private host-file validation is unavailable on this target

Error message

private host-file validation is unavailable on this target

What it means

validate_private_file() checks that an existing file satisfies the private-file policy (correct owner and no group/other access, e.g. no external hard links or permissive modes). On targets that are neither Unix nor Windows this check cannot be performed, so it fails with io::ErrorKind::Unsupported.

Source

Thrown at crates/astrid-core/src/platform_fs.rs:291

/// # Errors
///
/// Returns an error on Windows for an unexpected owner, permissive or inherited
/// ACL, reparse point, or non-regular file.
pub fn validate_private_file(path: &Path) -> io::Result<()> {
    #[cfg(windows)]
    {
        windows::validate_private_file(path)
    }

    #[cfg(unix)]
    {
        validate_private_file_unix(path)
    }

    #[cfg(not(any(unix, windows)))]
    {
        let _ = path;
        Err(io::Error::new(
            io::ErrorKind::Unsupported,
            "private host-file validation is unavailable on this target",
        ))
    }
}

/// Reject a native path carrying an extended access-control list.
///
/// macOS ACL entries can grant access beyond owner-only POSIX mode bits, so
/// security-sensitive paths must satisfy both checks. Platforms without this
/// additional ACL surface accept the path unchanged.
///
/// # Errors
///
/// Returns an error when the ACL cannot be inspected or contains any entry.
pub fn validate_no_extended_acl(path: &Path) -> io::Result<()> {
    #[cfg(target_os = "macos")]
    {

View on GitHub (pinned to affd8760f4)

Solutions

Skip private-file validation on targets without platform support, or restrict that code path to unix/windows.
Guard with cfg!(any(unix, windows)) at the call site and choose an explicit fallback behavior.
Add a platform backend in platform_fs.rs if validation is required on the new target.

Example fix

// before
validate_private_file(&secret_path)?;
// after
#[cfg(any(unix, windows))]
validate_private_file(&secret_path)?;
#[cfg(not(any(unix, windows)))]
log::warn!("private-file validation unavailable on this target");

Defensive patterns

Strategy: fallback

Validate before calling

let supported = cfg!(any(unix, windows));
if supported { validate_private_file(&path)?; }

Type guard

fn supports_private_validation() -> bool { cfg!(any(unix, windows)) }

Try / catch

match validate_private_file(&path) {
    Err(e) if e.kind() == io::ErrorKind::Unsupported => { /* explicit unvalidated fallback */ }
    other => other?,
}

Prevention

Restrict secret-storage code paths to supported platforms
Do not compile private-file flows for wasm/embedded targets expecting validation
Document that validation returns Unsupported on other targets

When it happens

Trigger: Calling validate_private_file(path) on a non-unix/non-windows target, directly or indirectly through read_private_file_to_string, atomic_write_private_file_unix, and related private-file helpers.

Common situations: Running the library on an unsupported OS build (wasm/embedded) and reading a private file; a test suite executing on an exotic target.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/3de767ea0eee28e2. Report an issue: GitHub.