3 is invalid\"\n    );\n    ensure!(\n        pointer.release.release_workflow_identity\n            == format!(\n                \"https://github.com/{REPOSITORY}/.github/workflows/release.yml@refs/tags/v{version}\"\n            ),\n        \"signed channel release workflow identity is invalid\"\n    );\n    validate_targets(&pointer.targets, &pointer.release.version)?;\n    Ok(())\n}\n\nfn nightly_source_commit(version: &semver::Version) -> Option<&str> {\n    let mut parts = version.pre.as_str().split('.');\n    let kind = parts.next()?;\n    let date = parts.next()?;","sourceCodeStart":513,"sourceCodeEnd":549,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/update_channel.rs#L513-L549","documentation":"Signature check in validate_pointer: pointer.release.metadata_blake3 is not valid lowercase 64-hex, so the manifest digest cannot be a real BLAKE3 hash and the pointer is rejected as malformed or tampered.","triggerScenarios":"Thrown at crates/astrid-cli/src/commands/update_channel.rs:531 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Recompute and re-sign the pointer with the correct BLAKE3 digest of the release manifest","Check the signing pipeline for truncated or uppercased hashes","Reject the channel update and retain the current pointer"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}