JanDeDobbeleer/oh-my-posh · error

failed to verify checksums signature

Error message

failed to verify checksums signature

What it means

The updater verifies that the downloaded SHA256 checksums file was signed with the project's ed25519 key. `validateSignature` returns false when the cryptographic signature check fails, and `verify` surfaces this generic error. This protects against tampered or truncated downloads.

Source

Thrown at src/cli/upgrade/verify.go:79

}

func verify(cfg *Config, asset string, binary []byte) error {
	checksums, err := cfg.DownloadAsset("checksums.txt")
	if err != nil {
		log.Debug("failed to download checksums")
		return err
	}

	signature, err := cfg.DownloadAsset("checksums.txt.sig")
	if err != nil {
		log.Debug("failed to download checksums signature")
		return err
	}

	OK := validateSignature(checksums, signature)
	if !OK {
		log.Debug("failed to verify checksums signature")
		return fmt.Errorf("failed to verify checksums signature")
	}

	return validateChecksum(asset, checksums, binary)
}

func validateSignature(data, signature []byte) bool {
	ed25519PublicKey, err := loadPublicKey()
	if err != nil {
		log.Debug("failed to load public key")
		log.Error(err)
		return false
	}

	return ed25519.Verify(*ed25519PublicKey, data, signature)
}

func loadPublicKey() (*ed25519.PublicKey, error) {
	block, _ := pem.Decode(publicKey)

View on GitHub (pinned to 0976794618)

Solutions

1. Re-run the upgrade — transient corruption is fixed by re-downloading
2. Bypass intercepting proxies (disable TLS inspection or use a direct connection)
3. Verify manually: compare the asset checksum on the GitHub release page
4. Upgrade via a package manager instead of the self-updater if it persists

if err := cli.Upgrade(); err != nil {
    if strings.Contains(err.Error(), "failed to verify checksums signature") {
        // suspect corrupted/tampered download: retry once, then fall back to manual install
    }
}

When it happens

Trigger: downloadAndVerify downloads checksums.txt and its .sig, then validateSignature returns false — signature bytes corrupted in transit, checksums file modified (MITM/proxy), or the downloaded signature does not match the embedded public key's signing scheme.

Common situations: Corporate TLS-inspection proxies altering the payload; incomplete/corrupted download; a release where the signature was regenerated with a different key than the binary embeds.

Related errors

• error parsing PEM block: key not found
• invalid public key format: %v
• error parsing public key: %v
• checksum mismatch
• we do not have permissions to update

AI-assisted analysis of JanDeDobbeleer/oh-my-posh@0976794618 (2026-08-31). Data as JSON: /api/errors/b80d440e58f408ee. Report an issue: GitHub.