--offline: signed source member {file_name} is not local and

Error message

--offline: signed source member {file_name} is not local and network access is forbidden

What it means

fetch_signed_member fetches an individual file that is part of a signed source (e.g. signature or lock files). If the member file is not present locally next to the source and --offline is set, network access is forbidden and this error is thrown, naming the missing member file.

Source

Thrown at crates/astrid-cli/src/commands/init_signed_source.rs:248

/// Read a lock/sig sibling locally or at its matching remote path.
async fn fetch_signed_member(
    source: &str,
    offline: bool,
    file_name: &str,
) -> anyhow::Result<Vec<u8>> {
    let manifest_path = Path::new(source);
    if manifest_path.exists() && manifest_path.is_file() {
        let path = manifest_path
            .parent()
            .ok_or_else(|| anyhow::anyhow!("Distro.toml has no parent directory"))?
            .join(file_name);
        return std::fs::read(&path)
            .with_context(|| format!("failed to read signed source member {}", path.display()));
    }

    if offline {
        bail!(
            "--offline: signed source member {file_name} is not local and network access is forbidden"
        );
    }

    let mut url = url::Url::parse(&super::resolve_distro_url(source)?)?;
    url.path_segments_mut()
        .map_err(|()| anyhow::anyhow!("signed source URL cannot contain path segments"))?
        .pop()
        .push(file_name);
    fetch_url_bytes(url.as_str(), file_name, 1024 * 1024).await
}

async fn fetch_url_bytes(url: &str, name: &str, limit: usize) -> anyhow::Result<Vec<u8>> {
    let client = reqwest::Client::builder()
        .user_agent("astrid-cli")
        .timeout(std::time::Duration::from_secs(30))
        .build()?;
    let response = client

View on GitHub (pinned to affd8760f4)

Solutions

Copy the complete signed source bundle (including {file_name}) to the local directory before running with --offline.
Re-download the full signed Distro while online, then re-run offline.
If network is allowed, remove --offline so the member can be fetched from the distro URL.

Example fix

// before: only Distro.toml copied, Distro.toml.sig missing
astrid init --offline ./signed-distro/Distro.toml

// after: copy all members
scp distro-server:/distro/Distro.toml* ./signed-distro/
astrid init --offline ./signed-distro/Distro.toml

Defensive patterns

Strategy: validation

Validate before calling

# ensure all signed-source members exist locally before offline run
for f in Distro.toml Distro.toml.sig Distro.lock.toml; do
  [[ -f "signed-distro/$f" ]] || echo "missing signed member: $f"
done

Try / catch

// shell
if ! astrid init --offline ./signed-distro/Distro.toml 2>err.log; then
  grep -q 'not local and network access is forbidden' err.log && echo "copy the complete signed bundle first"
fi

Prevention

Copy the entire signed bundle (manifest, signature, lock) when moving to offline machines.
Verify bundle completeness with a checksum manifest after transfer.
Keep a single archive (.shuttle) of the signed source instead of loose files to avoid partial copies.

When it happens

Trigger: fetch_signed_manifest -> fetch_signed_member with a file_name that does not exist in the local directory alongside the source; the local-read branch fails to find it and the `if offline` check bails because fetching it over the network is disallowed.

Common situations: Partially downloaded signed source (manifest present but signature file missing) used with --offline; running init in an air-gapped environment where the signed Distro bundle was not fully copied over.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/c5bad9bd262b0b69. Report an issue: GitHub.