JanDeDobbeleer/oh-my-posh · error

error parsing PEM block: key not found

Error message

error parsing PEM block: key not found

What it means

The embedded ed25519 public key is decoded with pem.Decode before signature validation. If the embedded bytes do not contain a valid PEM block, the decode yields nil and this error is returned. Because the key is embedded at build time, this almost always indicates a build/embed problem rather than user configuration.

Source

Thrown at src/cli/upgrade/verify.go:100

	return validateChecksum(asset, checksums, binary)
}

func validateSignature(data, signature []byte) bool {
	ed25519PublicKey, err := loadPublicKey()
	if err != nil {
		log.Debug("failed to load public key")
		log.Error(err)
		return false
	}

	return ed25519.Verify(*ed25519PublicKey, data, signature)
}

func loadPublicKey() (*ed25519.PublicKey, error) {
	block, _ := pem.Decode(publicKey)
	if block == nil {
		log.Debug("failed to decode PEM block")
		return nil, fmt.Errorf("error parsing PEM block: key not found")
	}

	pubKey, err := x509.ParsePKIXPublicKey(block.Bytes)
	if err != nil {
		log.Debug("failed to parse public key")
		return nil, fmt.Errorf("error parsing public key: %v", err)
	}

	ed25519PubKey, ok := pubKey.(ed25519.PublicKey)
	if !ok {
		log.Debug("failed to convert public key to ed25519")
		return nil, fmt.Errorf("invalid public key format: %v", err)
	}

	return &ed25519PubKey, nil
}

func validateChecksum(asset string, sha256sums, binary []byte) error {

View on GitHub (pinned to 0976794618)

Solutions

1. Reinstall oh-my-posh from the official release (official install script or package manager)
2. Verify the binary checksum against the published SHA256 sums
3. If building from source, confirm the embedded public key file exists and is valid PEM at build time

if err := cli.Upgrade(); err != nil {
    if strings.Contains(err.Error(), "PEM block") {
        // binary integrity problem: reinstall from official release instead of retrying
    }
}

When it happens

Trigger: loadPublicKey called by validateSignature when the embedded publicKey constant is empty, corrupted, or not PEM-encoded (e.g. a broken build, stripped binary, or modified/repacked executable).

Common situations: Running a binary that was built from a modified source tree without the key file; antivirus quarantining/truncating the binary; downloading the binary over a connection that corrupted it.

Related errors

• failed to verify checksums signature
• invalid public key format: %v
• error parsing public key: %v
• checksum mismatch
• we do not have permissions to update

AI-assisted analysis of JanDeDobbeleer/oh-my-posh@0976794618 (2026-08-31). Data as JSON: /api/errors/0705a65331843fb9. Report an issue: GitHub.