signature check failed for

Error message

signature check failed for ${artifact} — refusing to install; partial download deleted

What it means

For each binary in INSTALL_BINARIES the installer looks up '<name>_<os>_<arch>' in the parsed checksum map. If the entry for this exact platform artifact is missing, it throws this 'signature check failed' error rather than installing an unverified binary.

Solutions

Check checksums.txt for a line matching <name>_<os>_<arch> for your platform.
Update the CLI/installer to the latest version that supports your platform.
Verify platform detection (process.platform/process.arch mapping) matches the artifact naming scheme.
If you own the release, add the missing artifact and regenerate the signed checksums.

Example fix

// manifest missing entry
// before: checksums.txt lacks 'caveman_linux_arm64'
// after: release pipeline includes:
echo "$(sha256sum caveman_linux_arm64)" >> checksums.txt && re-sign

Defensive patterns

Strategy: validation

Validate before calling

const artifact = `caveman_${process.platform}_${process.arch}`;
const manifest = await (await fetch(CHECKSUMS_URL)).text();
if (!manifest.includes(artifact)) console.warn(`no checksum entry for ${artifact}; update installer`);

Try / catch

try { await install() } catch (e) { if (/signature check failed for .+/.test(String(e.message))) console.error('Platform artifact missing from manifest — upgrade the installer or use a supported platform'); }

Prevention

Confirm your OS/arch is supported before installing on new hardware (e.g. linux/arm64).
Keep the CLI updated so platform coverage matches current releases.
Check the manifest naming scheme when cross-installing.

When it happens

Trigger: checksums.get(`${name}_${platform.os}_${platform.arch}`) returns undefined — the manifest has no digest line for the current OS/arch combination (e.g. a newly released platform not yet covered, or an os/arch string mismatch).

Common situations: Running on a newer platform (e.g. linux/arm64) before the release added its checksum entry; typo'd or renamed artifact in the release; older pinned manifest missing the artifact.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of JuliusBrussee/caveman@3ee70a1026 (2026-09-20). Data as JSON: /api/errors/91168905bf9b0b01. Report an issue: GitHub.

Appendix: source

Thrown at packages/cli/src/index.ts:2464

  if (!verifyChecksumSignature(checksumsRaw!, signatureRaw!)) {
    throw new Error("signature check failed for checksums.txt — refusing to install; partial download deleted");
  }

  let checksums: Map<string, string>;
  try {
    checksums = parseSignedChecksums(checksumsRaw!);
  } catch {
    throw new Error("signature check failed for checksums.txt — refusing to install; partial download deleted");
  }

  const installed: InstalledBinary[] = [];
  const artifactDigests: Record<string, string> = {};
  for (const name of INSTALL_BINARIES) {
    const artifact = `${name}_${platform.os}_${platform.arch}`;
    const expected = checksums.get(artifact);
    if (!expected) {
      throw new Error(`signature check failed for ${artifact} — refusing to install; partial download deleted`);
    }
    const target = join(binDir, binaryInstallFilename(name, platform.os));
    artifactDigests[name] = expected;
    if (sha256File(target) === expected) {
      installed.push({ name, path: target, sha256: expected, status: "already installed" });
      continue;
    }

    const partial = `${target}.part`;
    cleanupPartial(partial);
    installProgressStart(name, platform);
    let result: { sha256: string; bytes: number };
    try {
      result = await downloadReleaseBinary(`${releaseBase}/${artifact}`, partial, timeoutSeconds);
    } catch (error) {
      cleanupPartial(partial);
      setupInstallFailure(error, timeoutSeconds);
    }

View on GitHub (pinned to 3ee70a1026)