{"record":{"id":"de6379974ce8d9dd","repo":"astrid-runtime/astrid","slug":"release-manifest-identity-is-invalid","errorCode":null,"errorMessage":"release manifest identity is invalid","messagePattern":"release manifest identity is invalid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/update_channel.rs","lineNumber":577,"sourceCode":"            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))\n    {\n        return None;\n    }\n    Some(commit)\n}\n\npub(super) fn verify_release_manifest(\n    bytes: &[u8],\n    pointer: &ChannelPointer,\n) -> anyhow::Result<()> {\n    ensure!(\n        blake3::hash(bytes).to_hex().as_str() == pointer.release.metadata_blake3,\n        \"immutable release manifest does not match the channel BLAKE3 digest\"\n    );\n    let text = std::str::from_utf8(bytes).context(\"release manifest is not UTF-8\")?;\n    let manifest: ReleaseManifest =\n        toml::from_str(text).context(\"release manifest is invalid TOML\")?;\n    ensure!(\n        manifest.schema_version == 1\n            && manifest.kind == \"astrid-release\"\n            && manifest.product == PRODUCT\n            && manifest.repository == REPOSITORY,\n        \"release manifest identity is invalid\"\n    );\n    ensure!(\n        manifest.version == pointer.release.version\n            && manifest.tag == pointer.release.tag\n            && manifest.source_commit == pointer.release.source_commit\n            && manifest.release_workflow_identity == pointer.release.release_workflow_identity,\n        \"release manifest does not match the signed channel pointer\"\n    );\n    ensure!(\n        manifest.contracts.repository == CONTRACTS_REPOSITORY\n            && is_commit(&manifest.contracts.commit),\n        \"release manifest contracts identity is invalid\"\n    );","sourceCodeStart":559,"sourceCodeEnd":595,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/update_channel.rs#L559-L595","documentation":"Identity check in verify_release_manifest: the parsed release TOML's schema_version/kind/product/repository do not match the expected values, so the manifest is not a genuine release manifest for this product and the channel resolution aborts.","triggerScenarios":"Thrown at crates/astrid-cli/src/commands/update_channel.rs:577 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-download the release manifest from the trusted channel location","Verify the BLAKE3 digest matched — a mismatch upstream usually triggers first","Re-publish the manifest if the release pipeline emitted wrong identity fields"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}