{"record":{"id":"25d9b461d1ebad5c","repo":"aaif-goose/goose","slug":"sigstore-verification-failed-aborting-update","errorCode":null,"errorMessage":"Sigstore verification failed: {}\n\nAborting update due to security check failure.","messagePattern":"Sigstore verification failed: (.+?)\n\nAborting update due to security check failure\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"crates/goose-cli/src/commands/update.rs","lineNumber":234,"sourceCode":"    // One passing attestation is sufficient.\n    let mut last_err = None;\n    for bundle_json in &bundles {\n        match verify_bundle(\n            bundle_json,\n            artifact_digest,\n            &policy,\n            &trusted_root,\n            workflow,\n        ) {\n            Ok(()) => {\n                println!(\"Sigstore provenance verification passed.\");\n                return Ok(());\n            }\n            Err(e) => last_err = Some(e),\n        }\n    }\n\n    Err(anyhow::anyhow!(\n        \"Sigstore verification failed: {}\\n\\nAborting update due to security check failure.\",\n        last_err.unwrap()\n    ))\n}\n\n/// Update the goose binary to the latest release.\n///\n/// Downloads the platform-appropriate archive from GitHub releases, verifies\n/// its SLSA provenance via Sigstore, extracts it with path-traversal\n/// hardening, and replaces the current binary in-place.\npub async fn update(canary: bool, reconfigure: bool) -> Result<()> {\n    #[cfg(feature = \"disable-update\")]\n    {\n        bail!(\"Update is disabled in this build.\");\n    }\n\n    #[cfg(not(feature = \"disable-update\"))]\n    {","sourceCodeStart":216,"sourceCodeEnd":252,"githubUrl":"https://github.com/aaif-goose/goose/blob/3810898a7447ec3299be72e223d3570a7aabf0ab/crates/goose-cli/src/commands/update.rs#L216-L252","documentation":"verify_provenance loops over every attestation bundle for the downloaded archive; each failure is stored and, when none pass, this final error aborts the update. It is goose's fail-closed SLSA provenance gate: the embedded detail (bundle parse failure, verify failure, or missing identity) names the last bundle's cause. Seeing it means the archive could not be proven to come from the official build workflow.","triggerScenarios":"Corrupted or tampered release download; proxy/mirror serving altered artifacts; a release published without valid provenance; an outdated goose whose trusted root/policy rejects the current signing setup.","commonSituations":"Corporate proxies caching or rewriting GitHub assets; resumed/interrupted downloads; very old goose versions updating across a provenance migration; genuinely compromised artifact (rare, but the gate exists for it).","solutions":["Re-run `goose update` on a clean, trusted network (transient corruption is most common)","Upgrade goose through your package manager first so trusted roots and bundle support are current","Optionally verify manually: download the archive + attestation and run slsa-verifier with the expected workflow identity","If verification still fails, report the tag — do not attempt to skip the check"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"let digest_a = sha256_hex(&download_release_asset(tag).await?);\nlet digest_b = sha256_hex(&download_release_asset(tag).await?);\nif digest_a != digest_b {\n    anyhow::bail!(\"unstable download (digest changed between fetches); network is unreliable or intercepted\");\n}","typeGuard":null,"tryCatchPattern":"match update(canary, reconfigure).await {\n    Err(e) if e.to_string().contains(\"Sigstore verification failed\") => {\n        // one clean re-download, then stop: never bypass or auto-retry past this\n        update(canary, reconfigure).await\n    }\n    other => other,\n}","preventionTips":["Never disable or skip provenance verification when an update fails it","Download only from official GitHub releases; exclude them from proxies/mirrors","Keep goose itself updated so its trusted roots and verification policy stay current","On persistent failure, verify manually with slsa-verifier and report the tag"],"tags":["sigstore","security","supply-chain","update","fail-closed"],"backgroundTag":null,"analyzedSha":"3810898a7447ec3299be72e223d3570a7aabf0ab","analyzedAt":"2026-08-16T10:14:26.282Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}