{"record":{"id":"0ac558506b35e63b","repo":"elastic/elasticsearch","slug":"pgp-exception-during-signature-verification-for","errorCode":null,"errorMessage":"PGP exception during signature verification for [{}]","messagePattern":"PGP exception during signature verification for \\[(.+?)\\]","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"distribution/tools/plugin-cli/bc/src/main/java/org/elasticsearch/plugins/cli/bc/PgpSignatureVerifier.java","lineNumber":72,"sourceCode":"        ) {\n            final JcaPGPObjectFactory factory = new JcaPGPObjectFactory(PGPUtil.getDecoderStream(sin));\n            final PGPSignature signature = ((PGPSignatureList) factory.nextObject()).get(0);\n\n            // validate the signature has key ID matching our public key ID\n            final String keyId = Long.toHexString(signature.getKeyID()).toUpperCase(Locale.ROOT);\n            if (publicKeyId.equals(keyId) == false) {\n                throw new IllegalStateException(\"key id [\" + keyId + \"] does not match expected key id [\" + publicKeyId + \"]\");\n            }\n\n            // compute the signature of the downloaded plugin zip\n            computeSignatureForDownloadedPlugin(fin, ain, signature);\n\n            // finally we verify the signature of the downloaded plugin zip matches the expected signature\n            if (signature.verify() == false) {\n                throw new IllegalStateException(\"signature verification for [\" + urlString + \"] failed\");\n            }\n        } catch (PGPException e) {\n            throw new IOException(\"PGP exception during signature verification for [\" + urlString + \"]\", e);\n        }\n    }\n\n    private static void computeSignatureForDownloadedPlugin(InputStream fin, InputStream ain, PGPSignature signature) throws PGPException,\n        IOException {\n        final PGPPublicKeyRingCollection collection = new PGPPublicKeyRingCollection(ain, new JcaKeyFingerprintCalculator());\n        final PGPPublicKey key = collection.getPublicKey(signature.getKeyID());\n        signature.init(new JcaPGPContentVerifierBuilderProvider(), key);\n        final byte[] buffer = new byte[1024];\n        int read;\n        while ((read = fin.read(buffer)) != -1) {\n            signature.update(buffer, 0, read);\n        }\n    }\n\n}\n","sourceCodeStart":54,"sourceCodeEnd":89,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/distribution/tools/plugin-cli/bc/src/main/java/org/elasticsearch/plugins/cli/bc/PgpSignatureVerifier.java#L54-L89","documentation":"IOException (checked) wrapping a `PGPException` that escaped the try block of verifySignature — i.e. a lower-level BouncyCastle/PGP failure during parsing or verification that is neither a key-id mismatch nor a simple verify=false. It is caught by `catch (PGPException e)` and rethrown with context including the URL. Common causes: malformed `.asc` file, ArmoredInputStream parse error, missing public key in the keyring, or `signature.init` failure.","triggerScenarios":"A `.asc` file that is not valid ASCII-armored PGP (corrupt or wrong format); the public key ring does not contain the key referenced by the signature; PGP library version incompatibility; truncated signature file.","commonSituations":"Downloading a `.asc` that is actually an HTML error page from a proxy; outdated bundled public key; partial file transfer.","solutions":["Inspect the wrapped PGPException's message/cause to find the precise PGP failure (e.g. 'invalid header', 'unknown object').","Re-download the `.asc` signature and confirm it is valid armored PGP (`-----BEGIN PGP SIGNATURE-----`).","Ensure the public key input is the correct, current Elastic signing key.","Retry with a fresh download; if behind a proxy, bypass and re-test."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    PgpSignatureVerifier.verifySignature(publicKeyId, url, zip, asc, pubKey);\n} catch (IOException e) {\n    Throwable cause = e.getCause(); // PGPException\n    // inspect cause message; re-download .asc / public key and retry\n}","preventionTips":["Validate the `.asc` starts with `-----BEGIN PGP SIGNATURE-----` before verifying.","Ensure the public key ring contains the key referenced by the signature.","Avoid proxies that return HTML error pages masquerading as `.asc`."],"tags":["elasticsearch","plugin-cli","pgp","bouncycastle","io"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}