{"record":{"id":"17c2b2f9a5e0541b","repo":"JuliusBrussee/caveman","slug":"generated-checksum-signature-failed-local-verifica","errorCode":null,"errorMessage":"generated checksum signature failed local verification","messagePattern":"generated checksum signature failed local verification","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"scripts/sign-binary-checksums.mjs","lineNumber":53,"sourceCode":"  return createPublicKey(value).export({ type: \"spki\", format: \"pem\" }).toString();\n}\n\nif (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {\n  try {\n    const [checksumsPath, outputPath, publicKeyPath] = process.argv.slice(2);\n    const privateKeyPEM = process.env.CAVEMAN_BINARY_SIGNING_PRIVATE_KEY_PEM;\n    if (!checksumsPath || !outputPath || !publicKeyPath) {\n      throw new Error(\"usage: sign-binary-checksums.mjs <checksums.txt> <output.keysig> <public-key.pem>\");\n    }\n    if (!privateKeyPEM) throw new Error(\"CAVEMAN_BINARY_SIGNING_PRIVATE_KEY_PEM is required\");\n    const checksums = readFileSync(checksumsPath);\n    const publicKeyPEM = readFileSync(publicKeyPath, \"utf8\");\n    if (normalizePublicKey(privateKeyPEM) !== normalizePublicKey(publicKeyPEM)) {\n      throw new Error(\"binary signing private key does not match committed public key\");\n    }\n    const bundle = checksumSignatureBundle(checksums, privateKeyPEM);\n    if (!verifyChecksumSignatureBundle(checksums, bundle, publicKeyPEM)) {\n      throw new Error(\"generated checksum signature failed local verification\");\n    }\n    writeFileSync(outputPath, `${JSON.stringify(bundle)}\\n`, { mode: 0o600 });\n  } catch (error) {\n    process.stderr.write(`${error.message}\\n`);\n    process.exit(1);\n  }\n}\n","sourceCodeStart":35,"sourceCodeEnd":61,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/scripts/sign-binary-checksums.mjs#L35-L61","documentation":"Thrown by scripts/sign-binary-checksums.mjs when a bundle it just signed fails verification with the committed public key (verifyChecksumSignatureBundle returns false). Because the key-pair match was already checked on the line above, this is a self-consistency invariant: sign, verify, and only then write the output file. Hitting it means the signing or verification code paths disagree — not a user configuration problem.","triggerScenarios":"An internal defect in checksumSignatureBundle/verifyChecksumSignatureBundle (e.g. digest or payload normalization mismatch), or memory/disk corruption between sign and verify. No realistic CLI input triggers it.","commonSituations":"Editing the bundle format in one function but not the other; a version mismatch after a partial refactor of the script. For end users it is effectively 'report a bug'.","solutions":["Re-run once with identical inputs to rule out transient corruption.","If it reproduces, inspect recent changes to checksumSignatureBundle and verifyChecksumSignatureBundle for payload/digest drift and file an issue with the script name in the traceback.","Do not bypass the check or hand-craft the .keysig file — consumers will reject it anyway."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  runSigner();\n} catch (error) {\n  if (error.message === \"generated checksum signature failed local verification\") {\n    fileBug(\"sign-binary-checksums.mjs self-verification failed\", { inputs, error });\n  }\n  throw error;\n}","preventionTips":["Never skip or patch out the self-verification step to get a release out.","Any change to the bundle format must update checksumSignatureBundle and verifyChecksumSignatureBundle together."],"tags":["signing","invariant","security","release"],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}