JuliusBrussee/caveman · error · Error

signature check failed for ${artifact} — refusing to install

Error message

signature check failed for ${artifact} — refusing to install; partial download deleted

What it means

Before downloading each binary, the installer looks up `<name>_<os>_<arch>` in the parsed checksums map; if the artifact key is absent it throws this error. It means the release does not publish a checksummed artifact for the current platform, and the CLI refuses to install an unverifiable binary.

Source

Thrown at packages/cli/src/index.ts:2227

  if (!verifyChecksumSignature(checksumsRaw!, signatureRaw!)) {
    throw new Error("signature check failed for checksums.txt — refusing to install; partial download deleted");
  }

  let checksums: Map<string, string>;
  try {
    checksums = parseSignedChecksums(checksumsRaw!);
  } catch {
    throw new Error("signature check failed for checksums.txt — refusing to install; partial download deleted");
  }

  const installed: InstalledBinary[] = [];
  const artifactDigests: Record<string, string> = {};
  for (const name of INSTALL_BINARIES) {
    const artifact = `${name}_${platform.os}_${platform.arch}`;
    const expected = checksums.get(artifact);
    if (!expected) {
      throw new Error(`signature check failed for ${artifact} — refusing to install; partial download deleted`);
    }
    const target = join(binDir, binaryInstallFilename(name, platform.os));
    artifactDigests[name] = expected;
    if (sha256File(target) === expected) {
      installed.push({ name, path: target, sha256: expected, status: "already installed" });
      continue;
    }

    const partial = `${target}.part`;
    cleanupPartial(partial);
    installProgressStart(name, platform);
    let result: { sha256: string; bytes: number };
    try {
      result = await downloadReleaseBinary(`${releaseBase}/${artifact}`, partial, timeoutSeconds);
    } catch (error) {
      cleanupPartial(partial);
      setupInstallFailure(error, timeoutSeconds);
    }

View on GitHub (pinned to 27d5a3981a)

Solutions

1. Check the release's checksums.txt for your `<binary>_<os>_<arch>` key to confirm the platform is unsupported
2. Build the Go binaries from source and place them on PATH or in ~/.caveman/bin (scripts/install-local-cli.sh does this)
3. Set CAVEMAN_PROXY_BIN / CAVEMAN_ENGINE_BIN / CAVEMAN_MCP_BIN env overrides to locally built binaries
4. Request/follow an upstream release adding your platform

// Before install, confirm the platform artifact exists in checksums.txt:
const res = await fetch(`${releaseBase}/checksums.txt`);
const text = await res.text();
const key = `${binaryName}_${process.platform}_${process.arch}`;
if (!text.includes(key)) {
  console.error(`no release artifact for ${key} — build from source instead`);
}

function isMissingPlatformArtifactError(e: unknown): boolean {
  return e instanceof Error && e.message.startsWith("signature check failed for ") && e.message.includes("_" + process.platform) ;
}

try {
  await runCavemanSetupInstall();
} catch (e) {
  if (isMissingPlatformArtifactError(e)) buildFromSourceAndSetEnvOverrides();
  else throw e;
}

When it happens

Trigger: `caveman setup --install` on a platform/os-arch combination missing from the release (e.g. a new or uncommon arch like linux/riscv64, freebsd, or a musl variant spelled differently), or a release that only ships a subset of platform artifacts.

Common situations: Running on exotic hardware or an OS the release pipeline does not target; an arm64 Windows or 32-bit machine; a partial release where some artifacts failed to upload but checksums were regenerated from what exists.

Related errors

• cave_${harness}_upstream_version_unresolvable
• caveman build: unresolved package dependency ${JSON.stringif
• binary download unreachable — agents still launch; traffic i
• signature check failed for checksums.txt — refusing to insta
• cannot read ${agent} agent-native bundle journal: ${(error a

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/91168905bf9b0b01. Report an issue: GitHub.