{"record":{"id":"30a5c32c248e8fba","repo":"astrid-runtime/astrid","slug":"capsule-archive-contains-unsupported-entry-path","errorCode":null,"errorMessage":"capsule archive contains unsupported entry '{path}'","messagePattern":"capsule archive contains unsupported entry '(.+?)'","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-build/src/artifact.rs","lineNumber":267,"sourceCode":"    let mut records = Vec::new();\n    let mut envelope = None;\n    let mut seen = HashSet::new();\n\n    for entry in archive\n        .entries()\n        .context(\"failed to read capsule archive\")?\n    {\n        let mut entry = entry.context(\"failed to read capsule archive entry\")?;\n        let path = normalized_entry_path(&entry)?;\n        if !seen.insert(path.clone()) {\n            bail!(\"capsule archive contains duplicate entry '{path}'\");\n        }\n        let kind = entry.header().entry_type();\n        if kind.is_dir() {\n            continue;\n        }\n        if !kind.is_file() {\n            bail!(\"capsule archive contains unsupported entry '{path}'\");\n        }\n        if path == PROVENANCE_FILE {\n            if entry.size() > 64 * 1024 {\n                bail!(\"capsule provenance envelope exceeds 64 KiB\");\n            }\n            let mut bytes = Vec::new();\n            entry\n                .read_to_end(&mut bytes)\n                .context(\"failed to read capsule provenance\")?;\n            envelope = Some(bytes);\n            continue;\n        }\n        records.push(hash_reader(path, entry.size(), &mut entry)?);\n    }\n    Ok((records, envelope))\n}\n\nfn normalized_entry_path<R: Read>(entry: &tar::Entry<'_, R>) -> anyhow::Result<String> {","sourceCodeStart":249,"sourceCodeEnd":285,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-build/src/artifact.rs#L249-L285","documentation":"The manifest's contracts section must reference the official contracts repository (CONTRACTS_REPOSITORY) and a syntactically valid 40-hex source commit (is_commit). This binds the release to a specific, valid revision of the contracts package. The error means the manifest names the wrong contracts repo or carries a malformed commit hash.","triggerScenarios":"verify_release_manifest parses a manifest whose contracts.repository != CONTRACTS_REPOSITORY, or whose contracts.commit fails is_commit (not 40 lowercase hex chars).","commonSituations":"Manifest generated against a forked contracts repo; placeholder commit ('HEAD', short SHA, or 'TBD') left in the manifest; upstream contracts repository migrated and manifest generated with the old org/name; manual manifest authoring.","solutions":["Set manifest.contracts.repository to the official CONTRACTS_REPOSITORY value and contracts.commit to the full 40-char lowercase hex commit.","Regenerate the manifest with the release tooling so the contracts revision is stamped from the actual build.","If contracts moved repos, update CONTRACTS_REPOSITORY/tooling and reissue both manifest and pointer."],"exampleFix":"# before\n[contracts]\nrepository = \"github.com/acme/contracts-old\"\ncommit = \"abc123\"\n# after\n[contracts]\nrepository = \"acme/contracts\"\ncommit = \"0123456789abcdef0123456789abcdef01234567\"","handlingStrategy":"validation","validationCode":"fn contracts_ok(repo: &str, commit: &str, expected_repo: &str) -> bool {\n    repo == expected_repo && commit.len() == 40\n        && commit.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f'))\n}","typeGuard":"fn is_commit(s: &str) -> bool {\n    s.len() == 40 && s.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f'))\n}","tryCatchPattern":"match verify_release_manifest(&bytes, &pointer) {\n    Err(e) if e.to_string().contains(\"contracts identity is invalid\") => eprintln!(\"regenerate manifest with valid contracts repo/commit\"),\n    other => other,\n}","preventionTips":["Stamp contracts.commit from the lockfile at build time","Validate generated manifests in CI","Disallow short SHAs or refs in commit fields"],"tags":["manifest","validation","provenance"],"backgroundTag":"invalid-identifier-format","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}