{"record":{"id":"20af03e95b92ecee","repo":"astrid-runtime/astrid","slug":"capsule-provenance-envelope-exceeds-64-kib","errorCode":null,"errorMessage":"capsule provenance envelope exceeds 64 KiB","messagePattern":"capsule provenance envelope exceeds 64 KiB","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-build/src/artifact.rs","lineNumber":271,"sourceCode":"    for entry in archive\n        .entries()\n        .context(\"failed to read capsule archive\")?\n    {\n        let mut entry = entry.context(\"failed to read capsule archive entry\")?;\n        let path = normalized_entry_path(&entry)?;\n        if !seen.insert(path.clone()) {\n            bail!(\"capsule archive contains duplicate entry '{path}'\");\n        }\n        let kind = entry.header().entry_type();\n        if kind.is_dir() {\n            continue;\n        }\n        if !kind.is_file() {\n            bail!(\"capsule archive contains unsupported entry '{path}'\");\n        }\n        if path == PROVENANCE_FILE {\n            if entry.size() > 64 * 1024 {\n                bail!(\"capsule provenance envelope exceeds 64 KiB\");\n            }\n            let mut bytes = Vec::new();\n            entry\n                .read_to_end(&mut bytes)\n                .context(\"failed to read capsule provenance\")?;\n            envelope = Some(bytes);\n            continue;\n        }\n        records.push(hash_reader(path, entry.size(), &mut entry)?);\n    }\n    Ok((records, envelope))\n}\n\nfn normalized_entry_path<R: Read>(entry: &tar::Entry<'_, R>) -> anyhow::Result<String> {\n    let path = entry.path().context(\"invalid capsule archive path\")?;\n    let mut parts = Vec::new();\n    for component in path.components() {\n        match component {","sourceCodeStart":253,"sourceCodeEnd":289,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-build/src/artifact.rs#L253-L289","documentation":"Finally, verify_release_manifest requires the manifest's targets table to be byte-for-byte equal to the targets embedded in the signed channel pointer (after validate_targets passed on the manifest itself). This error means the set of platform targets — their asset URLs/digests — differs between the manifest and the signed pointer, so the client cannot trust which artifacts belong to this release.","triggerScenarios":"verify_release_manifest (via resolve_signed_channel or workflow_identity_and_metadata_digest_are_exact) finds manifest.targets != pointer.targets after validate_targets(&manifest.targets, &manifest.version) succeeded.","commonSituations":"A new platform target added to the manifest but the pointer was signed earlier without it; a target's asset hash or URL changed on a re-upload; pointer generated from a template with a default target list; partial rollback of one target.","solutions":["Re-sign the channel pointer with the exact same targets table as the current manifest (or vice versa: publish the manifest matching the pointer's targets).","Regenerate both artifacts together in the release pipeline so targets are captured once and reused.","If a target was legitimately added post-release, cut a new generation of the pointer including it."],"exampleFix":"# before: pointer targets\n[[targets]]\ntriple = \"x86_64-unknown-linux-gnu\"\n# manifest also has aarch64-apple-darwin -> mismatch\n# after: regenerate pointer including all manifest targets\npointer.targets = manifest.targets.clone();","handlingStrategy":"validation","validationCode":"fn targets_match(m: &ReleaseManifest, p: &ChannelPointer) -> bool {\n    m.targets == p.targets\n}","typeGuard":null,"tryCatchPattern":"match verify_release_manifest(&bytes, &pointer) {\n    Err(e) if e.to_string().contains(\"targets do not match\") => eprintln!(\"re-fetch both artifacts or re-sign pointer with current targets\"),\n    other => other,\n}","preventionTips":["Generate pointer and manifest from one shared release descriptor","Treat targets as immutable post-signing","Diff targets in CI before publishing"],"tags":["manifest","targets","validation"],"backgroundTag":"schema-validation-failed","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}