astrid-runtime/astrid · error

signed channel identity is invalid

Error message

signed channel identity is invalid

What it means

The channel pointer's identity fields failed validation: schema_version must be 1, kind must be "astrid-channel", and product/repository must match the built-in PRODUCT and REPOSITORY constants. This guard ensures the signed pointer belongs to this product and repo, failing closed on anything else.

Solutions

1. Verify the channel pointer file points at the correct product and repository
2. Regenerate or re-download the pointer from the official source
3. Update the CLI to a version matching the pointer's schema_version
4. Restore the pointer file from a backup instead of editing it

fn pointer_identity_ok(p: &ChannelPointer, product: &str, repo: &str) -> bool {
    p.schema_version == 1 && p.kind == "astrid-channel" && p.product == product && p.repository == repo
}

fn is_valid_pointer(p: &ChannelPointer) -> bool {
    p.schema_version == 1 && p.kind == "astrid-channel"
}

if !pointer_identity_ok(&pointer, PRODUCT, REPOSITORY) {
    eprintln!("pointer is not for this product/repo; re-download it");
}

When it happens

Trigger: parse_channel or enforce_continuity encounters a pointer whose schema_version != 1, kind is not "astrid-channel", product/repository differ from the compiled-in constants — e.g. a pointer from a fork, an older/newer schema, or a corrupted/hand-edited pointer file.

Common situations: Pointing the CLI at a channel file copied from another product or fork; a schema bump by the publisher not yet supported by the installed CLI; manual edits to the pointer JSON.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• astrid distro apply requires a signed Distro…
• Astrid durable media is redirected or not a regular file
• authenticated AstridFS.app is redirected or not a directory
• authenticated macOS lifecycle tool is redirected or not…
• cache changed to a redirect or special entry

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/b1b56b7f462fc4d9. Report an issue: GitHub.

Appendix: source

Thrown at crates/astrid-cli/src/commands/update_channel.rs:462

pub(super) fn parse_channel(
    bytes: &[u8],
    expected_channel: UpdateChannel,
    now: DateTime<Utc>,
) -> anyhow::Result<ChannelPointer> {
    let text = std::str::from_utf8(bytes).context("signed channel metadata is not UTF-8")?;
    let pointer: ChannelPointer =
        toml::from_str(text).context("signed channel metadata is invalid TOML")?;
    validate_pointer(&pointer, expected_channel, Some(now))?;
    Ok(pointer)
}

fn validate_pointer(
    pointer: &ChannelPointer,
    expected_channel: UpdateChannel,
    now: Option<DateTime<Utc>>,
) -> anyhow::Result<()> {
    ensure!(
        pointer.schema_version == 1
            && pointer.kind == "astrid-channel"
            && pointer.product == PRODUCT
            && pointer.repository == REPOSITORY,
        "signed channel identity is invalid"
    );
    ensure!(
        pointer.channel == expected_channel.as_str(),
        "signed channel names '{}', expected '{}'",
        pointer.channel,
        expected_channel.as_str()
    );
    ensure!(
        pointer.generation > 0,
        "signed channel generation must be positive"
    );
    let published = canonical_time(&pointer.published_at, "published-at")?;
    let expires = canonical_time(&pointer.expires_at, "expires-at")?;

View on GitHub (pinned to affd8760f4)