{"record":{"id":"dab1a1d6ee797e78","repo":"astrid-runtime/astrid","slug":"signed-channel-release-workflow-identity-is-invali","errorCode":null,"errorMessage":"signed channel release workflow identity is invalid","messagePattern":"signed channel release workflow identity is invalid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/update_channel.rs","lineNumber":535,"sourceCode":"    ensure!(\n        is_commit(&pointer.release.source_commit),\n        \"signed channel source commit is invalid\"\n    );\n    if let Some(commit) = nightly_commit {\n        ensure!(\n            commit == pointer.release.source_commit,\n            \"nightly channel version does not embed its source commit\"\n        );\n    }\n    ensure!(\n        pointer.release.metadata_asset == format!(\"astrid-{version}-release.toml\"),\n        \"signed channel release metadata asset is invalid\"\n    );\n    ensure!(\n        is_lower_hex_64(&pointer.release.metadata_blake3),\n        \"signed channel release metadata BLAKE3 is invalid\"\n    );\n    ensure!(\n        pointer.release.release_workflow_identity\n            == format!(\n                \"https://github.com/{REPOSITORY}/.github/workflows/release.yml@refs/tags/v{version}\"\n            ),\n        \"signed channel release workflow identity is invalid\"\n    );\n    validate_targets(&pointer.targets, &pointer.release.version)?;\n    Ok(())\n}\n\nfn nightly_source_commit(version: &semver::Version) -> Option<&str> {\n    let mut parts = version.pre.as_str().split('.');\n    let kind = parts.next()?;\n    let date = parts.next()?;\n    let commit = parts.next()?.strip_prefix('g')?;\n    if parts.next().is_some()\n        || kind != \"nightly\"\n        || date.len() != 8","sourceCodeStart":517,"sourceCodeEnd":553,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/update_channel.rs#L517-L553","documentation":"Pointer-integrity failure in validate_pointer: the signed channel pointer's release workflow identity field failed its structural check (expected the canonical workflow identity format for the release). validate_pointer enforces a chain of invariants on signed release pointers (commit hash, metadata asset name, BLAKE3 digest forms); this ensure! is one link in that chain, and failure means the pointer was tampered with, corrupted, or produced by a non-conforming release workflow. Reached via parse_channel and enforce_continuity.","triggerScenarios":"Thrown at crates/astrid-cli/src/commands/update_channel.rs:535 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-publish the pointer with the canonical workflow identity string","Verify the CI pipeline writes the identity unmodified","Refuse the update; fall back to the last trusted pointer"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}