{"record":{"id":"4dbabd8937fe5672","repo":"astrid-runtime/astrid","slug":"label-release-metadata-does-not-bind-the-authent","errorCode":null,"errorMessage":"{label} release metadata does not bind the authenticated legacy release manifest","messagePattern":"(.+?) release metadata does not bind the authenticated legacy release manifest","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/update_channel.rs","lineNumber":671,"sourceCode":"        .with_context(|| format!(\"{label} release metadata is not UTF-8\"))?;\n    let extension: ReleaseExtension = toml::from_str(text)\n        .with_context(|| format!(\"{label} release metadata is invalid TOML\"))?;\n    ensure!(\n        extension.schema_version == 1\n            && extension.kind == expected_kind\n            && extension.product == PRODUCT\n            && extension.repository == REPOSITORY,\n        \"{label} release metadata identity is invalid\"\n    );\n    canonical_version(&extension.version)?;\n    ensure!(\n        extension.version == pointer.release.version\n            && extension.tag == pointer.release.tag\n            && extension.source_commit == pointer.release.source_commit\n            && extension.release_workflow_identity == pointer.release.release_workflow_identity,\n        \"{label} release metadata does not match the authenticated legacy release\"\n    );\n    ensure!(\n        extension.legacy_release.metadata_asset == pointer.release.metadata_asset\n            && extension.legacy_release.metadata_blake3 == pointer.release.metadata_blake3\n            && blake3::hash(legacy_manifest_bytes).to_hex().as_str()\n                == extension.legacy_release.metadata_blake3,\n        \"{label} release metadata does not bind the authenticated legacy release manifest\"\n    );\n    validate_targets_for(\n        &extension.targets,\n        expected_targets,\n        &extension.version,\n        &format!(\"{label} release metadata\"),\n    )?;\n    Ok(extension\n        .targets\n        .iter()\n        .find(|entry| entry.triple == target)\n        .with_context(|| format!(\"{label} release metadata target set is incomplete\"))?\n        .blake3","sourceCodeStart":653,"sourceCodeEnd":689,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/update_channel.rs#L653-L689","documentation":"This error is thrown by verify_release_extension when the extension's legacy_release section fails to bind the downloaded legacy release manifest: either metadata_asset/metadata_blake3 in the extension do not match pointer.release, or the BLAKE3 hash of the actually-downloaded legacy manifest bytes does not equal the metadata_blake3 recorded in the extension. This cryptographically ties the legacy manifest you received to the release metadata, so a tampered or wrong manifest is rejected.","triggerScenarios":"Calling resolve_target_blake3 / verify_musl_extension / verify_windows_extension when the legacy manifest bytes were corrupted in transit, the wrong manifest asset was downloaded, the extension's legacy_release.metadata_asset or metadata_blake3 differ from pointer.release, or the extension metadata was regenerated without updating the manifest hash.","commonSituations":"Partial/truncated download of the legacy manifest (hash differs); a mirror serving a modified manifest; release pipeline rebuilt the manifest after the extension metadata was signed; pointer advanced to a release whose metadata_asset name changed.","solutions":["Re-download both the legacy manifest and the extension metadata from the authenticated release and retry — a transient corruption is the most common cause","Verify the legacy manifest's blake3 hash manually and compare with the metadata asset name/hash recorded in the channel pointer","Republish the release so extension metadata and legacy manifest are generated from the same pipeline run","If operating a mirror, ensure assets are served byte-identical (verify checksums after sync)"],"exampleFix":"// before: serving a re-uploaded manifest without updating extension metadata\nlegacy_release.metadata_blake3 = \"<hash of OLD manifest>\"  // downloaded manifest is new\n// after: regenerate metadata after the manifest is final\nlegacy_release.metadata_blake3 = blake3::hash(final_manifest_bytes).to_hex()","handlingStrategy":"validation","validationCode":"fn manifest_is_bound(ext: &ReleaseExtension, manifest_bytes: &[u8], pointer: &ChannelPointer) -> bool {\n    ext.legacy_release.metadata_asset == pointer.release.metadata_asset\n        && blake3::hash(manifest_bytes).to_hex().as_str() == ext.legacy_release.metadata_blake3\n}","typeGuard":null,"tryCatchPattern":"match verify_release_extension(&bytes, &manifest, &pointer, target, kind, targets, label) {\n    Ok(blake3) => proceed(blake3),\n    Err(e) if e.to_string().contains(\"does not bind\") => {\n        eprintln!(\"legacy manifest corrupted or mismatched; re-downloading assets\");\n        redownload_and_retry();\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Verify asset checksums immediately after download and re-download on any mismatch","Generate extension metadata as the final step of the release pipeline, after the legacy manifest bytes are frozen","Operate mirrors with post-sync checksum verification","Never edit a published manifest without republishing the whole release including metadata"],"tags":["security","blake3","checksum","update-channel","supply-chain"],"backgroundTag":"checksum-mismatch","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}