astrid-runtime/astrid · error

release manifest does not match the signed channel pointer

Error message

release manifest does not match the signed channel pointer

What it means

Cross-check in verify_release_manifest: the manifest's version/tag/source_commit/workflow identity do not equal the signed channel pointer's release fields, so the manifest does not correspond to the release the pointer commits to.

Solutions

1. Re-fetch both the pointer and the manifest — one of them is stale
2. Verify the CDN/mirror is not serving a manifest from another release
3. Re-sign and re-publish the coherent pointer+manifest pair

When it happens

Trigger: Thrown at crates/astrid-cli/src/commands/update_channel.rs:584 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/80004896c809fe54. Report an issue: GitHub.

Appendix: source

Thrown at crates/astrid-cli/src/commands/update_channel.rs:584

pub(super) fn verify_release_manifest(
    bytes: &[u8],
    pointer: &ChannelPointer,
) -> anyhow::Result<()> {
    ensure!(
        blake3::hash(bytes).to_hex().as_str() == pointer.release.metadata_blake3,
        "immutable release manifest does not match the channel BLAKE3 digest"
    );
    let text = std::str::from_utf8(bytes).context("release manifest is not UTF-8")?;
    let manifest: ReleaseManifest =
        toml::from_str(text).context("release manifest is invalid TOML")?;
    ensure!(
        manifest.schema_version == 1
            && manifest.kind == "astrid-release"
            && manifest.product == PRODUCT
            && manifest.repository == REPOSITORY,
        "release manifest identity is invalid"
    );
    ensure!(
        manifest.version == pointer.release.version
            && manifest.tag == pointer.release.tag
            && manifest.source_commit == pointer.release.source_commit
            && manifest.release_workflow_identity == pointer.release.release_workflow_identity,
        "release manifest does not match the signed channel pointer"
    );
    ensure!(
        manifest.contracts.repository == CONTRACTS_REPOSITORY
            && is_commit(&manifest.contracts.commit),
        "release manifest contracts identity is invalid"
    );
    validate_targets(&manifest.targets, &manifest.version)?;
    ensure!(
        manifest.targets == pointer.targets,
        "release manifest targets do not match the signed channel pointer"
    );
    Ok(())
}

View on GitHub (pinned to affd8760f4)