JanDeDobbeleer/oh-my-posh · error

error parsing public key: %v

Error message

error parsing public key: %v

What it means

After the PEM block decodes successfully, its DER bytes are parsed as a PKIX public key. If x509.ParsePKIXPublicKey cannot parse them, loadPublicKey fails with this error including the parser's message. Like the PEM error, this points to a bad embedded key rather than user configuration.

Source

Thrown at src/cli/upgrade/verify.go:106

		log.Debug("failed to load public key")
		log.Error(err)
		return false
	}

	return ed25519.Verify(*ed25519PublicKey, data, signature)
}

func loadPublicKey() (*ed25519.PublicKey, error) {
	block, _ := pem.Decode(publicKey)
	if block == nil {
		log.Debug("failed to decode PEM block")
		return nil, fmt.Errorf("error parsing PEM block: key not found")
	}

	pubKey, err := x509.ParsePKIXPublicKey(block.Bytes)
	if err != nil {
		log.Debug("failed to parse public key")
		return nil, fmt.Errorf("error parsing public key: %v", err)
	}

	ed25519PubKey, ok := pubKey.(ed25519.PublicKey)
	if !ok {
		log.Debug("failed to convert public key to ed25519")
		return nil, fmt.Errorf("invalid public key format: %v", err)
	}

	return &ed25519PubKey, nil
}

func validateChecksum(asset string, sha256sums, binary []byte) error {
	var assetChecksum string
	checksums := strings.SplitSeq(string(sha256sums), "\n")

	for line := range checksums {
		if !strings.HasSuffix(line, asset) {
			continue

View on GitHub (pinned to 0976794618)

Solutions

1. Reinstall from the official release to restore the correct embedded key
2. If building from source, ensure the key file is exported in PKIX (SPKI) format, e.g. `openssl pkey -pubout`
3. Verify binary integrity via its checksum

Example fix

// before (raw ed25519 key breaks PKIX parsing)
openssl pkey -in key.pem -out pub.key -outform DER
// after (export PKIX/SPKI public key)
openssl pkey -in key.pem -pubout -out pub.pem

// validate key material before use
block, _ := pem.Decode(pubPEM)
if block == nil { return errors.New("not PEM") }
if _, err := x509.ParsePKIXPublicKey(block.Bytes); err != nil { return err }

if err := cli.Upgrade(); err != nil {
    if strings.Contains(err.Error(), "error parsing public key") {
        // embedded key malformed: reinstall official binary
    }
}

When it happens

Trigger: validateSignature → loadPublicKey when the embedded key's DER payload is malformed, truncated, or not a PKIX SubjectPublicKeyInfo structure.

Common situations: Corrupted/partially downloaded binary; a hand-edited or rebuilt binary where the key material was replaced with a non-PKIX format (e.g. raw ed25519 or PKCS#1).

Related errors

• failed to verify checksums signature
• error parsing PEM block: key not found
• invalid public key format: %v
• checksum mismatch
• we do not have permissions to update

AI-assisted analysis of JanDeDobbeleer/oh-my-posh@0976794618 (2026-08-31). Data as JSON: /api/errors/c0737c064cd97766. Report an issue: GitHub.