{"record":{"id":"1ced81992246fe7c","repo":"ruby/rubygems","slug":"trusted-root-certificate-root-subject-checksum","errorCode":null,"errorMessage":"trusted root certificate #{root.subject} checksum does not match signing root certificate checksum","messagePattern":"trusted root certificate #(.+?) checksum does not match signing root certificate checksum","errorType":"exception","errorClass":"Gem::Security::Exception","httpStatus":null,"severity":"error","filePath":"lib/rubygems/security/policy.rb","lineNumber":173,"sourceCode":"\n    path = Gem::Security.trust_dir.cert_path root\n\n    unless File.exist? path\n      message = \"root cert #{root.subject} is not trusted\".dup\n\n      message << \" (root of signing cert #{chain.last.subject})\" if\n        chain.length > 1\n\n      raise Gem::Security::Exception, message\n    end\n\n    save_cert = OpenSSL::X509::Certificate.new File.read path\n    save_dgst = digester.digest save_cert.public_key.public_to_pem\n\n    pkey_str = root.public_key.public_to_pem\n    cert_dgst = digester.digest pkey_str\n\n    raise Gem::Security::Exception,\n          \"trusted root certificate #{root.subject} checksum \" \\\n          \"does not match signing root certificate checksum\" unless\n      save_dgst == cert_dgst\n\n    true\n  end\n\n  ##\n  # Extracts the email or subject from +certificate+\n\n  def subject(certificate) # :nodoc:\n    certificate.extensions.each do |extension|\n      next unless extension.oid == \"subjectAltName\"\n\n      return extension.value\n    end\n\n    certificate.subject.to_s","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/ruby/rubygems/blob/86cbb817a38ce8477b181c17467a703ded3f2be8/lib/rubygems/security/policy.rb#L155-L191","documentation":"Error \"trusted root certificate #{root.subject} checksum does not match signing root certificate checksum\" thrown in ruby/rubygems.","triggerScenarios":"Thrown at lib/rubygems/security/policy.rb:173 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove the stale trusted certificate and re-add the correct one: `gem cert --remove` then `gem cert --add`"],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"86cbb817a38ce8477b181c17467a703ded3f2be8","analyzedAt":"2026-08-23T06:27:48.159Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}