MOAT_004 — Moat Invalid

What This Means

Syllago tried to verify a MOAT registry but something about the manifest or its signing bundle is malformed, corrupt, or cryptographically invalid. This differs from MOAT_003 (identity mismatch) — MOAT_004 means the cryptographic machinery itself rejected the input, not that the identity disagreed.

Typical triggers: truncated .sigstore bundle, wrong media type, a manifest whose bytes don’t match the signed artifact digest, a certificate chain that does not terminate in the bundled Fulcio root, or a Rekor inclusion proof that does not verify.

Syllago fails closed on any of these because a silent accept would mean your install pipeline would pull content whose provenance cannot be proven.

Common Causes

• The registry published a manifest but updated it without re-signing (bytes no longer match the signature).
• A CDN or proxy rewrote the manifest JSON in transit (whitespace normalization breaks signatures).
• The .sigstore bundle was generated by an old tool and uses a media type this version of syllago does not accept.
• The Publisher Action emitted a partial write — the bundle file exists but is truncated.
• Disk corruption or a partial git clone.

How to Fix

1. syllago registry sync <name> to force a fresh clone / fetch of the manifest and bundle.

2. Inspect the raw files:

   ls -la ~/.syllago/registries/<NAME>/manifest.json
   ls -la ~/.syllago/registries/<NAME>/manifest.json.sigstore

   Both files must exist and be non-empty.

3. If the manifest and bundle look intact but verification still fails, the registry publisher almost certainly re-uploaded the manifest without re-signing — file an issue against the registry.

4. If you trust the publisher and need an unsigned fallback while they fix their pipeline, remove the registry and re-add it without any --signing-* flags to drop back to legacy git-only mode (no verification).

Example Output

Error MOAT_004: manifest signature invalid for registry OpenScribbler/syllago-meta-registry
  Suggestion: Run `syllago registry sync` to refresh. If the error persists, the registry re-uploaded the manifest without re-signing — contact the registry operator.
  Details: MOAT_INVALID: sigstore-go verify: signature does not verify against manifest bytes