{"record":{"id":"5307ea24bbca75ed","repo":"astrid-runtime/astrid","slug":"label-release-metadata-does-not-match-the-authen","errorCode":null,"errorMessage":"{label} release metadata does not match the authenticated legacy release","messagePattern":"(.+?) release metadata does not match the authenticated legacy release","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/update_channel.rs","lineNumber":664,"sourceCode":"    label: &str,\n) -> anyhow::Result<String> {\n    ensure!(\n        expected_targets.contains(&target),\n        \"{label} release metadata does not support target '{target}'\"\n    );\n    let text = std::str::from_utf8(bytes)\n        .with_context(|| format!(\"{label} release metadata is not UTF-8\"))?;\n    let extension: ReleaseExtension = toml::from_str(text)\n        .with_context(|| format!(\"{label} release metadata is invalid TOML\"))?;\n    ensure!(\n        extension.schema_version == 1\n            && extension.kind == expected_kind\n            && extension.product == PRODUCT\n            && extension.repository == REPOSITORY,\n        \"{label} release metadata identity is invalid\"\n    );\n    canonical_version(&extension.version)?;\n    ensure!(\n        extension.version == pointer.release.version\n            && extension.tag == pointer.release.tag\n            && extension.source_commit == pointer.release.source_commit\n            && extension.release_workflow_identity == pointer.release.release_workflow_identity,\n        \"{label} release metadata does not match the authenticated legacy release\"\n    );\n    ensure!(\n        extension.legacy_release.metadata_asset == pointer.release.metadata_asset\n            && extension.legacy_release.metadata_blake3 == pointer.release.metadata_blake3\n            && blake3::hash(legacy_manifest_bytes).to_hex().as_str()\n                == extension.legacy_release.metadata_blake3,\n        \"{label} release metadata does not bind the authenticated legacy release manifest\"\n    );\n    validate_targets_for(\n        &extension.targets,\n        expected_targets,\n        &extension.version,\n        &format!(\"{label} release metadata\"),","sourceCodeStart":646,"sourceCodeEnd":682,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/update_channel.rs#L646-L682","documentation":"This error is thrown by verify_release_extension after the metadata identity passes, when the extension's version, tag, source_commit, or release_workflow_identity fields do not exactly match the corresponding fields of the authenticated ChannelPointer release record. It ensures the extension metadata is bound to the exact legacy release the user is being updated to, preventing a mixed or replayed metadata file describing a different release.","triggerScenarios":"Calling resolve_target_blake3 / verify_musl_extension / verify_windows_extension with extension metadata whose version is not a canonical version (canonical_version fails first) or whose version/tag/source_commit/release_workflow_identity differ from pointer.release — e.g. metadata from an older release paired with a newer channel pointer, or a re-tagged release where source_commit or workflow identity changed.","commonSituations":"CDN cache serving stale extension metadata for a previous version while the channel pointer was already advanced; re-running a release workflow so release_workflow_identity changed but the metadata asset was not regenerated; manually pinning an older metadata file during testing.","solutions":["Re-download the extension metadata from the same release the channel pointer authenticates (same version, tag, source_commit, release_workflow_identity)","Purge CDN/proxy caches so the metadata asset matches the current pointer.release","Regenerate the extension metadata in the release workflow so its fields match the final release record","Verify the channel pointer itself was not advanced to a release whose metadata asset failed to publish"],"exampleFix":"// before: stale cached metadata from the previous release\nmetadata_asset = \"astrid-release-musl-extension-v1.2.3.toml\"  // pointer says v1.2.4\n// after: metadata bound to the pointer's exact release\nmetadata_asset = \"astrid-release-musl-extension-v1.2.4.toml\"","handlingStrategy":"validation","validationCode":"fn extension_matches_pointer(ext: &ReleaseExtension, pointer: &ChannelPointer) -> bool {\n    ext.version == pointer.release.version\n        && ext.tag == pointer.release.tag\n        && ext.source_commit == pointer.release.source_commit\n        && ext.release_workflow_identity == pointer.release.release_workflow_identity\n}","typeGuard":"fn is_current_release(ext: &ReleaseExtension, expected_version: &str) -> bool {\n    canonical_version(&ext.version).is_ok() && ext.version == expected_version\n}","tryCatchPattern":"match verify_release_extension(&bytes, &manifest, &pointer, target, kind, targets, label) {\n    Ok(blake3) => proceed(blake3),\n    Err(e) if e.to_string().contains(\"does not match the authenticated legacy release\") => {\n        eprintln!(\"stale/mismatched metadata; re-fetching channel pointer and assets\");\n        refresh_pointer_and_retry();\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Always download extension metadata from the same release assets the channel pointer authenticates, in one pass","Purge or bypass CDN caches when advancing the channel pointer","Regenerate extension metadata whenever a release is rebuilt or re-tagged","Log version/tag/source_commit of both metadata and pointer on failure to speed diagnosis"],"tags":["security","update-channel","release-integrity","version-mismatch"],"backgroundTag":"checksum-mismatch","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}