astrid-runtime/astrid · error

WinFsp lease callback token is invalid

Error message

WinFsp lease callback token is invalid

What it means

The lease's callback token is a shared secret used to authenticate control-endpoint callbacks. The validator requires it to be at least 16 and at most 4096 bytes; otherwise the launch is rejected. A token outside this range cannot have been produced by the normal lease issuer, so the library treats the launch descriptor as corrupt or forged.

Source

Thrown at crates/astrid-storage-provider-winfsp/src/win.rs:266

    }
    if let Some(identity) = launch.parent.start_identity.as_deref()
        && (identity.is_empty() || identity.len() > 512 || identity.chars().any(char::is_control))
    {
        bail!("WinFsp service parent start identity is invalid");
    }
    if launch.parent.start_identity.is_none() {
        bail!("WinFsp service parent start identity is required on Windows");
    }
    let lease = &launch.lease;
    let now = SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .context("read system clock")?
        .as_secs();
    if lease.expires_at_epoch_secs < now {
        bail!("WinFsp lease is expired");
    }
    if lease.lease_token.len() < 16 || lease.lease_token.len() > 4096 {
        bail!("WinFsp lease callback token is invalid");
    }
    if !lease.resource_path.is_absolute()
        || !lease.callback_path.is_absolute()
        || lease.callback_path != lease.resource_path.join("control.endpoint")
    {
        bail!("WinFsp lease paths are malformed");
    }
    platform_fs::validate_private_directory(&lease.resource_path)
        .context("validate private WinFsp lease resource")?;
    platform_fs::verify_no_redirects(&lease.resource_path)
        .context("reject redirected WinFsp lease resource")?;
    let manifest_path = lease.resource_path.join("lease.json");
    platform_fs::validate_private_file(&manifest_path)
        .context("validate private WinFsp lease manifest")?;
    let manifest = std::fs::read(&manifest_path).context("read WinFsp lease manifest")?;
    if manifest.len() > 64 * 1024 {
        bail!("WinFsp lease manifest exceeds the bounded size");
    }

View on GitHub (pinned to affd8760f4)

Solutions

1. Regenerate the lease so lease_token is a real token from the issuer (typically >=16 bytes of entropy), rather than reusing a hand-made or redacted value.
2. Inspect the launch descriptor on disk/logging pipeline for redaction or truncation of the token field.
3. Ensure any intermediary (env var, registry, IPC buffer) carrying the token allows at least 4096 bytes and does not strip or pad it.
4. If the issuer is your own code, assert token length is within 16..=4096 at issuance time to catch the bug at the source.

Example fix

// before
lease_token: "abc".to_string(),
// after
lease_token: base64_encode(rand_bytes(32)), // 16..=4096 bytes

let n = lease.lease_token.len();
if !(16..=4096).contains(&n) {
    return Err(anyhow!("lease_token length {n} outside 16..=4096 — regenerate the lease"));
}

When it happens

Trigger: service_main -> validate_service_launch where lease.lease_token.len() < 16 || > 4096: a launch descriptor carries a missing/placeholder/oversized lease_token field.

Common situations: Hand-edited launch/lease JSON with a placeholder like "token" or "<redacted>"; a secrets-scrubbing CI log sanitizer that replaced the token with a short mask; serializing the token into a system that truncated it (e.g. a 15-char registry value or fixed-width buffer); copying an example from docs with a dummy token.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• FSKit lease callback token is invalid
• WinFsp service parent token is invalid
• WinFsp lease manifest exceeds the bounded size
• FSKit lease paths must be absolute
• FSKit callback path is not the kernel lease endpoint

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/7a53271ec7a4f5e8. Report an issue: GitHub.