astrid-runtime/astrid · error

{label} release metadata does not match the authenticated le

Error message

{label} release metadata does not match the authenticated legacy release

What it means

This error is thrown by verify_release_extension after the metadata identity passes, when the extension's version, tag, source_commit, or release_workflow_identity fields do not exactly match the corresponding fields of the authenticated ChannelPointer release record. It ensures the extension metadata is bound to the exact legacy release the user is being updated to, preventing a mixed or replayed metadata file describing a different release.

Source

Thrown at crates/astrid-cli/src/commands/update_channel.rs:664

    label: &str,
) -> anyhow::Result<String> {
    ensure!(
        expected_targets.contains(&target),
        "{label} release metadata does not support target '{target}'"
    );
    let text = std::str::from_utf8(bytes)
        .with_context(|| format!("{label} release metadata is not UTF-8"))?;
    let extension: ReleaseExtension = toml::from_str(text)
        .with_context(|| format!("{label} release metadata is invalid TOML"))?;
    ensure!(
        extension.schema_version == 1
            && extension.kind == expected_kind
            && extension.product == PRODUCT
            && extension.repository == REPOSITORY,
        "{label} release metadata identity is invalid"
    );
    canonical_version(&extension.version)?;
    ensure!(
        extension.version == pointer.release.version
            && extension.tag == pointer.release.tag
            && extension.source_commit == pointer.release.source_commit
            && extension.release_workflow_identity == pointer.release.release_workflow_identity,
        "{label} release metadata does not match the authenticated legacy release"
    );
    ensure!(
        extension.legacy_release.metadata_asset == pointer.release.metadata_asset
            && extension.legacy_release.metadata_blake3 == pointer.release.metadata_blake3
            && blake3::hash(legacy_manifest_bytes).to_hex().as_str()
                == extension.legacy_release.metadata_blake3,
        "{label} release metadata does not bind the authenticated legacy release manifest"
    );
    validate_targets_for(
        &extension.targets,
        expected_targets,
        &extension.version,
        &format!("{label} release metadata"),

View on GitHub (pinned to affd8760f4)

Solutions

1. Re-download the extension metadata from the same release the channel pointer authenticates (same version, tag, source_commit, release_workflow_identity)
2. Purge CDN/proxy caches so the metadata asset matches the current pointer.release
3. Regenerate the extension metadata in the release workflow so its fields match the final release record
4. Verify the channel pointer itself was not advanced to a release whose metadata asset failed to publish

Example fix

// before: stale cached metadata from the previous release
metadata_asset = "astrid-release-musl-extension-v1.2.3.toml"  // pointer says v1.2.4
// after: metadata bound to the pointer's exact release
metadata_asset = "astrid-release-musl-extension-v1.2.4.toml"

fn extension_matches_pointer(ext: &ReleaseExtension, pointer: &ChannelPointer) -> bool {
    ext.version == pointer.release.version
        && ext.tag == pointer.release.tag
        && ext.source_commit == pointer.release.source_commit
        && ext.release_workflow_identity == pointer.release.release_workflow_identity
}

fn is_current_release(ext: &ReleaseExtension, expected_version: &str) -> bool {
    canonical_version(&ext.version).is_ok() && ext.version == expected_version
}

match verify_release_extension(&bytes, &manifest, &pointer, target, kind, targets, label) {
    Ok(blake3) => proceed(blake3),
    Err(e) if e.to_string().contains("does not match the authenticated legacy release") => {
        eprintln!("stale/mismatched metadata; re-fetching channel pointer and assets");
        refresh_pointer_and_retry();
    }
    Err(e) => return Err(e),
}

When it happens

Trigger: Calling resolve_target_blake3 / verify_musl_extension / verify_windows_extension with extension metadata whose version is not a canonical version (canonical_version fails first) or whose version/tag/source_commit/release_workflow_identity differ from pointer.release — e.g. metadata from an older release paired with a newer channel pointer, or a re-tagged release where source_commit or workflow identity changed.

Common situations: CDN cache serving stale extension metadata for a previous version while the channel pointer was already advanced; re-running a release workflow so release_workflow_identity changed but the metadata asset was not regenerated; manually pinning an older metadata file during testing.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• capsule identity or version changed after authority decision
• signed channel generation rollback rejected
• signed channel same-generation equivocation rejected
• {label} release metadata identity is invalid
• {label} release metadata does not bind the authenticated leg

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/5307ea24bbca75ed. Report an issue: GitHub.