astrid-runtime/astrid · critical

durable capsule {id} identity differs across archive and aut

Error message

durable capsule {id} identity differs across archive and authority

What it means

This error is thrown by verify_package_identity when a capsule's identity is not consistent across the two sources of truth: the authority receipt's capsule_id and the archive manifest's package.name must both equal the requested capsule id. The library treats this as tampering or corruption — a capsule whose archive and signed authority record disagree about who it is must never be installed or loaded. It guards the durable install path (read_verified_durable_package_for_owner) against mismatched or repackaged artifacts.

Source

Thrown at crates/astrid-capsule-install/src/storage.rs:267

}

fn verify_package_identity(
    id: &str,
    manifest: &CapsuleManifest,
    metadata: &CapsuleMeta,
    authority: &InstalledAuthority,
    manifest_bytes: &[u8],
    verification: &ArtifactVerification,
    archive_files: &std::collections::BTreeMap<String, Vec<u8>>,
) -> anyhow::Result<()> {
    if authority.schema_version != 1 {
        bail!(
            "durable capsule {id} has unsupported authority schema {}",
            authority.schema_version
        );
    }
    if authority.capsule_id != id || manifest.package.name != id {
        bail!("durable capsule {id} identity differs across archive and authority");
    }
    if authority.version != manifest.package.version || metadata.version != authority.version {
        bail!("durable capsule {id} version differs across package records");
    }
    let manifest_digest = crate::authority::digest_manifest(manifest_bytes);
    if authority.manifest_digest != manifest_digest {
        bail!("durable capsule {id} manifest digest differs from authority receipt");
    }
    if authority.content_digest != verification.content_digest() {
        bail!("durable capsule {id} content digest differs from authority receipt");
    }
    let expected_imports = crate::wit::version_map_to_strings(&manifest.imports, |definition| {
        definition.version.to_string()
    });
    if metadata.imports != expected_imports {
        bail!("durable capsule {id} imports differ between metadata and archive");
    }
    let expected_exports = crate::wit::version_map_to_strings(&manifest.exports, |definition| {

View on GitHub (pinned to affd8760f4)

Solutions

1. Reinstall the capsule from a freshly published archive so the authority receipt and manifest are regenerated together.
2. Check that the id passed to read_verified_durable_package_for_owner exactly matches manifest.package.name in the archive (case-sensitive).
3. Reissue the authority record with the correct capsule_id if the package was legitimately renamed.
4. Inspect the install directory for cross-contaminated manifest/authority files and remove the corrupted capsule.

Example fix

// before: loading capsule under mismatched id
let pkg = store.read_verified_durable_package_for_owner(owner, "my-capsule")?;
// after: ensure the id matches the manifest's package name before loading
let manifest = parse_manifest(&archive_bytes)?;
assert_eq!(manifest.package.name, "my-capsule");
let pkg = store.read_verified_durable_package_for_owner(owner, "my-capsule")?;

fn capsule_identity_matches(id: &str, manifest: &CapsuleManifest, authority: &InstalledAuthority) -> bool {
    authority.capsule_id == id && manifest.package.name == id
}
// call before read_verified_durable_package_for_owner

fn is_expected_capsule(a: &InstalledAuthority, id: &str) -> bool { a.capsule_id == id }

match store.read_verified_durable_package_for_owner(owner, id) {
    Ok(pkg) => pkg,
    Err(e) if e.to_string().contains("identity differs across archive and authority") => {
        // reinstall from canonical archive
        store.install(owner, &canonical_archive)?
    }
    Err(e) => return Err(e),
}

When it happens

Trigger: Calling read_verified_durable_package_for_owner (or the test-path durable_metadata_cross_binding_rejects_manifest_and_archive_mismatches) with an archive where manifest.package.name != the requested id, or where the InstalledAuthority receipt was issued for a different capsule_id than the one being resolved.

Common situations: Manually renaming a package in CapsuleManifest without reissuing the authority receipt; mixing up archive files between two capsules during copy/restore; installing a capsule under a different id/owner directory than it was signed for; hand-edited metadata after an interrupted install.

Related errors

• installed capsule identity/version differs from its authorit
• installed Capsule.toml differs from the exact manifest appro
• durable capsule {id} version differs across package records
• durable capsule {id} manifest digest differs from authority
• durable capsule {id} content digest differs from authority r

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/5943a5158e44aa30. Report an issue: GitHub.