What causes "generated checksum signature failed local verification" in JuliusBrussee/caveman?

Re-run once with identical inputs to rule out transient corruption.

generated checksum signature failed local verification

Error message

generated checksum signature failed local verification

What it means

Thrown by scripts/sign-binary-checksums.mjs when a bundle it just signed fails verification with the committed public key (verifyChecksumSignatureBundle returns false). Because the key-pair match was already checked on the line above, this is a self-consistency invariant: sign, verify, and only then write the output file. Hitting it means the signing or verification code paths disagree — not a user configuration problem.

Source

Thrown at scripts/sign-binary-checksums.mjs:53

  return createPublicKey(value).export({ type: "spki", format: "pem" }).toString();
}

if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
  try {
    const [checksumsPath, outputPath, publicKeyPath] = process.argv.slice(2);
    const privateKeyPEM = process.env.CAVEMAN_BINARY_SIGNING_PRIVATE_KEY_PEM;
    if (!checksumsPath || !outputPath || !publicKeyPath) {
      throw new Error("usage: sign-binary-checksums.mjs <checksums.txt> <output.keysig> <public-key.pem>");
    }
    if (!privateKeyPEM) throw new Error("CAVEMAN_BINARY_SIGNING_PRIVATE_KEY_PEM is required");
    const checksums = readFileSync(checksumsPath);
    const publicKeyPEM = readFileSync(publicKeyPath, "utf8");
    if (normalizePublicKey(privateKeyPEM) !== normalizePublicKey(publicKeyPEM)) {
      throw new Error("binary signing private key does not match committed public key");
    }
    const bundle = checksumSignatureBundle(checksums, privateKeyPEM);
    if (!verifyChecksumSignatureBundle(checksums, bundle, publicKeyPEM)) {
      throw new Error("generated checksum signature failed local verification");
    }
    writeFileSync(outputPath, `${JSON.stringify(bundle)}\n`, { mode: 0o600 });
  } catch (error) {
    process.stderr.write(`${error.message}\n`);
    process.exit(1);
  }
}

View on GitHub (pinned to 27d5a3981a)

Solutions

Re-run once with identical inputs to rule out transient corruption.
If it reproduces, inspect recent changes to checksumSignatureBundle and verifyChecksumSignatureBundle for payload/digest drift and file an issue with the script name in the traceback.
Do not bypass the check or hand-craft the .keysig file — consumers will reject it anyway.

Defensive patterns

Strategy: try-catch

Try / catch

try {
  runSigner();
} catch (error) {
  if (error.message === "generated checksum signature failed local verification") {
    fileBug("sign-binary-checksums.mjs self-verification failed", { inputs, error });
  }
  throw error;
}

Prevention

Never skip or patch out the self-verification step to get a release out.
Any change to the bundle format must update checksumSignatureBundle and verifyChecksumSignatureBundle together.

When it happens

Trigger: An internal defect in checksumSignatureBundle/verifyChecksumSignatureBundle (e.g. digest or payload normalization mismatch), or memory/disk corruption between sign and verify. No realistic CLI input triggers it.

Common situations: Editing the bundle format in one function but not the other; a version mismatch after a partial refactor of the script. For end users it is effectively 'report a bug'.

Related errors

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/17c2b2f9a5e0541b. Report an issue: GitHub.