astrid-runtime/astrid · error

distro '{distro_id}' has no signing-key pin at {} — install

Error message

distro '{distro_id}' has no signing-key pin at {} — install the operator-verified key before use; this path does not create a first-use pin

What it means

When the trust policy is RequireExistingPin, verify_and_pin refuses a distro that has no signing-key pin on record instead of creating a first-use pin (TOFU) implicitly. The operator must install a pre-verified pin before use; this closed path exists for high-assurance environments.

Source

Thrown at crates/astrid-cli/src/commands/distro/trust.rs:167

    let pinned = read_pinned(home, distro_id)?;
    let action = match pinned {
        Some(pin_key) if pin_key == pubkey => TrustAction::PinnedMatch,
        Some(pin_key) => {
            // Valid signature, but under a key that differs from the pin.
            if !accept_new_key {
                bail!(
                    "distro '{distro_id}' is pinned to {} but this artifact is signed by {} — \
                     refusing. Re-run with --accept-new-key only if you trust the new key.",
                    sign::pubkey_to_wire(&pin_key),
                    key_str,
                );
            }
            write_pin(home, distro_id, &key_str)?;
            TrustAction::NewKeyAccepted
        },
        None if policy == TrustPolicy::RequireExistingPin => {
            bail!(
                "distro '{distro_id}' has no signing-key pin at {} — install the operator-verified \
                 key before use; this path does not create a first-use pin",
                trust_path(home, distro_id).display()
            );
        },
        None => {
            write_pin(home, distro_id, &key_str)?;
            TrustAction::ToFuTrusted
        },
    };

    audit_trust(distro_id, &key_str, action);

    Ok(TrustOutcome {
        pubkey,
        key_str,
        action,
    })

View on GitHub (pinned to affd8760f4)

Solutions

1. Provision the operator-verified pin file at the trust path shown in the error before installing
2. Run a pin-installation/TOFU step explicitly as part of machine provisioning
3. Switch to a policy that permits first-use pinning if implicit TOFU is acceptable

Example fix

// before: no pin on fresh CI runner -> refused
// after: provision pin during setup
// astrid distro trust pin distro-id <verified-pubkey>

let pin_path = trust_path(home, distro_id);
if !pin_path.exists() {
    return Err(anyhow!("no pin for {distro_id}; provision it first"));
}

When it happens

Trigger: First install of a distro_id under TrustPolicy::RequireExistingPin where trust_path(home, distro_id) does not exist — no pin was ever provisioned on this machine.

Common situations: Fresh machines/CI runners provisioned without the operator's verified key pin; pin file deleted or home directory changed; onboarding a new distro under strict policy without the pin-distribution step.

Related errors

• durable capsule {id} manifest exceeds its authority receipt
• distro '{distro_id}' is pinned to {} but this artifact is si
• astrid distro apply requires a signed Distro; --allow-unsign
• manifest exceeds its installed capability approval: {details
• installed WASM executable differs from its authority receipt

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/8b65ff55f74cd261. Report an issue: GitHub.