astrid-runtime/astrid · error · io::Error

Astrid durable media is redirected or not a regular file: {}

Error message

Astrid durable media is redirected or not a regular file: {}

What it means

Thrown by validate_runtime_key_bootstrap (invoked from validate_fresh_root_entries) in crates/astrid-core/src/dirs.rs:514 when, during runtime-key provisioning, the keys directory contains an entry other than the expected runtime key file, or (per the message at this site) the durable media for the runtime key is a symlink or not a regular file. The bootstrap path must contain exactly the one expected key file as a regular file; anything else fails with InvalidData.

Source

Thrown at crates/astrid-core/src/dirs.rs:514

                        "Astrid durable media is redirected or not a regular file: {}",
                        path.display()
                    ),
                ));
            }
            crate::platform_fs::validate_private_file(&path)?;
            state = UnsentinelledRootState::StoppedVolume;
        }
        Ok(state)
    }

    fn validate_runtime_key_bootstrap(&self, keys_dir: &Path) -> io::Result<()> {
        crate::platform_fs::validate_private_directory(keys_dir)?;
        let mut entries = keys_dir.read_dir()?.collect::<Result<Vec<_>, _>>()?;
        entries.sort_by_key(std::fs::DirEntry::file_name);
        for entry in entries {
            let path = entry.path();
            if path != self.runtime_key_path() {
                return Err(io::Error::new(
                    io::ErrorKind::InvalidData,
                    format!(
                        "unadmitted entry in the fresh runtime-key bootstrap: {}",
                        path.display()
                    ),
                ));
            }
            crate::platform_fs::validate_private_file(&path)?;
        }
        Ok(())
    }

    /// Root directory path (`~/.astrid/`).
    #[must_use]
    pub fn root(&self) -> &Path {
        &self.root
    }

View on GitHub (pinned to affd8760f4)

Solutions

  1. Empty the keys directory so it contains only the expected runtime key file, then re-run provisioning.
  2. Replace any symlinked/non-regular key file with a real regular file (copy the bytes, don't link).
  3. Regenerate the runtime key through the normal provisioning flow if the existing material is untrusted.
  4. Check with symlink_metadata (`ls -la`) that the key is a regular file before provisioning.

Example fix

# before
$ ls -la ~/.astrid/keys
runtime.key -> /run/secrets/key
error: Astrid durable media is redirected or not a regular file

# after
$ rm ~/.astrid/keys/runtime.key
$ cp /run/secrets/key ~/.astrid/keys/runtime.key
$ chmod 600 ~/.astrid/keys/runtime.key
Defensive patterns

Strategy: validation

Validate before calling

// Rust
fn keys_dir_clean(keys_dir: &Path, expected_key: &Path) -> io::Result<()> {
    for entry in std::fs::read_dir(keys_dir)? {
        let path = entry?.path();
        let md = std::fs::symlink_metadata(&path)?;
        if path != expected_key || md.file_type().is_symlink() || !md.is_file() {
            return Err(io::Error::new(io::ErrorKind::InvalidData,
                format!("bad keys dir entry: {}", path.display())));
        }
    }
    Ok(())
}

Type guard

fn is_regular_key_file(path: &Path) -> bool {
    std::fs::symlink_metadata(path)
        .map(|md| !md.file_type().is_symlink() && md.is_file())
        .unwrap_or(false)
}

Try / catch

match provisioning_result {
    Err(e) if e.kind() == io::ErrorKind::InvalidData => {
        // clean keys dir of extra entries, replace symlinks with real files, retry
    }
    r => r?,
}

Prevention

When it happens

Trigger: Running validate_runtime_identity_provisioning/ensure() when keys_dir contains extra files (leftover keys, editor backups like key.bak, .DS_Store), or the runtime key file itself is a symlink or non-regular file (redirected media).

Common situations: Re-provisioning after a partial install left stale key material; users symlinking key files into secret managers or mounted secrets; backup-restore tools recreating keys as directories or symlinks.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/94319bc303071e7e. Report an issue: GitHub.