astrid-runtime/astrid · error

signed metadata asset identity is invalid for {}

Error message

signed metadata asset identity is invalid for {}

What it means

For each target, `validate_targets_for` recomputes the required asset filename (`astrid-{version}-{triple}.tar.gz`) and its sigstore bundle name (`{asset}.sigstore.json`) and requires both fields on the target to match exactly. This error means the target's asset name or sigstore bundle reference does not follow the deterministic naming scheme — so clients could not locate or verify the artifacts the metadata claims to describe.

Source

Thrown at crates/astrid-cli/src/commands/update_channel.rs:354

    targets: &[TargetMetadata],
    expected_targets: &[&str],
    version: &str,
    label: &str,
) -> anyhow::Result<()> {
    ensure!(
        targets.len() == expected_targets.len(),
        "{label} must contain exactly {} targets",
        expected_targets.len()
    );
    let mut seen = HashSet::new();
    for target in targets {
        ensure!(
            expected_targets.contains(&target.triple.as_str())
                && seen.insert(target.triple.as_str()),
            "{label} target set is invalid"
        );
        let expected_asset = format!("astrid-{version}-{}.tar.gz", target.triple);
        ensure!(
            target.asset == expected_asset
                && target.sigstore_bundle == format!("{expected_asset}.sigstore.json"),
            "signed metadata asset identity is invalid for {}",
            target.triple
        );
        ensure!(
            target.size > 0,
            "signed metadata target size must be positive"
        );
        ensure!(
            is_lower_hex_64(&target.blake3) && is_lower_hex_64(&target.sha256),
            "signed metadata target digest is invalid"
        );
    }
    ensure!(
        seen.len() == expected_targets.len(),
        "{label} target set is incomplete"
    );

View on GitHub (pinned to affd8760f4)

Solutions

1. Rename the published assets to match the scheme `astrid-{version}-{triple}.tar.gz` plus `astrid-{version}-{triple}.tar.gz.sigstore.json`, or update the metadata fields to the canonical names.
2. Regenerate the signed metadata from the actual artifacts so `asset` and `sigstore_bundle` are derived, not hand-typed, then re-sign.
3. Fix the release pipeline so it embeds the same `version` in the metadata and in the filenames.
4. Verify the sigstore signing step names its bundle `<asset>.sigstore.json`.

Example fix

// before
"asset": "astrid-1.2.3-x86_64-unknown-linux-gnu-debug.tar.gz",
"sigstore_bundle": "astrid-1.2.3-x86_64-unknown-linux-gnu.sigstore.json"

// after
"asset": "astrid-1.2.3-x86_64-unknown-linux-gnu.tar.gz",
"sigstore_bundle": "astrid-1.2.3-x86_64-unknown-linux-gnu.tar.gz.sigstore.json"

// Rust: assert naming scheme before signing
let expected = format!("astrid-{version}-{triple}.tar.gz");
assert_eq!(target.asset, expected);
assert_eq!(target.sigstore_bundle, format!("{expected}.sigstore.json"));

null

null

When it happens

Trigger: `validate_targets` / `verify_release_extension` finding a target where `asset` differs from `astrid-{version}-{triple}.tar.gz` or `sigstore_bundle` differs from `{asset}.sigstore.json` — e.g. renamed artifacts, wrong version embedded in the filename, or a bundle path that doesn't end in `.sigstore.json`.

Common situations: A release script that renames tarballs (adds a suffix like `-debug` or a date); metadata regenerated with a different version than the filenames embed; bundles generated without the `.sigstore.json` extension; manually edited metadata after artifact renames.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• {label} target set is invalid
• signed metadata target size must be positive
• {label} target set is incomplete
• signed metadata target digest is invalid
• WASM capsule has no BLAKE3 hash in meta.json

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/206345cbf39f40e8. Report an issue: GitHub.