astrid-runtime/astrid · error

signed metadata target size must be positive

Error message

signed metadata target size must be positive

What it means

`validate_targets_for` enforces `target.size > 0` for every target in the signed channel metadata. A zero (or negative, if the field is signed) size cannot describe a real release artifact, so the metadata is rejected. This is a sanity bound on the declared artifact size before it is used for download validation/progress accounting.

Source

Thrown at crates/astrid-cli/src/commands/update_channel.rs:360

        targets.len() == expected_targets.len(),
        "{label} must contain exactly {} targets",
        expected_targets.len()
    );
    let mut seen = HashSet::new();
    for target in targets {
        ensure!(
            expected_targets.contains(&target.triple.as_str())
                && seen.insert(target.triple.as_str()),
            "{label} target set is invalid"
        );
        let expected_asset = format!("astrid-{version}-{}.tar.gz", target.triple);
        ensure!(
            target.asset == expected_asset
                && target.sigstore_bundle == format!("{expected_asset}.sigstore.json"),
            "signed metadata asset identity is invalid for {}",
            target.triple
        );
        ensure!(
            target.size > 0,
            "signed metadata target size must be positive"
        );
        ensure!(
            is_lower_hex_64(&target.blake3) && is_lower_hex_64(&target.sha256),
            "signed metadata target digest is invalid"
        );
    }
    ensure!(
        seen.len() == expected_targets.len(),
        "{label} target set is incomplete"
    );
    Ok(())
}

fn validate_targets(targets: &[TargetMetadata], version: &str) -> anyhow::Result<()> {
    validate_targets_for(targets, TARGETS, version, "signed metadata")
}

View on GitHub (pinned to affd8760f4)

Solutions

1. Set `size` to the actual byte length of the published tarball (`stat -c %s astrid-{version}-{triple}.tar.gz`).
2. Regenerate the signed metadata after the artifacts are built so sizes are computed from the real files, then re-sign.
3. If a target legitimately has no artifact yet, remove the target entry entirely rather than shipping size 0.
4. Add a pre-publish check in CI that asserts every target's size matches the artifact on disk.

Example fix

// before
"asset": "astrid-1.2.3-x86_64-unknown-linux-gnu.tar.gz",
"size": 0

// after
"asset": "astrid-1.2.3-x86_64-unknown-linux-gnu.tar.gz",
"size": 18345216

// shell: size from the real artifact before writing metadata
SIZE=$(stat -c %s "astrid-${VERSION}-${TRIPLE}.tar.gz")
[ "$SIZE" -gt 0 ] || { echo "artifact missing/empty" >&2; exit 1; }

null

null

When it happens

Trigger: `validate_targets` / `verify_release_extension` encountering a target entry whose `size` field is `0` — typically a placeholder that was never filled in when the metadata was generated.

Common situations: Metadata generation that ran before the artifact was built (size defaulted to 0); hand-authored target entries with an unfilled size; a templating bug emitting `"size": 0`.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• {label} target set is invalid
• signed metadata asset identity is invalid for {}
• {label} target set is incomplete
• signed metadata target digest is invalid
• WASM capsule has no BLAKE3 hash in meta.json

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/5bc028a5accdf4af. Report an issue: GitHub.