{"record":{"id":"5bc028a5accdf4af","repo":"astrid-runtime/astrid","slug":"signed-metadata-target-size-must-be-positive","errorCode":null,"errorMessage":"signed metadata target size must be positive","messagePattern":"signed metadata target size must be positive","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/update_channel.rs","lineNumber":360,"sourceCode":"        targets.len() == expected_targets.len(),\n        \"{label} must contain exactly {} targets\",\n        expected_targets.len()\n    );\n    let mut seen = HashSet::new();\n    for target in targets {\n        ensure!(\n            expected_targets.contains(&target.triple.as_str())\n                && seen.insert(target.triple.as_str()),\n            \"{label} target set is invalid\"\n        );\n        let expected_asset = format!(\"astrid-{version}-{}.tar.gz\", target.triple);\n        ensure!(\n            target.asset == expected_asset\n                && target.sigstore_bundle == format!(\"{expected_asset}.sigstore.json\"),\n            \"signed metadata asset identity is invalid for {}\",\n            target.triple\n        );\n        ensure!(\n            target.size > 0,\n            \"signed metadata target size must be positive\"\n        );\n        ensure!(\n            is_lower_hex_64(&target.blake3) && is_lower_hex_64(&target.sha256),\n            \"signed metadata target digest is invalid\"\n        );\n    }\n    ensure!(\n        seen.len() == expected_targets.len(),\n        \"{label} target set is incomplete\"\n    );\n    Ok(())\n}\n\nfn validate_targets(targets: &[TargetMetadata], version: &str) -> anyhow::Result<()> {\n    validate_targets_for(targets, TARGETS, version, \"signed metadata\")\n}","sourceCodeStart":342,"sourceCodeEnd":378,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/update_channel.rs#L342-L378","documentation":"`validate_targets_for` enforces `target.size > 0` for every target in the signed channel metadata. A zero (or negative, if the field is signed) size cannot describe a real release artifact, so the metadata is rejected. This is a sanity bound on the declared artifact size before it is used for download validation/progress accounting.","triggerScenarios":"`validate_targets` / `verify_release_extension` encountering a target entry whose `size` field is `0` — typically a placeholder that was never filled in when the metadata was generated.","commonSituations":"Metadata generation that ran before the artifact was built (size defaulted to 0); hand-authored target entries with an unfilled size; a templating bug emitting `\"size\": 0`.","solutions":["Set `size` to the actual byte length of the published tarball (`stat -c %s astrid-{version}-{triple}.tar.gz`).","Regenerate the signed metadata after the artifacts are built so sizes are computed from the real files, then re-sign.","If a target legitimately has no artifact yet, remove the target entry entirely rather than shipping size 0.","Add a pre-publish check in CI that asserts every target's size matches the artifact on disk."],"exampleFix":"// before\n\"asset\": \"astrid-1.2.3-x86_64-unknown-linux-gnu.tar.gz\",\n\"size\": 0\n\n// after\n\"asset\": \"astrid-1.2.3-x86_64-unknown-linux-gnu.tar.gz\",\n\"size\": 18345216","handlingStrategy":"validation","validationCode":"// shell: size from the real artifact before writing metadata\nSIZE=$(stat -c %s \"astrid-${VERSION}-${TRIPLE}.tar.gz\")\n[ \"$SIZE\" -gt 0 ] || { echo \"artifact missing/empty\" >&2; exit 1; }","typeGuard":"null","tryCatchPattern":"null","preventionTips":["Build artifacts first, generate metadata second — never the reverse.","Compute size from the file on disk, not from build config defaults.","Fail the pipeline if an expected artifact is missing instead of emitting size 0.","Re-sign metadata after any artifact rebuild."],"tags":["schema-validation","update-channel","metadata","rust"],"backgroundTag":"value-out-of-range","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}