astrid distro apply requires a signed Distro; --allow-unsign

Error message

astrid distro apply requires a signed Distro; --allow-unsigned is not acceptance

What it means

`astrid distro apply` enforces that a Distro must be signed; passing --allow-unsigned does not constitute acceptance of an unsigned distro, so the CLI deliberately refuses the operation. This is a policy check that runs before any install takes place, guaranteeing unsigned distros can never be applied even when the user asks to bypass the check.

Source

Thrown at crates/astrid-cli/src/dispatch.rs:510

async fn dispatch_distro(command: DistroCommands) -> Result<ExitCode> {
    match command {
        DistroCommands::Apply {
            name,
            agent,
            yes,
            offline,
            allow_unsigned,
            accept_new_key,
            vars,
        } => {
            if agent.is_some() {
                return Ok(commands::stub::deferred(
                    "distro apply -a <agent>",
                    &[tracker_657()],
                ));
            }
            if allow_unsigned {
                anyhow::bail!(
                    "astrid distro apply requires a signed Distro; --allow-unsigned is not acceptance"
                );
            }
            let distro = non_empty_distro_source(name).ok_or_else(|| {
                anyhow::anyhow!(
                    "astrid distro apply requires an explicit distro source: @owner/repo, URL, local Distro.toml, or .shuttle; Astrid Runtime does not choose a product distro"
                )
            })?;
            let opts = commands::init::InitOpts {
                yes,
                offline,
                allow_unsigned,
                accept_new_key,
                vars: commands::init::parse_cli_vars(&vars)?,
                target_principal: crate::principal::current(),
                // `distro apply` has no `--grant-capsules` surface; granting
                grant_capsules: false,
                require_signed: true,

View on GitHub (pinned to affd8760f4)

Solutions

Remove --allow-unsigned from the command.
Obtain a signed Distro (or a signature over the existing Distro) from the distro publisher.
Point the command at a signed source: @owner/repo, a URL, a local Distro.toml, or a .shuttle file.
If tests reference this flag, update them to expect rejection (see distro_apply_rejects_unsigned_acceptance_before_install).

Example fix

// before
astrid distro apply --allow-unsigned -a myagent @owner/repo
// after
astrid distro apply -a myagent @owner/repo   # distro must be signed

Defensive patterns

Strategy: validation

Validate before calling

fn distro_apply_cmd_is_valid(args: &[String]) -> bool {
    !args.iter().any(|a| a == "--allow-unsigned") && args.iter().any(|a| a.starts_with('@') || a.starts_with("http") || a.ends_with("Distro.toml") || a.ends_with(".shuttle"))
}

Try / catch

match dispatch_distro(cmd) {
    Ok(code) => code,
    Err(e) if e.to_string().contains("--allow-unsigned is not acceptance") => {
        eprintln!("Unsigned distros cannot be applied; provide a signed distro source");
        ExitCode::FAILURE
    }
    Err(e) => { eprintln!("{e:#}"); ExitCode::FAILURE }
}

Prevention

Remove --allow-unsigned from scripts and CI configs — it is never valid.
Verify distro signatures before applying (publisher-side signing step in CI).
Always pass an explicit source: @owner/repo, URL, Distro.toml, or .shuttle.
Track the tracker issue (tracker_657) for the deferred full implementation.

When it happens

Trigger: Running `astrid distro apply --allow-unsigned ...` with any distro source; the flag is rejected unconditionally before resolving the distro source.

Common situations: Scripts or CI pipelines migrated from an older workflow that permitted unsigned distros; users who previously relied on --allow-unsigned to skip signature checks after a security hardening change.

Understand the failure class

Background: "unknown output mode", "invalid value for flag", "expects true/false": fixing invalid flag value errors in CLI tools — this error's family across 24 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/dc2efe0b434cdaca. Report an issue: GitHub.