{"record":{"id":"c98fd9aa0d0e2820","repo":"astrid-runtime/astrid","slug":"signed-metadata-target-digest-is-invalid","errorCode":null,"errorMessage":"signed metadata target digest is invalid","messagePattern":"signed metadata target digest is invalid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/update_channel.rs","lineNumber":364,"sourceCode":"    let mut seen = HashSet::new();\n    for target in targets {\n        ensure!(\n            expected_targets.contains(&target.triple.as_str())\n                && seen.insert(target.triple.as_str()),\n            \"{label} target set is invalid\"\n        );\n        let expected_asset = format!(\"astrid-{version}-{}.tar.gz\", target.triple);\n        ensure!(\n            target.asset == expected_asset\n                && target.sigstore_bundle == format!(\"{expected_asset}.sigstore.json\"),\n            \"signed metadata asset identity is invalid for {}\",\n            target.triple\n        );\n        ensure!(\n            target.size > 0,\n            \"signed metadata target size must be positive\"\n        );\n        ensure!(\n            is_lower_hex_64(&target.blake3) && is_lower_hex_64(&target.sha256),\n            \"signed metadata target digest is invalid\"\n        );\n    }\n    ensure!(\n        seen.len() == expected_targets.len(),\n        \"{label} target set is incomplete\"\n    );\n    Ok(())\n}\n\nfn validate_targets(targets: &[TargetMetadata], version: &str) -> anyhow::Result<()> {\n    validate_targets_for(targets, TARGETS, version, \"signed metadata\")\n}\n\nfn musl_metadata_asset(version: &str) -> String {\n    format!(\"astrid-{version}-musl-release.toml\")\n}","sourceCodeStart":346,"sourceCodeEnd":382,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/update_channel.rs#L346-L382","documentation":"Each target must carry both a blake3 and a sha256 digest, and `is_lower_hex_64` verifies each is exactly 64 lowercase hexadecimal characters. This error means at least one digest field is malformed — wrong length, uppercase hex, a `sha256:...` prefix, or a non-hex character — so it cannot be a valid 256-bit digest for download verification.","triggerScenarios":"`validate_targets` / `verify_release_extension` finding a target where `blake3` or `sha256` is not 64 lowercase hex chars — e.g. `\"sha256\": \"ABCDEF...\"` (uppercase), a prefixed digest (`sha256:ab12...`), a truncated hash, or an empty string.","commonSituations":"Digest fields copied with a `sha256:<hex>` prefix from `sha256sum` tooling output; uppercase hex from a different hashing tool; placeholders left in hand-edited metadata; a generator emitting base64 digests instead of hex.","solutions":["Replace the digest with the bare 64-character lowercase hex hash of the artifact (`sha256sum` / `b3sum` output without any prefix).","Fix the metadata generator to emit lowercase hex encoding for both digests and re-sign.","Regenerate the signed metadata from the actual artifacts rather than pasting hashes by hand.","Add a pre-publish lint that regex-checks `^[0-9a-f]{64}$` for both digest fields."],"exampleFix":"// before\n\"sha256\": \"sha256:AB12CD34...\"  // prefixed + uppercase\n\n// after\n\"sha256\": \"ab12cd34...\"  // 64 lowercase hex chars","handlingStrategy":"validation","validationCode":"// shell: emit bare lowercase hex digests\nSHA256=$(sha256sum \"$ASSET\" | cut -d' ' -f1)\nBLAKE3=$(b3sum \"$ASSET\" | cut -d' ' -f1)\n[[ \"$SHA256\" =~ ^[0-9a-f]{64}$ && \"$BLAKE3\" =~ ^[0-9a-f]{64}$ ]] || exit 1","typeGuard":"null","tryCatchPattern":"null","preventionTips":["Strip any `algorithm:` prefix from hashing tool output before embedding digests.","Always lowercase hex-encode digests; never paste base64 or uppercase output.","Compute digests from the final artifact bytes at publish time.","Regex-check `^[0-9a-f]{64}$` on both fields in CI before signing."],"tags":["schema-validation","hash","update-channel","rust"],"backgroundTag":"invalid-argument-format","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}