{"record":{"id":"dc2efe0b434cdaca","repo":"astrid-runtime/astrid","slug":"astrid-distro-apply-requires-a-signed-distro-al","errorCode":null,"errorMessage":"astrid distro apply requires a signed Distro; --allow-unsigned is not acceptance","messagePattern":"astrid distro apply requires a signed Distro; --allow-unsigned is not acceptance","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/dispatch.rs","lineNumber":510,"sourceCode":"async fn dispatch_distro(command: DistroCommands) -> Result<ExitCode> {\n    match command {\n        DistroCommands::Apply {\n            name,\n            agent,\n            yes,\n            offline,\n            allow_unsigned,\n            accept_new_key,\n            vars,\n        } => {\n            if agent.is_some() {\n                return Ok(commands::stub::deferred(\n                    \"distro apply -a <agent>\",\n                    &[tracker_657()],\n                ));\n            }\n            if allow_unsigned {\n                anyhow::bail!(\n                    \"astrid distro apply requires a signed Distro; --allow-unsigned is not acceptance\"\n                );\n            }\n            let distro = non_empty_distro_source(name).ok_or_else(|| {\n                anyhow::anyhow!(\n                    \"astrid distro apply requires an explicit distro source: @owner/repo, URL, local Distro.toml, or .shuttle; Astrid Runtime does not choose a product distro\"\n                )\n            })?;\n            let opts = commands::init::InitOpts {\n                yes,\n                offline,\n                allow_unsigned,\n                accept_new_key,\n                vars: commands::init::parse_cli_vars(&vars)?,\n                target_principal: crate::principal::current(),\n                // `distro apply` has no `--grant-capsules` surface; granting\n                grant_capsules: false,\n                require_signed: true,","sourceCodeStart":492,"sourceCodeEnd":528,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/dispatch.rs#L492-L528","documentation":"`astrid distro apply` enforces that a Distro must be signed; passing --allow-unsigned does not constitute acceptance of an unsigned distro, so the CLI deliberately refuses the operation. This is a policy check that runs before any install takes place, guaranteeing unsigned distros can never be applied even when the user asks to bypass the check.","triggerScenarios":"Running `astrid distro apply --allow-unsigned ...` with any distro source; the flag is rejected unconditionally before resolving the distro source.","commonSituations":"Scripts or CI pipelines migrated from an older workflow that permitted unsigned distros; users who previously relied on --allow-unsigned to skip signature checks after a security hardening change.","solutions":["Remove --allow-unsigned from the command.","Obtain a signed Distro (or a signature over the existing Distro) from the distro publisher.","Point the command at a signed source: @owner/repo, a URL, a local Distro.toml, or a .shuttle file.","If tests reference this flag, update them to expect rejection (see distro_apply_rejects_unsigned_acceptance_before_install)."],"exampleFix":"// before\nastrid distro apply --allow-unsigned -a myagent @owner/repo\n// after\nastrid distro apply -a myagent @owner/repo   # distro must be signed","handlingStrategy":"validation","validationCode":"fn distro_apply_cmd_is_valid(args: &[String]) -> bool {\n    !args.iter().any(|a| a == \"--allow-unsigned\") && args.iter().any(|a| a.starts_with('@') || a.starts_with(\"http\") || a.ends_with(\"Distro.toml\") || a.ends_with(\".shuttle\"))\n}","typeGuard":null,"tryCatchPattern":"match dispatch_distro(cmd) {\n    Ok(code) => code,\n    Err(e) if e.to_string().contains(\"--allow-unsigned is not acceptance\") => {\n        eprintln!(\"Unsigned distros cannot be applied; provide a signed distro source\");\n        ExitCode::FAILURE\n    }\n    Err(e) => { eprintln!(\"{e:#}\"); ExitCode::FAILURE }\n}","preventionTips":["Remove --allow-unsigned from scripts and CI configs — it is never valid.","Verify distro signatures before applying (publisher-side signing step in CI).","Always pass an explicit source: @owner/repo, URL, Distro.toml, or .shuttle.","Track the tracker issue (tracker_657) for the deferred full implementation."],"tags":["cli","security","signing","policy"],"backgroundTag":"invalid-flag-value","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}