{"record":{"id":"1ba20c7899c5df93","repo":"astrid-runtime/astrid","slug":"installed-wasm-integrity-check-failed-expected-bl","errorCode":null,"errorMessage":"installed WASM integrity check failed: expected BLAKE3 {expected}, got {actual}","messagePattern":"installed WASM integrity check failed: expected BLAKE3 (.+?), got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"crates/astrid-capsule-install/src/authority.rs","lineNumber":643,"sourceCode":"    }\n    let executable = if component.path.is_absolute() {\n        component.path.clone()\n    } else {\n        let local = target_dir.join(&component.path);\n        if local.exists() {\n            local\n        } else {\n            home.bin_dir().join(format!(\"{expected}.wasm\"))\n        }\n    };\n    let mut bytes = Vec::new();\n    std::fs::File::open(&executable)\n        .with_context(|| format!(\"failed to open installed WASM {}\", executable.display()))?\n        .read_to_end(&mut bytes)\n        .with_context(|| format!(\"failed to read installed WASM {}\", executable.display()))?;\n    let actual = blake3::hash(&bytes).to_hex().to_string();\n    if actual != expected {\n        bail!(\"installed WASM integrity check failed: expected BLAKE3 {expected}, got {actual}\");\n    }\n    Ok(Some(actual))\n}\n\n/// A decision bound to one previously inspected content digest.\n#[derive(Debug, Clone, PartialEq, Eq)]\npub enum AuthorityDecision {\n    /// Accept only when the artifact is signed by this runtime.\n    Automatic,\n    /// One-install approval for the exact digest.\n    ExplicitApproval {\n        /// Digest shown to and approved by the caller.\n        content_digest: String,\n    },\n    /// Product/operator-owned distro acceptance for the exact digest.\n    OperatorDistribution {\n        /// Digest verified by the distribution install path.\n        content_digest: String,","sourceCodeStart":625,"sourceCodeEnd":661,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-capsule-install/src/authority.rs#L625-L661","documentation":"After reading the installed WASM bytes, the library recomputes the BLAKE3 hash and compares it to the expected value recorded in meta.json. Any difference means the installed binary is corrupt or tampered with, so the integrity check fails with both hashes in the message.","triggerScenarios":"verified_installed_wasm_hash opens the installed executable, hashes it with blake3::hash, and actual != expected (the meta.json wasm_hash).","commonSituations":"Disk corruption or truncated download of the .wasm; overwriting the installed wasm with a different build; interrupted install leaving a partial file.","solutions":["Reinstall the capsule from a trusted artifact so the wasm matches the recorded hash","Verify the source artifact's hash matches meta.json, then re-copy the wasm into place","Check storage health / re-download the capsule package if corruption recurs"],"exampleFix":"// before\n// corrupted installed wasm\nverify_installed_authority(&home, &target_dir, &manifest, None)?;\n// after\nblake3sum downloaded-module.wasm   # confirm matches meta.json wasm_hash\ncp downloaded-module.wasm ~/.astrid/capsules/my-capsule/module.wasm","handlingStrategy":"validation","validationCode":"let bytes = std::fs::read(&wasm_path)?;\nlet actual = blake3::hash(&bytes).to_hex().to_string();\nif actual != meta.wasm_hash {\n    return Err(anyhow!(\"wasm integrity failed: expected {}, got {} — reinstall\", meta.wasm_hash, actual));\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify hashes of downloaded artifacts before installing","Use checksums when copying capsules between machines","Re-run install after any interrupt instead of trusting partial files"],"tags":["capsule","wasm","integrity","blake3","corruption"],"backgroundTag":"checksum-mismatch","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}