astrid-runtime/astrid · error

signed channel release workflow identity is invalid

Error message

signed channel release workflow identity is invalid

What it means

Pointer-integrity failure in validate_pointer: the signed channel pointer's release workflow identity field failed its structural check (expected the canonical workflow identity format for the release). validate_pointer enforces a chain of invariants on signed release pointers (commit hash, metadata asset name, BLAKE3 digest forms); this ensure! is one link in that chain, and failure means the pointer was tampered with, corrupted, or produced by a non-conforming release workflow. Reached via parse_channel and enforce_continuity.

Source

Thrown at crates/astrid-cli/src/commands/update_channel.rs:535

    ensure!(
        is_commit(&pointer.release.source_commit),
        "signed channel source commit is invalid"
    );
    if let Some(commit) = nightly_commit {
        ensure!(
            commit == pointer.release.source_commit,
            "nightly channel version does not embed its source commit"
        );
    }
    ensure!(
        pointer.release.metadata_asset == format!("astrid-{version}-release.toml"),
        "signed channel release metadata asset is invalid"
    );
    ensure!(
        is_lower_hex_64(&pointer.release.metadata_blake3),
        "signed channel release metadata BLAKE3 is invalid"
    );
    ensure!(
        pointer.release.release_workflow_identity
            == format!(
                "https://github.com/{REPOSITORY}/.github/workflows/release.yml@refs/tags/v{version}"
            ),
        "signed channel release workflow identity is invalid"
    );
    validate_targets(&pointer.targets, &pointer.release.version)?;
    Ok(())
}

fn nightly_source_commit(version: &semver::Version) -> Option<&str> {
    let mut parts = version.pre.as_str().split('.');
    let kind = parts.next()?;
    let date = parts.next()?;
    let commit = parts.next()?.strip_prefix('g')?;
    if parts.next().is_some()
        || kind != "nightly"
        || date.len() != 8

View on GitHub (pinned to affd8760f4)

Solutions

1. Re-publish the pointer with the canonical workflow identity string
2. Verify the CI pipeline writes the identity unmodified
3. Refuse the update; fall back to the last trusted pointer

When it happens

Trigger: Thrown at crates/astrid-cli/src/commands/update_channel.rs:535 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/dab1a1d6ee797e78. Report an issue: GitHub.