{"record":{"id":"206345cbf39f40e8","repo":"astrid-runtime/astrid","slug":"signed-metadata-asset-identity-is-invalid-for","errorCode":null,"errorMessage":"signed metadata asset identity is invalid for {}","messagePattern":"signed metadata asset identity is invalid for (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/update_channel.rs","lineNumber":354,"sourceCode":"    targets: &[TargetMetadata],\n    expected_targets: &[&str],\n    version: &str,\n    label: &str,\n) -> anyhow::Result<()> {\n    ensure!(\n        targets.len() == expected_targets.len(),\n        \"{label} must contain exactly {} targets\",\n        expected_targets.len()\n    );\n    let mut seen = HashSet::new();\n    for target in targets {\n        ensure!(\n            expected_targets.contains(&target.triple.as_str())\n                && seen.insert(target.triple.as_str()),\n            \"{label} target set is invalid\"\n        );\n        let expected_asset = format!(\"astrid-{version}-{}.tar.gz\", target.triple);\n        ensure!(\n            target.asset == expected_asset\n                && target.sigstore_bundle == format!(\"{expected_asset}.sigstore.json\"),\n            \"signed metadata asset identity is invalid for {}\",\n            target.triple\n        );\n        ensure!(\n            target.size > 0,\n            \"signed metadata target size must be positive\"\n        );\n        ensure!(\n            is_lower_hex_64(&target.blake3) && is_lower_hex_64(&target.sha256),\n            \"signed metadata target digest is invalid\"\n        );\n    }\n    ensure!(\n        seen.len() == expected_targets.len(),\n        \"{label} target set is incomplete\"\n    );","sourceCodeStart":336,"sourceCodeEnd":372,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/update_channel.rs#L336-L372","documentation":"For each target, `validate_targets_for` recomputes the required asset filename (`astrid-{version}-{triple}.tar.gz`) and its sigstore bundle name (`{asset}.sigstore.json`) and requires both fields on the target to match exactly. This error means the target's asset name or sigstore bundle reference does not follow the deterministic naming scheme — so clients could not locate or verify the artifacts the metadata claims to describe.","triggerScenarios":"`validate_targets` / `verify_release_extension` finding a target where `asset` differs from `astrid-{version}-{triple}.tar.gz` or `sigstore_bundle` differs from `{asset}.sigstore.json` — e.g. renamed artifacts, wrong version embedded in the filename, or a bundle path that doesn't end in `.sigstore.json`.","commonSituations":"A release script that renames tarballs (adds a suffix like `-debug` or a date); metadata regenerated with a different version than the filenames embed; bundles generated without the `.sigstore.json` extension; manually edited metadata after artifact renames.","solutions":["Rename the published assets to match the scheme `astrid-{version}-{triple}.tar.gz` plus `astrid-{version}-{triple}.tar.gz.sigstore.json`, or update the metadata fields to the canonical names.","Regenerate the signed metadata from the actual artifacts so `asset` and `sigstore_bundle` are derived, not hand-typed, then re-sign.","Fix the release pipeline so it embeds the same `version` in the metadata and in the filenames.","Verify the sigstore signing step names its bundle `<asset>.sigstore.json`."],"exampleFix":"// before\n\"asset\": \"astrid-1.2.3-x86_64-unknown-linux-gnu-debug.tar.gz\",\n\"sigstore_bundle\": \"astrid-1.2.3-x86_64-unknown-linux-gnu.sigstore.json\"\n\n// after\n\"asset\": \"astrid-1.2.3-x86_64-unknown-linux-gnu.tar.gz\",\n\"sigstore_bundle\": \"astrid-1.2.3-x86_64-unknown-linux-gnu.tar.gz.sigstore.json\"","handlingStrategy":"validation","validationCode":"// Rust: assert naming scheme before signing\nlet expected = format!(\"astrid-{version}-{triple}.tar.gz\");\nassert_eq!(target.asset, expected);\nassert_eq!(target.sigstore_bundle, format!(\"{expected}.sigstore.json\"));","typeGuard":"null","tryCatchPattern":"null","preventionTips":["Generate asset and bundle names programmatically from version+triple; never type them manually.","Use one version variable for both metadata and filenames.","Configure sigstore signing to name bundles `<asset>.sigstore.json`.","Verify uploaded artifact names against the scheme before publishing metadata."],"tags":["schema-validation","update-channel","metadata","rust"],"backgroundTag":"schema-validation-failed","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}