{"record":{"id":"2da57f23b0a16158","repo":"astrid-runtime/astrid","slug":"release-manifest-contracts-identity-is-invalid","errorCode":null,"errorMessage":"release manifest contracts identity is invalid","messagePattern":"release manifest contracts identity is invalid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/update_channel.rs","lineNumber":591,"sourceCode":"    );\n    let text = std::str::from_utf8(bytes).context(\"release manifest is not UTF-8\")?;\n    let manifest: ReleaseManifest =\n        toml::from_str(text).context(\"release manifest is invalid TOML\")?;\n    ensure!(\n        manifest.schema_version == 1\n            && manifest.kind == \"astrid-release\"\n            && manifest.product == PRODUCT\n            && manifest.repository == REPOSITORY,\n        \"release manifest identity is invalid\"\n    );\n    ensure!(\n        manifest.version == pointer.release.version\n            && manifest.tag == pointer.release.tag\n            && manifest.source_commit == pointer.release.source_commit\n            && manifest.release_workflow_identity == pointer.release.release_workflow_identity,\n        \"release manifest does not match the signed channel pointer\"\n    );\n    ensure!(\n        manifest.contracts.repository == CONTRACTS_REPOSITORY\n            && is_commit(&manifest.contracts.commit),\n        \"release manifest contracts identity is invalid\"\n    );\n    validate_targets(&manifest.targets, &manifest.version)?;\n    ensure!(\n        manifest.targets == pointer.targets,\n        \"release manifest targets do not match the signed channel pointer\"\n    );\n    Ok(())\n}\n\nfn verify_musl_extension(\n    bytes: &[u8],\n    legacy_manifest_bytes: &[u8],\n    pointer: &ChannelPointer,\n    target: &str,\n) -> anyhow::Result<String> {","sourceCodeStart":573,"sourceCodeEnd":609,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/update_channel.rs#L573-L609","documentation":"Cross-check in verify_release_manifest: the manifest's contracts.repos section does not match the identity pinned by the signed pointer, so the release's contracts provenance cannot be trusted and resolution aborts.","triggerScenarios":"Thrown at crates/astrid-cli/src/commands/update_channel.rs:591 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-publish the release manifest with the correct contracts identity","Verify the release workflow stamps contracts.repos from the pointer, not ad-hoc values","Reject the update and keep the previously verified channel state"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}