installed WASM integrity check failed: expected BLAKE3 {expe

Error message

installed WASM integrity check failed: expected BLAKE3 {expected}, got {actual}

What it means

After reading the installed WASM bytes, the library recomputes the BLAKE3 hash and compares it to the expected value recorded in meta.json. Any difference means the installed binary is corrupt or tampered with, so the integrity check fails with both hashes in the message.

Source

Thrown at crates/astrid-capsule-install/src/authority.rs:643

    }
    let executable = if component.path.is_absolute() {
        component.path.clone()
    } else {
        let local = target_dir.join(&component.path);
        if local.exists() {
            local
        } else {
            home.bin_dir().join(format!("{expected}.wasm"))
        }
    };
    let mut bytes = Vec::new();
    std::fs::File::open(&executable)
        .with_context(|| format!("failed to open installed WASM {}", executable.display()))?
        .read_to_end(&mut bytes)
        .with_context(|| format!("failed to read installed WASM {}", executable.display()))?;
    let actual = blake3::hash(&bytes).to_hex().to_string();
    if actual != expected {
        bail!("installed WASM integrity check failed: expected BLAKE3 {expected}, got {actual}");
    }
    Ok(Some(actual))
}

/// A decision bound to one previously inspected content digest.
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum AuthorityDecision {
    /// Accept only when the artifact is signed by this runtime.
    Automatic,
    /// One-install approval for the exact digest.
    ExplicitApproval {
        /// Digest shown to and approved by the caller.
        content_digest: String,
    },
    /// Product/operator-owned distro acceptance for the exact digest.
    OperatorDistribution {
        /// Digest verified by the distribution install path.
        content_digest: String,

View on GitHub (pinned to affd8760f4)

Solutions

Reinstall the capsule from a trusted artifact so the wasm matches the recorded hash
Verify the source artifact's hash matches meta.json, then re-copy the wasm into place
Check storage health / re-download the capsule package if corruption recurs

Example fix

// before
// corrupted installed wasm
verify_installed_authority(&home, &target_dir, &manifest, None)?;
// after
blake3sum downloaded-module.wasm   # confirm matches meta.json wasm_hash
cp downloaded-module.wasm ~/.astrid/capsules/my-capsule/module.wasm

Defensive patterns

Strategy: validation

Validate before calling

let bytes = std::fs::read(&wasm_path)?;
let actual = blake3::hash(&bytes).to_hex().to_string();
if actual != meta.wasm_hash {
    return Err(anyhow!("wasm integrity failed: expected {}, got {} — reinstall", meta.wasm_hash, actual));
}

Prevention

Verify hashes of downloaded artifacts before installing
Use checksums when copying capsules between machines
Re-run install after any interrupt instead of trusting partial files

When it happens

Trigger: verified_installed_wasm_hash opens the installed executable, hashes it with blake3::hash, and actual != expected (the meta.json wasm_hash).

Common situations: Disk corruption or truncated download of the .wasm; overwriting the installed wasm with a different build; interrupted install leaving a partial file.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/1ba20c7899c5df93. Report an issue: GitHub.