{"record":{"id":"8cd6fdbc75806e0b","repo":"astrid-runtime/astrid","slug":"unsupported-capsule-provenance-schema-algorit","errorCode":null,"errorMessage":"unsupported capsule provenance schema {} / algorithm '{}'","messagePattern":"unsupported capsule provenance schema (.+?) / algorithm '(.+?)'","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-build/src/artifact.rs","lineNumber":365,"sourceCode":"    let mut message =\n        Vec::with_capacity(SIGNATURE_DOMAIN.len().saturating_add(content_digest.len()));\n    message.extend_from_slice(SIGNATURE_DOMAIN);\n    message.extend_from_slice(content_digest.as_bytes());\n    message\n}\n\nfn verify_records(\n    records: Vec<ContentRecord>,\n    envelope: Option<&[u8]>,\n) -> anyhow::Result<ArtifactVerification> {\n    let content_digest = digest_records(records)?;\n    let Some(bytes) = envelope else {\n        return Ok(ArtifactVerification::Unsigned { content_digest });\n    };\n    let envelope: ProvenanceEnvelope =\n        serde_json::from_slice(bytes).context(\"invalid capsule provenance envelope\")?;\n    if envelope.schema_version != SCHEMA_VERSION || envelope.algorithm != ALGORITHM {\n        bail!(\n            \"unsupported capsule provenance schema {} / algorithm '{}'\",\n            envelope.schema_version,\n            envelope.algorithm\n        );\n    }\n    if envelope.content_digest != content_digest {\n        bail!(\"capsule content digest does not match its signed provenance\");\n    }\n    envelope\n        .signer\n        .verify(\n            &signature_message(&envelope.content_digest),\n            &envelope.signature,\n        )\n        .context(\"capsule provenance signature verification failed\")?;\n    Ok(ArtifactVerification::Signed(VerifiedProvenance {\n        content_digest,\n        signer: envelope.signer,","sourceCodeStart":347,"sourceCodeEnd":383,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-build/src/artifact.rs#L347-L383","documentation":"Fired by verify_records when a present provenance envelope declares a schema_version or algorithm other than the ones this build supports (SCHEMA_VERSION / ALGORITHM). The signature cannot be interpreted, so verification fails closed.","triggerScenarios":"Thrown at crates/astrid-build/src/artifact.rs:365 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Rebuild the capsule with the currently supported provenance schema/algorithm","Upgrade astrid to a version that understands the envelope's schema/algorithm","Treat the capsule as untrusted unless re-signed by the publisher"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}