What causes "release contains duplicate asset '{name}'" in astrid-runtime/astrid?

Inspect the release and delete the duplicate asset so only one remains.

release contains duplicate asset '{name}'

Error message

release contains duplicate asset '{name}'

What it means

exact_asset_url requires asset names within a release to be unique. If two or more assets share the requested name it throws this error, refusing to guess which one to download. This is another supply-chain integrity check on release contents.

Source

Thrown at crates/astrid-cli/src/commands/self_update/mod.rs:319

pub(super) fn exact_asset_url<'a>(
    release: &'a serde_json::Value,
    name: &str,
) -> anyhow::Result<&'a str> {
    let assets = release
        .get("assets")
        .and_then(serde_json::Value::as_array)
        .ok_or_else(|| anyhow::anyhow!("release has no asset list"))?;
    anyhow::ensure!(
        assets.len() <= MAX_RELEASE_ASSETS,
        "release contains too many assets"
    );
    let mut matches = assets
        .iter()
        .filter(|asset| asset.get("name").and_then(|value| value.as_str()) == Some(name));
    let asset = matches
        .next()
        .ok_or_else(|| anyhow::anyhow!("release has no asset '{name}'"))?;
    anyhow::ensure!(
        matches.next().is_none(),
        "release contains duplicate asset '{name}'"
    );
    asset
        .get("browser_download_url")
        .and_then(|value| value.as_str())
        .filter(|url| !url.is_empty())
        .ok_or_else(|| anyhow::anyhow!("release asset '{name}' has no download URL"))
}

fn publisher_bundle_url<'a>(
    release: &'a serde_json::Value,
    archive_name: &str,
) -> Result<&'a str, UpdateStageError> {
    let bundle_name = format!("{archive_name}.sigstore.json");
    exact_asset_url(release, &bundle_name)
        .map_err(|error| UpdateStageError::publisher(error.to_string()))
}

View on GitHub (pinned to affd8760f4)

Solutions

Inspect the release and delete the duplicate asset so only one remains.
Fix the publishing workflow to delete-then-upload assets, preventing duplicates.
Switch ASTRID_UPDATE_REPO back to the official repository, which enforces unique asset names.
Treat duplicates as a red flag: verify release authenticity before trusting it.

Defensive patterns

Strategy: validation

Validate before calling

// detect duplicate asset names in a release before updating
const names = release.assets.map(a => a.name);
if (new Set(names).size !== names.length) throw new Error("duplicate asset names in release");

Prevention

Use delete-then-upload in publish workflows to prevent duplicate assets.
Only update from the official repo; GitHub itself enforces uniqueness there.
Investigate duplicates as a potential integrity compromise.

When it happens

Trigger: A release contains duplicate-named assets (GitHub normally forbids this, but forks/mirrors or API-forged JSON can have it) and exact_asset_url matches more than one entry for the requested name.

Common situations: Using a fork or custom update source whose tooling re-uploaded assets without deleting originals; a compromised or manipulated release payload.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/85e7886a36498ede. Report an issue: GitHub.