astrid-runtime/astrid · error

signed channel source commit is invalid

Error message

signed channel source commit is invalid

What it means

The pointer's `release.source_commit` must pass is_commit (a well-formed commit identifier, e.g. 40 hex chars). The source commit binds the channel pointer to the exact revision the release was built from; an unrecognizable value means the pointer cannot be traced to a build and is rejected.

Solutions

1. Set `release.source_commit` to the full commit hash of the release build (as is_commit expects) and republish
2. Fix the publishing script to resolve the ref to a full SHA (e.g. `git rev-parse HEAD`) before templating
3. Regenerate the pointer via the official release workflow
4. If fetched from upstream, re-download — the file may be truncated

Example fix

// before (channel.toml)
source-commit = "main"
// after
source-commit = "9f2c1a7e4b8d..." # full 40-char hex SHA

fn source_commit_ok(commit: &str) -> bool {
    commit.len() == 40 && commit.bytes().all(|b| b.is_ascii_hexdigit())
}

fn has_valid_source_commit(release: &ReleaseRef) -> bool {
    release.source_commit.len() == 40
        && release.source_commit.bytes().all(|b| b.is_ascii_hexdigit())
}

match parse_channel(&bytes, channel, now) {
    Err(e) if e.to_string().contains("source commit is invalid") => {
        anyhow::bail!("channel pointer has malformed source commit; regenerate with a full SHA")
    }
    other => other?,
}

When it happens

Trigger: parse_channel or enforce_continuity reads a pointer whose `release.source_commit` is empty, a branch/tag name, a short 7-char SHA, or contains non-hex characters — anything failing is_commit.

Common situations: Publisher script writing `$GIT_REF` (a branch name) instead of the full SHA; hand-edited TOML with a truncated commit; template placeholder like `<commit>` never substituted.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• git history path must be a relative in-repository path
• must contain exactly targets
• nightly channel must point to an exact nightly prerelease
• signed channel generation must be positive
• signed channel lifetime exceeds the maximum for its channel

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/84e18be5926ad556. Report an issue: GitHub.

Appendix: source

Thrown at crates/astrid-cli/src/commands/update_channel.rs:517

        "signed channel lifetime exceeds the maximum for its channel"
    );
    let version = canonical_version(&pointer.release.version)?;
    let nightly_commit = nightly_source_commit(&version);
    match expected_channel {
        UpdateChannel::Nightly => ensure!(
            nightly_commit.is_some() && version.build.is_empty(),
            "nightly channel must point to an exact nightly prerelease"
        ),
        UpdateChannel::Stable | UpdateChannel::Dev => ensure!(
            version.pre.is_empty() && version.build.is_empty(),
            "stable and dev channels must point to canonical releases"
        ),
    }
    ensure!(
        pointer.release.tag == format!("v{version}"),
        "signed channel release tag does not match its version"
    );
    ensure!(
        is_commit(&pointer.release.source_commit),
        "signed channel source commit is invalid"
    );
    if let Some(commit) = nightly_commit {
        ensure!(
            commit == pointer.release.source_commit,
            "nightly channel version does not embed its source commit"
        );
    }
    ensure!(
        pointer.release.metadata_asset == format!("astrid-{version}-release.toml"),
        "signed channel release metadata asset is invalid"
    );
    ensure!(
        is_lower_hex_64(&pointer.release.metadata_blake3),
        "signed channel release metadata BLAKE3 is invalid"
    );
    ensure!(

View on GitHub (pinned to affd8760f4)