astrid-runtime/astrid · error

Distro.lock identity does not match the signed Distro.toml

Error message

Distro.lock identity does not match the signed Distro.toml

What it means

validate_signed_member_sets enforces that the Distro.lock describes exactly the same distribution as the signed Distro.toml before any capsule is resolved. It first compares schema_version, distro.id, and distro.version; any difference means the lock belongs to a different distribution identity than the authenticated manifest, so it bails rather than resolving members. This prevents mixing members across distro versions or entirely different distros.

Source

Thrown at crates/astrid-cli/src/commands/init_signed_source.rs:337

    Ok(lock
        .capsules
        .iter()
        .filter_map(|capsule| {
            capsule
                .resolved_ref
                .clone()
                .map(|resolved_ref| (capsule.name.clone(), resolved_ref))
        })
        .collect())
}

/// Require the signed lock to describe exactly the authenticated TOML members.
fn validate_signed_member_sets(manifest: &DistroManifest, lock: &DistroLock) -> anyhow::Result<()> {
    if lock.schema_version != manifest.schema_version
        || lock.distro.id != manifest.distro.id
        || lock.distro.version != manifest.distro.version
    {
        bail!("Distro.lock identity does not match the signed Distro.toml");
    }

    let declared: HashMap<&str, &DistroCapsule> = manifest
        .capsules
        .iter()
        .map(|capsule| (capsule.name.as_str(), capsule))
        .collect();
    anyhow::ensure!(
        declared.len() == manifest.capsules.len() && lock.capsules.len() == declared.len(),
        "signed Distro.lock members do not match Distro.toml declarations"
    );
    for capsule in &lock.capsules {
        let declared_capsule = declared
            .get(capsule.name.as_str())
            .copied()
            .ok_or_else(|| {
                anyhow::anyhow!(
                    "signed Distro.lock contains undeclared capsule '{}'",

View on GitHub (pinned to affd8760f4)

Solutions

1. Align versions: regenerate Distro.lock from the current signed Distro.toml so schema_version, distro.id, and distro.version all match.
2. If you meant the older version, fetch the signed Distro.toml for the distro version recorded in your lock instead.
3. Check for a schema-version upgrade requiring a tooling update — upgrade the CLI and re-lock.
4. Ensure the lock file actually belongs to this distro (matching id); if copied from another project, delete it and re-init.

Example fix

// before (Distro.lock)
distro = { id = "mydistro", version = "1.2.0" }
// after (regenerated to match signed Distro.toml)
distro = { id = "mydistro", version = "1.3.0" }

let identity_matches = lock.schema_version == manifest.schema_version
    && lock.distro.id == manifest.distro.id
    && lock.distro.version == manifest.distro.version;
if !identity_matches {
    eprintln!("Distro.lock was generated for a different distro/version; re-lock");
}

match verify_signed_manifest(&client, &url, &manifest_hash, &lock, accept_new_key).await {
    Err(e) if e.to_string().contains("identity does not match") => {
        eprintln!("Lock belongs to {} {}, manifest is {} {} — regenerate the lock",
            lock.distro.id, lock.distro.version, manifest.distro.id, manifest.distro.version);
        Err(e)
    }
    other => other,
}

When it happens

Trigger: verify_signed_manifest calls validate_signed_member_sets with the signed DistroManifest and DistroLock; lock.schema_version != manifest.schema_version, or lock.distro.id != manifest.distro.id, or lock.distro.version != manifest.distro.version.

Common situations: Upstream released distro version 1.3.0 but the lock still records 1.2.0; lock file copied from a different distro project (id mismatch); manifest or lock schema upgraded by a tooling version bump; user checked out an old branch whose lock predates the signed manifest's version bump.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• signed Distro.toml does not match Distro.lock manifest_hash;
• signed Distro.lock entry '{}' does not match Distro.toml
• installed capsule identity/version differs from its authorit
• durable capsule {id} version differs across package records
• installed Capsule.toml differs from the exact manifest appro

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/4fc8d3f15cf13d44. Report an issue: GitHub.