{"record":{"id":"d2c862b874397743","repo":"astrid-runtime/astrid","slug":"installed-wasm-integrity-check-failed-expected-bl-d2c862","errorCode":null,"errorMessage":"installed WASM integrity check failed: expected BLAKE3 {expected}, got {actual}","messagePattern":"installed WASM integrity check failed: expected BLAKE3 (.+?), got (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-capsule-install/src/wasm.rs","lineNumber":135,"sourceCode":"        .ok_or_else(|| anyhow::anyhow!(\"WASM catalog entry is missing: bin/{hash}.wasm\"))?;\n    storage\n        .content()\n        .read_range(&StateOwner::System, &name, 0, descriptor.logical_bytes())\n        .map_err(|error| anyhow::anyhow!(error))\n        .context(\"read WASM from system catalog\")?\n        .ok_or_else(|| anyhow::anyhow!(\"WASM catalog entry has no readable bytes: bin/{hash}.wasm\"))\n}\n\n/// Verify that the system catalog entry for `expected` exists and hashes to\n/// its content-addressed name.\npub fn catalog_wasm_hash(\n    storage: &RuntimePrincipalStore,\n    expected: &str,\n) -> anyhow::Result<String> {\n    let actual = blake3::hash(&read_catalog_wasm(storage, expected)?)\n        .to_hex()\n        .to_string();\n    anyhow::ensure!(\n        actual == expected,\n        \"installed WASM integrity check failed: expected BLAKE3 {expected}, got {actual}\"\n    );\n    Ok(actual)\n}\n\n#[cfg(test)]\nmod tests {\n    use super::*;\n    use astrid_capsule::discovery::load_manifest;\n    use astrid_storage::{KvQuotaResolver, open_runtime_principal_store};\n    use std::sync::Arc;\n\n    fn unlimited_quota() -> Arc<dyn KvQuotaResolver<StateOwner>> {\n        Arc::new(|owner: &StateOwner| {\n            Ok(match owner {\n                StateOwner::System => None,\n                StateOwner::Principal(_) | StateOwner::Fleet(_) => Some(u64::MAX),","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-capsule-install/src/wasm.rs#L117-L153","documentation":"Integrity assertion in catalog_wasm_hash: after reading the installed WASM back from the system catalog, its BLAKE3 digest does not equal the expected content-addressed hash. This means the bytes stored under bin/{expected}.wasm are not the bytes the name promises — corruption or substitution of installed WASM.","triggerScenarios":"catalog_wasm_hash(storage, expected) is called; read_catalog_wasm succeeds, blake3::hash of the bytes differs from `expected`, and anyhow::ensure! fires.","commonSituations":"Disk corruption or bit-rot in the content store; a process rewrote the catalog entry with different bytes under the same name; artifact modified after install (antivirus/quarantine rewrite); comparing a hash computed with a different algorithm/version against stored content; stale entry from a previous build published under a reused name.","solutions":["Re-install the WASM so the catalog entry is republished from the trusted source and the hash matches","Compare the actual hash against the source artifact's BLAKE3 to determine if the store corrupted the bytes or the expected hash is wrong","Check for external processes (AV, sync tools) modifying files inside the content store","Confirm hash string casing/format matches (hex, no 0x prefix) on both sides"],"exampleFix":"// before\nanyhow::ensure!(actual == expected, \"installed WASM integrity check failed: expected BLAKE3 {expected}, got {actual}\");\n// after: recover by republishing instead of hard-failing\nif actual != expected {\n    republish_wasm(storage, expected_bytes)?; // rewrite catalog entry from trusted source\n}\nanyhow::ensure!(actual == expected, \"installed WASM integrity check failed: expected BLAKE3 {expected}, got {actual}\");","handlingStrategy":"try-catch","validationCode":"// verify before trusting the installed capsule\nlet actual = blake3::hash(&read_catalog_wasm(&storage, &expected)?).to_hex().to_string();\nif actual != expected {\n    eprintln!(\"installed WASM corrupted; republishing from source\");\n    republish_wasm(&storage, &source_bytes)?;\n}","typeGuard":null,"tryCatchPattern":"match catalog_wasm_hash(&storage, &expected) {\n    Ok(actual) => actual,\n    Err(e) if e.to_string().contains(\"integrity check failed\") => {\n        republish_wasm(&storage, &source_bytes)?; // self-heal from trusted source\n        catalog_wasm_hash(&storage, &expected)?\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Always verify content-addressed entries by hashing after install","Exclude the content store from antivirus/sync tools that rewrite files","Treat any integrity mismatch as store corruption: republish, never bypass the check"],"tags":["rust","wasm","integrity","blake3","corruption"],"backgroundTag":"checksum-mismatch","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}