JuliusBrussee/caveman · error

githubapp: sign app jwt: %w

Error message

githubapp: sign app jwt: %w

What it means

Fires in AppJWT() when rsa.SignPKCS1v15 fails while signing the RS256 App JWT — the stored private key is inconsistent with the digest/parameters (e.g. key became invalid, or a mismatched key object). Rare in practice since New() already parses and validates the RSA key.

Source

Thrown at shared/platform/githubapp/githubapp.go:133

	header := map[string]string{"alg": "RS256", "typ": "JWT"}
	claims := map[string]any{
		"iat": now.Add(-60 * time.Second).Unix(),
		"exp": now.Add(10 * time.Minute).Unix(),
		"iss": a.appID,
	}
	hb, err := json.Marshal(header)
	if err != nil {
		return "", err
	}
	cb, err := json.Marshal(claims)
	if err != nil {
		return "", err
	}
	signingInput := base64.RawURLEncoding.EncodeToString(hb) + "." + base64.RawURLEncoding.EncodeToString(cb)
	digest := sha256.Sum256([]byte(signingInput))
	sig, err := rsa.SignPKCS1v15(rand.Reader, a.privateKey, crypto.SHA256, digest[:])
	if err != nil {
		return "", fmt.Errorf("githubapp: sign app jwt: %w", err)
	}
	return signingInput + "." + base64.RawURLEncoding.EncodeToString(sig), nil
}

// InstallationToken is the JIT, least-agency credential. It is scoped to the
// single repo named and to the supplied permissions only, and is NEVER
// persisted. The caller revokes it via RevokeToken at job end.
type InstallationToken struct {
	Token     string    `json:"token"`
	ExpiresAt time.Time `json:"expires_at"`
}

// Installation is the App-authenticated identity GitHub assigns to an install.
// Callers use it to reject callback-supplied ids that do not belong to this App.
type Installation struct {
	ID      int64 `json:"id"`
	Account struct {
		Login string `json:"login"`

View on GitHub (pinned to 766dce6b13)

Solutions

1. Re-deploy with a valid GitHub App private key; regenerate the App key if it is corrupt
2. If persistent, verify the key loaded at New() is the same RSA key used here and that no in-memory corruption occurred

When it happens

Trigger: Thrown at shared/platform/githubapp/githubapp.go:133 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/e0c9cdd7ad5aac48. Report an issue: GitHub.