{"record":{"id":"39994af05676d3ba","repo":"duplicati/duplicati","slug":"installed-manifest-signature-is-invalid","errorCode":null,"errorMessage":"Installed manifest signature is invalid","messagePattern":"Installed manifest signature is invalid","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"warning","filePath":"Duplicati/Library/AutoUpdater/UpdaterManager.cs","lineNumber":312,"sourceCode":"        /// </summary>\r\n        /// <param name=\"folder\">The folder to read the manifest from</param>\r\n        /// <returns>The manifest if found, or null if not found</returns>\r\n        private static UpdateInfo? ReadInstalledManifest(string folder)\r\n        {\r\n            var manifest = Path.Combine(folder, UPDATE_MANIFEST_FILENAME);\r\n            if (File.Exists(manifest))\r\n            {\r\n                try\r\n                {\r\n                    var verifyOps = SIGN_KEYS.Select(k => new JSONSignature.VerifyOperation(\r\n                        Algorithm: JSONSignature.RSA_SHA256,\r\n                        PublicKey: k.ToXmlString(false)\r\n                    ));\r\n\r\n                    using (var fs = File.OpenRead(manifest))\r\n                    {\r\n                        if (!JSONSignature.VerifyAtLeastOne(fs, verifyOps))\r\n                            throw new Exception(\"Installed manifest signature is invalid\");\r\n\r\n                        return JsonSerializer.Deserialize<UpdateInfo>(fs);\r\n                    }\r\n                }\r\n                catch (Exception ex)\r\n                {\r\n                    if (OnError != null)\r\n                        OnError(ex);\r\n                }\r\n            }\r\n\r\n            return null;\r\n        }\r\n\r\n        /// <summary>\r\n        /// Builds the list of urls to try when downloading an update package.\r\n        /// Each alternate url is pointed at the package name taken from the first package\r\n        /// url, and the alternates are tried first, in the order they were configured.\r","sourceCodeStart":294,"sourceCodeEnd":330,"githubUrl":"https://github.com/duplicati/duplicati/blob/3f348be3e33f5d72d414e3ad55839c2ba34dda67/Duplicati/Library/AutoUpdater/UpdaterManager.cs#L294-L330","documentation":"Thrown by UpdaterManager.ReadInstalledManifest when the locally stored manifest file (the previously downloaded update manifest) fails signature verification. The installed manifest is treated as untrusted, so it is not used to drive an update. The exception is caught locally and reported via OnError rather than propagated.","triggerScenarios":"ReadInstalledManifest finds the manifest file in the updates folder, builds VerifyOperations from SIGN_KEYS, and VerifyAtLeastOne returns false. The on-disk manifest has been modified, is from an incompatible signing key, or was corrupted on disk.","commonSituations":"Disk corruption or a partial write left a damaged manifest; the manifest was manually edited; a build change rotated signing keys so the old installed manifest no longer verifies; an antivirus quarantined and restored a truncated file.","solutions":["Delete the installed manifest file from the updates folder so Duplicati re-downloads a fresh signed copy.","Confirm the running build's SIGN_KEYS include the key that signed the installed manifest (update the build if keys rotated).","Run a filesystem check if disk corruption is suspected.","Re-download the manifest via CheckForUpdate to replace the invalid local copy."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"// ReadInstalledManifest already swallows the exception and reports via OnError;\n// handle it there rather than expecting a throw.\nUpdaterManager.OnError = ex =>\n{\n    if (ex.Message == \"Installed manifest signature is invalid\")\n        TryDeleteInstalledManifest(); // force a fresh download next CheckForUpdate\n    else\n        Log.Error(\"Updater error: {Message}\", ex.Message);\n};","preventionTips":["Delete a corrupted installed manifest so Duplicati re-downloads a signed copy.","Keep the build's signing keys current with the manifests you install.","Avoid editing manifest files on disk manually."],"tags":["auto-updater","signing","manifest","security","filesystem"],"backgroundTag":null,"analyzedSha":"3f348be3e33f5d72d414e3ad55839c2ba34dda67","analyzedAt":"2026-08-13T16:48:27.008Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}