{"record":{"id":"0705a65331843fb9","repo":"JanDeDobbeleer/oh-my-posh","slug":"error-parsing-pem-block-key-not-found","errorCode":null,"errorMessage":"error parsing PEM block: key not found","messagePattern":"error parsing PEM block: key not found","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cli/upgrade/verify.go","lineNumber":100,"sourceCode":"\treturn validateChecksum(asset, checksums, binary)\n}\n\nfunc validateSignature(data, signature []byte) bool {\n\ted25519PublicKey, err := loadPublicKey()\n\tif err != nil {\n\t\tlog.Debug(\"failed to load public key\")\n\t\tlog.Error(err)\n\t\treturn false\n\t}\n\n\treturn ed25519.Verify(*ed25519PublicKey, data, signature)\n}\n\nfunc loadPublicKey() (*ed25519.PublicKey, error) {\n\tblock, _ := pem.Decode(publicKey)\n\tif block == nil {\n\t\tlog.Debug(\"failed to decode PEM block\")\n\t\treturn nil, fmt.Errorf(\"error parsing PEM block: key not found\")\n\t}\n\n\tpubKey, err := x509.ParsePKIXPublicKey(block.Bytes)\n\tif err != nil {\n\t\tlog.Debug(\"failed to parse public key\")\n\t\treturn nil, fmt.Errorf(\"error parsing public key: %v\", err)\n\t}\n\n\ted25519PubKey, ok := pubKey.(ed25519.PublicKey)\n\tif !ok {\n\t\tlog.Debug(\"failed to convert public key to ed25519\")\n\t\treturn nil, fmt.Errorf(\"invalid public key format: %v\", err)\n\t}\n\n\treturn &ed25519PubKey, nil\n}\n\nfunc validateChecksum(asset string, sha256sums, binary []byte) error {","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/JanDeDobbeleer/oh-my-posh/blob/0976794618c5ed95de0985dded50de1b4dc914cb/src/cli/upgrade/verify.go#L82-L118","documentation":"The embedded ed25519 public key is decoded with pem.Decode before signature validation. If the embedded bytes do not contain a valid PEM block, the decode yields nil and this error is returned. Because the key is embedded at build time, this almost always indicates a build/embed problem rather than user configuration.","triggerScenarios":"loadPublicKey called by validateSignature when the embedded publicKey constant is empty, corrupted, or not PEM-encoded (e.g. a broken build, stripped binary, or modified/repacked executable).","commonSituations":"Running a binary that was built from a modified source tree without the key file; antivirus quarantining/truncating the binary; downloading the binary over a connection that corrupted it.","solutions":["Reinstall oh-my-posh from the official release (official install script or package manager)","Verify the binary checksum against the published SHA256 sums","If building from source, confirm the embedded public key file exists and is valid PEM at build time"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := cli.Upgrade(); err != nil {\n    if strings.Contains(err.Error(), \"PEM block\") {\n        // binary integrity problem: reinstall from official release instead of retrying\n    }\n}","preventionTips":["Only use official release binaries — verify checksums after download","If building from source, confirm the embedded key file is present and valid PEM","Treat this error as a corrupted/modified binary: reinstall, do not retry in place"],"tags":["security","pem","ed25519","upgrade"],"backgroundTag":"pem-decode-failed","analyzedSha":"0976794618c5ed95de0985dded50de1b4dc914cb","analyzedAt":"2026-08-31T23:41:19.708Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}