JanDeDobbeleer/oh-my-posh · error

invalid public key format: %v

Error message

invalid public key format: %v

What it means

The parsed public key must be an ed25519.PublicKey for signature validation. If the PKIX parse succeeded but produced a different key type (RSA, ECDSA, etc.), loadPublicKey returns this error. Note the format string prints `err`, which at this point is nil, so the message will read "invalid public key format: %!v(MISSING)"-style output — a minor logging bug in the source.

Source

Thrown at src/cli/upgrade/verify.go:112

}

func loadPublicKey() (*ed25519.PublicKey, error) {
	block, _ := pem.Decode(publicKey)
	if block == nil {
		log.Debug("failed to decode PEM block")
		return nil, fmt.Errorf("error parsing PEM block: key not found")
	}

	pubKey, err := x509.ParsePKIXPublicKey(block.Bytes)
	if err != nil {
		log.Debug("failed to parse public key")
		return nil, fmt.Errorf("error parsing public key: %v", err)
	}

	ed25519PubKey, ok := pubKey.(ed25519.PublicKey)
	if !ok {
		log.Debug("failed to convert public key to ed25519")
		return nil, fmt.Errorf("invalid public key format: %v", err)
	}

	return &ed25519PubKey, nil
}

func validateChecksum(asset string, sha256sums, binary []byte) error {
	var assetChecksum string
	checksums := strings.SplitSeq(string(sha256sums), "\n")

	for line := range checksums {
		if !strings.HasSuffix(line, asset) {
			continue
		}

		assetChecksum = strings.Fields(line)[0]
		break
	}

View on GitHub (pinned to 0976794618)

Solutions

1. Reinstall the official binary whose embedded key type matches the release signatures
2. If building from source, regenerate the embedded key as ed25519: `openssl genpkey -algorithm ed25519`
3. Report a key-rotation mismatch if it appears in an official build

Example fix

// before (RSA key where ed25519 is required)
openssl genpkey -algorithm RSA -out key.pem
// after
openssl genpkey -algorithm ed25519 -out key.pem

pub, err := x509.ParsePKIXPublicKey(block.Bytes)
if err != nil { return err }
if _, ok := pub.(ed25519.PublicKey); !ok { return errors.New("key is not ed25519") }

func isEd25519(pub any) bool { _, ok := pub.(ed25519.PublicKey); return ok }

if err := cli.Upgrade(); err != nil {
    if strings.Contains(err.Error(), "invalid public key format") {
        // signing key type mismatch: reinstall matching official release
    }
}

When it happens

Trigger: validateSignature → loadPublicKey when the embedded PEM contains a valid PKIX key of a non-ed25519 type.

Common situations: The signing key was rotated or regenerated as RSA/ECDSA while the binary expects ed25519; building from source with a swapped key file.

Related errors

• failed to verify checksums signature
• error parsing PEM block: key not found
• error parsing public key: %v
• checksum mismatch
• we do not have permissions to update

AI-assisted analysis of JanDeDobbeleer/oh-my-posh@0976794618 (2026-08-31). Data as JSON: /api/errors/fff22394d6e1dc37. Report an issue: GitHub.