astrid-runtime/astrid · error

unsupported capsule provenance schema

Error message

unsupported capsule provenance schema {} / algorithm '{}'

What it means

Fired by verify_records when a present provenance envelope declares a schema_version or algorithm other than the ones this build supports (SCHEMA_VERSION / ALGORITHM). The signature cannot be interpreted, so verification fails closed.

Solutions

1. Rebuild the capsule with the currently supported provenance schema/algorithm
2. Upgrade astrid to a version that understands the envelope's schema/algorithm
3. Treat the capsule as untrusted unless re-signed by the publisher

When it happens

Trigger: Thrown at crates/astrid-build/src/artifact.rs:365 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/8cd6fdbc75806e0b. Report an issue: GitHub.

Appendix: source

Thrown at crates/astrid-build/src/artifact.rs:365

    let mut message =
        Vec::with_capacity(SIGNATURE_DOMAIN.len().saturating_add(content_digest.len()));
    message.extend_from_slice(SIGNATURE_DOMAIN);
    message.extend_from_slice(content_digest.as_bytes());
    message
}

fn verify_records(
    records: Vec<ContentRecord>,
    envelope: Option<&[u8]>,
) -> anyhow::Result<ArtifactVerification> {
    let content_digest = digest_records(records)?;
    let Some(bytes) = envelope else {
        return Ok(ArtifactVerification::Unsigned { content_digest });
    };
    let envelope: ProvenanceEnvelope =
        serde_json::from_slice(bytes).context("invalid capsule provenance envelope")?;
    if envelope.schema_version != SCHEMA_VERSION || envelope.algorithm != ALGORITHM {
        bail!(
            "unsupported capsule provenance schema {} / algorithm '{}'",
            envelope.schema_version,
            envelope.algorithm
        );
    }
    if envelope.content_digest != content_digest {
        bail!("capsule content digest does not match its signed provenance");
    }
    envelope
        .signer
        .verify(
            &signature_message(&envelope.content_digest),
            &envelope.signature,
        )
        .context("capsule provenance signature verification failed")?;
    Ok(ArtifactVerification::Signed(VerifiedProvenance {
        content_digest,
        signer: envelope.signer,

View on GitHub (pinned to affd8760f4)