{"record":{"id":"80004896c809fe54","repo":"astrid-runtime/astrid","slug":"release-manifest-does-not-match-the-signed-channel","errorCode":null,"errorMessage":"release manifest does not match the signed channel pointer","messagePattern":"release manifest does not match the signed channel pointer","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/update_channel.rs","lineNumber":584,"sourceCode":"pub(super) fn verify_release_manifest(\n    bytes: &[u8],\n    pointer: &ChannelPointer,\n) -> anyhow::Result<()> {\n    ensure!(\n        blake3::hash(bytes).to_hex().as_str() == pointer.release.metadata_blake3,\n        \"immutable release manifest does not match the channel BLAKE3 digest\"\n    );\n    let text = std::str::from_utf8(bytes).context(\"release manifest is not UTF-8\")?;\n    let manifest: ReleaseManifest =\n        toml::from_str(text).context(\"release manifest is invalid TOML\")?;\n    ensure!(\n        manifest.schema_version == 1\n            && manifest.kind == \"astrid-release\"\n            && manifest.product == PRODUCT\n            && manifest.repository == REPOSITORY,\n        \"release manifest identity is invalid\"\n    );\n    ensure!(\n        manifest.version == pointer.release.version\n            && manifest.tag == pointer.release.tag\n            && manifest.source_commit == pointer.release.source_commit\n            && manifest.release_workflow_identity == pointer.release.release_workflow_identity,\n        \"release manifest does not match the signed channel pointer\"\n    );\n    ensure!(\n        manifest.contracts.repository == CONTRACTS_REPOSITORY\n            && is_commit(&manifest.contracts.commit),\n        \"release manifest contracts identity is invalid\"\n    );\n    validate_targets(&manifest.targets, &manifest.version)?;\n    ensure!(\n        manifest.targets == pointer.targets,\n        \"release manifest targets do not match the signed channel pointer\"\n    );\n    Ok(())\n}","sourceCodeStart":566,"sourceCodeEnd":602,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/update_channel.rs#L566-L602","documentation":"Cross-check in verify_release_manifest: the manifest's version/tag/source_commit/workflow identity do not equal the signed channel pointer's release fields, so the manifest does not correspond to the release the pointer commits to.","triggerScenarios":"Thrown at crates/astrid-cli/src/commands/update_channel.rs:584 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-fetch both the pointer and the manifest — one of them is stale","Verify the CDN/mirror is not serving a manifest from another release","Re-sign and re-publish the coherent pointer+manifest pair"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}