astrid-runtime/astrid · error

nightly channel version does not embed its source commit

Error message

nightly channel version does not embed its source commit

What it means

Signature check in validate_pointer for the nightly channel: the version's prerelease/build metadata does not embed the release's source commit, so the pointer cannot prove the nightly binary was built from the commit it claims.

Solutions

1. Re-publish the nightly pointer with a version whose build/pre metadata embeds the source commit
2. Verify the release pipeline stamps the commit into the version string
3. Reject the channel update; fall back to the last known-good pointer

When it happens

Trigger: Thrown at crates/astrid-cli/src/commands/update_channel.rs:522 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/09dacfa45f733edb. Report an issue: GitHub.

Appendix: source

Thrown at crates/astrid-cli/src/commands/update_channel.rs:522

        UpdateChannel::Nightly => ensure!(
            nightly_commit.is_some() && version.build.is_empty(),
            "nightly channel must point to an exact nightly prerelease"
        ),
        UpdateChannel::Stable | UpdateChannel::Dev => ensure!(
            version.pre.is_empty() && version.build.is_empty(),
            "stable and dev channels must point to canonical releases"
        ),
    }
    ensure!(
        pointer.release.tag == format!("v{version}"),
        "signed channel release tag does not match its version"
    );
    ensure!(
        is_commit(&pointer.release.source_commit),
        "signed channel source commit is invalid"
    );
    if let Some(commit) = nightly_commit {
        ensure!(
            commit == pointer.release.source_commit,
            "nightly channel version does not embed its source commit"
        );
    }
    ensure!(
        pointer.release.metadata_asset == format!("astrid-{version}-release.toml"),
        "signed channel release metadata asset is invalid"
    );
    ensure!(
        is_lower_hex_64(&pointer.release.metadata_blake3),
        "signed channel release metadata BLAKE3 is invalid"
    );
    ensure!(
        pointer.release.release_workflow_identity
            == format!(
                "https://github.com/{REPOSITORY}/.github/workflows/release.yml@refs/tags/v{version}"
            ),
        "signed channel release workflow identity is invalid"

View on GitHub (pinned to affd8760f4)