astrid-runtime/astrid · error

release manifest identity is invalid

Error message

release manifest identity is invalid

What it means

Identity check in verify_release_manifest: the parsed release TOML's schema_version/kind/product/repository do not match the expected values, so the manifest is not a genuine release manifest for this product and the channel resolution aborts.

Solutions

1. Re-download the release manifest from the trusted channel location
2. Verify the BLAKE3 digest matched — a mismatch upstream usually triggers first
3. Re-publish the manifest if the release pipeline emitted wrong identity fields

When it happens

Trigger: Thrown at crates/astrid-cli/src/commands/update_channel.rs:577 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/de6379974ce8d9dd. Report an issue: GitHub.

Appendix: source

Thrown at crates/astrid-cli/src/commands/update_channel.rs:577

            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
    {
        return None;
    }
    Some(commit)
}

pub(super) fn verify_release_manifest(
    bytes: &[u8],
    pointer: &ChannelPointer,
) -> anyhow::Result<()> {
    ensure!(
        blake3::hash(bytes).to_hex().as_str() == pointer.release.metadata_blake3,
        "immutable release manifest does not match the channel BLAKE3 digest"
    );
    let text = std::str::from_utf8(bytes).context("release manifest is not UTF-8")?;
    let manifest: ReleaseManifest =
        toml::from_str(text).context("release manifest is invalid TOML")?;
    ensure!(
        manifest.schema_version == 1
            && manifest.kind == "astrid-release"
            && manifest.product == PRODUCT
            && manifest.repository == REPOSITORY,
        "release manifest identity is invalid"
    );
    ensure!(
        manifest.version == pointer.release.version
            && manifest.tag == pointer.release.tag
            && manifest.source_commit == pointer.release.source_commit
            && manifest.release_workflow_identity == pointer.release.release_workflow_identity,
        "release manifest does not match the signed channel pointer"
    );
    ensure!(
        manifest.contracts.repository == CONTRACTS_REPOSITORY
            && is_commit(&manifest.contracts.commit),
        "release manifest contracts identity is invalid"
    );

View on GitHub (pinned to affd8760f4)