{"record":{"id":"84e18be5926ad556","repo":"astrid-runtime/astrid","slug":"signed-channel-source-commit-is-invalid","errorCode":null,"errorMessage":"signed channel source commit is invalid","messagePattern":"signed channel source commit is invalid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/update_channel.rs","lineNumber":517,"sourceCode":"        \"signed channel lifetime exceeds the maximum for its channel\"\n    );\n    let version = canonical_version(&pointer.release.version)?;\n    let nightly_commit = nightly_source_commit(&version);\n    match expected_channel {\n        UpdateChannel::Nightly => ensure!(\n            nightly_commit.is_some() && version.build.is_empty(),\n            \"nightly channel must point to an exact nightly prerelease\"\n        ),\n        UpdateChannel::Stable | UpdateChannel::Dev => ensure!(\n            version.pre.is_empty() && version.build.is_empty(),\n            \"stable and dev channels must point to canonical releases\"\n        ),\n    }\n    ensure!(\n        pointer.release.tag == format!(\"v{version}\"),\n        \"signed channel release tag does not match its version\"\n    );\n    ensure!(\n        is_commit(&pointer.release.source_commit),\n        \"signed channel source commit is invalid\"\n    );\n    if let Some(commit) = nightly_commit {\n        ensure!(\n            commit == pointer.release.source_commit,\n            \"nightly channel version does not embed its source commit\"\n        );\n    }\n    ensure!(\n        pointer.release.metadata_asset == format!(\"astrid-{version}-release.toml\"),\n        \"signed channel release metadata asset is invalid\"\n    );\n    ensure!(\n        is_lower_hex_64(&pointer.release.metadata_blake3),\n        \"signed channel release metadata BLAKE3 is invalid\"\n    );\n    ensure!(","sourceCodeStart":499,"sourceCodeEnd":535,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/update_channel.rs#L499-L535","documentation":"The pointer's `release.source_commit` must pass is_commit (a well-formed commit identifier, e.g. 40 hex chars). The source commit binds the channel pointer to the exact revision the release was built from; an unrecognizable value means the pointer cannot be traced to a build and is rejected.","triggerScenarios":"parse_channel or enforce_continuity reads a pointer whose `release.source_commit` is empty, a branch/tag name, a short 7-char SHA, or contains non-hex characters — anything failing is_commit.","commonSituations":"Publisher script writing `$GIT_REF` (a branch name) instead of the full SHA; hand-edited TOML with a truncated commit; template placeholder like `<commit>` never substituted.","solutions":["Set `release.source_commit` to the full commit hash of the release build (as is_commit expects) and republish","Fix the publishing script to resolve the ref to a full SHA (e.g. `git rev-parse HEAD`) before templating","Regenerate the pointer via the official release workflow","If fetched from upstream, re-download — the file may be truncated"],"exampleFix":"// before (channel.toml)\nsource-commit = \"main\"\n// after\nsource-commit = \"9f2c1a7e4b8d...\" # full 40-char hex SHA","handlingStrategy":"validation","validationCode":"fn source_commit_ok(commit: &str) -> bool {\n    commit.len() == 40 && commit.bytes().all(|b| b.is_ascii_hexdigit())\n}","typeGuard":"fn has_valid_source_commit(release: &ReleaseRef) -> bool {\n    release.source_commit.len() == 40\n        && release.source_commit.bytes().all(|b| b.is_ascii_hexdigit())\n}","tryCatchPattern":"match parse_channel(&bytes, channel, now) {\n    Err(e) if e.to_string().contains(\"source commit is invalid\") => {\n        anyhow::bail!(\"channel pointer has malformed source commit; regenerate with a full SHA\")\n    }\n    other => other?,\n}","preventionTips":["Resolve refs to full SHAs with `git rev-parse HEAD` in publishing scripts","Never substitute branch names or short SHAs into source-commit","Substitute all template placeholders before signing; fail the build if any remain"],"tags":["update-channel","validation","git"],"backgroundTag":"invalid-identifier-format","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}