astrid-runtime/astrid · error

release manifest contracts identity is invalid

Error message

release manifest contracts identity is invalid

What it means

Cross-check in verify_release_manifest: the manifest's contracts.repos section does not match the identity pinned by the signed pointer, so the release's contracts provenance cannot be trusted and resolution aborts.

Solutions

1. Re-publish the release manifest with the correct contracts identity
2. Verify the release workflow stamps contracts.repos from the pointer, not ad-hoc values
3. Reject the update and keep the previously verified channel state

When it happens

Trigger: Thrown at crates/astrid-cli/src/commands/update_channel.rs:591 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/2da57f23b0a16158. Report an issue: GitHub.

Appendix: source

Thrown at crates/astrid-cli/src/commands/update_channel.rs:591

    );
    let text = std::str::from_utf8(bytes).context("release manifest is not UTF-8")?;
    let manifest: ReleaseManifest =
        toml::from_str(text).context("release manifest is invalid TOML")?;
    ensure!(
        manifest.schema_version == 1
            && manifest.kind == "astrid-release"
            && manifest.product == PRODUCT
            && manifest.repository == REPOSITORY,
        "release manifest identity is invalid"
    );
    ensure!(
        manifest.version == pointer.release.version
            && manifest.tag == pointer.release.tag
            && manifest.source_commit == pointer.release.source_commit
            && manifest.release_workflow_identity == pointer.release.release_workflow_identity,
        "release manifest does not match the signed channel pointer"
    );
    ensure!(
        manifest.contracts.repository == CONTRACTS_REPOSITORY
            && is_commit(&manifest.contracts.commit),
        "release manifest contracts identity is invalid"
    );
    validate_targets(&manifest.targets, &manifest.version)?;
    ensure!(
        manifest.targets == pointer.targets,
        "release manifest targets do not match the signed channel pointer"
    );
    Ok(())
}

fn verify_musl_extension(
    bytes: &[u8],
    legacy_manifest_bytes: &[u8],
    pointer: &ChannelPointer,
    target: &str,
) -> anyhow::Result<String> {

View on GitHub (pinned to affd8760f4)