private host-file permissions are unavailable on this target

Error message

private host-file permissions are unavailable on this target

What it means

restrict_private_file() tightens a file's permissions so only the owner can read/write it. On targets that are neither Unix nor Windows the platform permission APIs are unavailable, so it returns io::ErrorKind::Unsupported with this message instead of silently leaving the file permissive.

Source

Thrown at crates/astrid-core/src/platform_fs.rs:261

/// # Errors
///
/// Returns an error if the file is missing, not regular, redirected, or cannot
/// be secured and validated.
pub fn restrict_private_file(path: &Path) -> io::Result<()> {
    #[cfg(windows)]
    {
        windows::restrict_private_file(path)
    }

    #[cfg(unix)]
    {
        restrict_private_file_unix(path)
    }

    #[cfg(not(any(unix, windows)))]
    {
        let _ = path;
        Err(io::Error::new(
            io::ErrorKind::Unsupported,
            "private host-file permissions are unavailable on this target",
        ))
    }
}

/// Validate that an existing private file still has the platform's required
/// access policy.
///
/// On Unix the existing mode checks remain with their current callers.
///
/// # Errors
///
/// Returns an error on Windows for an unexpected owner, permissive or inherited
/// ACL, reparse point, or non-regular file.
pub fn validate_private_file(path: &Path) -> io::Result<()> {
    #[cfg(windows)]
    {

View on GitHub (pinned to affd8760f4)

Solutions

Restrict file permissions only on unix/windows targets; on other targets skip the restriction or implement a platform backend.
Guard the call site with cfg!(any(unix, windows)) and handle the else branch explicitly.
If security is required on this target, the platform backend must be added in platform_fs.rs; there is no caller-side fix.

Example fix

// before
restrict_private_file(&path)?;
// after
#[cfg(any(unix, windows))]
restrict_private_file(&path)?;
#[cfg(not(any(unix, windows)))]
let _ = &path; // permissions unsupported on this target

Defensive patterns

Strategy: fallback

Validate before calling

let supported = cfg!(any(unix, windows));
if supported { restrict_private_file(&path)?; }

Type guard

fn supports_file_permissions() -> bool { cfg!(any(unix, windows)) }

Try / catch

match restrict_private_file(&path) {
    Err(e) if e.kind() == io::ErrorKind::Unsupported => log::warn!("permission restriction unavailable here"),
    other => other?,
}

Prevention

Gate permission-sensitive code with cfg(any(unix, windows))
Skip private-file workflows on unsupported targets by design, not at runtime
Add CI coverage for every target OS in your build matrix

When it happens

Trigger: Calling restrict_private_file(path) (directly or via read_private_file_to_string) on a non-unix/non-windows target.

Common situations: Compiling for wasm or an embedded/other OS target and attempting the private-file workflow; CI matrix running the library on an unsupported host.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/5e8a2eacb72bb6ce. Report an issue: GitHub.