{"record":{"id":"8ffb6b06205aecbc","repo":"astrid-runtime/astrid","slug":"capsule-archive-contains-duplicate-entry-request","errorCode":null,"errorMessage":"capsule archive contains duplicate entry '{requested}'","messagePattern":"capsule archive contains duplicate entry '(.+?)'","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-build/src/artifact.rs","lineNumber":224,"sourceCode":"///\n/// Fails when the archive is malformed, contains duplicate matching entries,\n/// or the requested entry is absent or not UTF-8.\npub fn read_archive_text(archive_path: &Path, requested: &str) -> anyhow::Result<String> {\n    let file = File::open(archive_path)\n        .with_context(|| format!(\"failed to open {}\", archive_path.display()))?;\n    let mut archive = tar::Archive::new(GzDecoder::new(file));\n    let mut found = None;\n    for entry in archive\n        .entries()\n        .context(\"failed to read capsule archive\")?\n    {\n        let mut entry = entry.context(\"failed to read capsule archive entry\")?;\n        let path = normalized_entry_path(&entry)?;\n        if path != requested {\n            continue;\n        }\n        if found.is_some() {\n            bail!(\"capsule archive contains duplicate entry '{requested}'\");\n        }\n        if !entry.header().entry_type().is_file() {\n            bail!(\"capsule archive entry '{requested}' is not a regular file\");\n        }\n        let mut bytes = Vec::new();\n        entry.read_to_end(&mut bytes)?;\n        found =\n            Some(String::from_utf8(bytes).with_context(|| {\n                format!(\"capsule archive entry '{requested}' is not valid UTF-8\")\n            })?);\n    }\n    found.with_context(|| format!(\"capsule archive is missing '{requested}'\"))\n}\n\nfn read_archive(archive_path: &Path) -> anyhow::Result<(Vec<ContentRecord>, Option<Vec<u8>>)> {\n    let file = File::open(archive_path)\n        .with_context(|| format!(\"failed to open {}\", archive_path.display()))?;\n    read_archive_reader(GzDecoder::new(file))","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-build/src/artifact.rs#L206-L242","documentation":"Each signed pointer must pin the exact GitHub Actions release workflow that produced the version: 'https://github.com/<REPOSITORY>/.github/workflows/release.yml@refs/tags/v<version>'. This ensure! fails when release_workflow_identity deviates from that canonical URL, blocking pointers whose provenance cannot be tied to the official release workflow.","triggerScenarios":"validate_pointer (via parse_channel or enforce_continuity) sees release.release_workflow_identity differing from the repository/workflow/tag-ref template built from REPOSITORY and the pointer's version.","commonSituations":"Repository renamed or forked so the URL host/org changed; workflow file renamed (e.g. release.yml to publish.yml); ref written as a SHA or a branch instead of refs/tags/v<version>; pointer copied from another product's channel.","solutions":["Set release_workflow_identity to exactly format!(\"https://github.com/{REPOSITORY}/.github/workflows/release.yml@refs/tags/v{version}\").","If the repository or workflow was renamed, regenerate the pointer with current tooling (the check will only pass for the canonical name).","Re-sign and redistribute the corrected pointer."],"exampleFix":"# before\nrelease_workflow_identity = \"https://github.com/acme/astrid/.github/workflows/publish.yml@main\"\n# after\nrelease_workflow_identity = \"https://github.com/acme/astrid/.github/workflows/release.yml@refs/tags/v1.2.3\"","handlingStrategy":"validation","validationCode":"fn workflow_identity_ok(repo: &str, version: &str, identity: &str) -> bool {\n    identity == format!(\"https://github.com/{repo}/.github/workflows/release.yml@refs/tags/v{version}\")\n}","typeGuard":null,"tryCatchPattern":"if let Err(e) = parse_channel(&bytes, channel, now) {\n    if e.to_string().contains(\"workflow identity is invalid\") { eprintln!(\"use canonical release.yml@refs/tags/v<version>\"); }\n    return Err(e.into());\n}","preventionTips":["Derive identity from REPOSITORY and version constants","Keep the release workflow file name stable","Always use refs/tags/v<version> refs"],"tags":["validation","signing","ci","provenance"],"backgroundTag":"invalid-url-format","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}