astrid-runtime/astrid · error

signed channel release metadata BLAKE3 is invalid

Error message

signed channel release metadata BLAKE3 is invalid

What it means

Signature check in validate_pointer: pointer.release.metadata_blake3 is not valid lowercase 64-hex, so the manifest digest cannot be a real BLAKE3 hash and the pointer is rejected as malformed or tampered.

Solutions

1. Recompute and re-sign the pointer with the correct BLAKE3 digest of the release manifest
2. Check the signing pipeline for truncated or uppercased hashes
3. Reject the channel update and retain the current pointer

When it happens

Trigger: Thrown at crates/astrid-cli/src/commands/update_channel.rs:531 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/0b2721af248e21e4. Report an issue: GitHub.

Appendix: source

Thrown at crates/astrid-cli/src/commands/update_channel.rs:531

    ensure!(
        pointer.release.tag == format!("v{version}"),
        "signed channel release tag does not match its version"
    );
    ensure!(
        is_commit(&pointer.release.source_commit),
        "signed channel source commit is invalid"
    );
    if let Some(commit) = nightly_commit {
        ensure!(
            commit == pointer.release.source_commit,
            "nightly channel version does not embed its source commit"
        );
    }
    ensure!(
        pointer.release.metadata_asset == format!("astrid-{version}-release.toml"),
        "signed channel release metadata asset is invalid"
    );
    ensure!(
        is_lower_hex_64(&pointer.release.metadata_blake3),
        "signed channel release metadata BLAKE3 is invalid"
    );
    ensure!(
        pointer.release.release_workflow_identity
            == format!(
                "https://github.com/{REPOSITORY}/.github/workflows/release.yml@refs/tags/v{version}"
            ),
        "signed channel release workflow identity is invalid"
    );
    validate_targets(&pointer.targets, &pointer.release.version)?;
    Ok(())
}

fn nightly_source_commit(version: &semver::Version) -> Option<&str> {
    let mut parts = version.pre.as_str().split('.');
    let kind = parts.next()?;
    let date = parts.next()?;

View on GitHub (pinned to affd8760f4)