{"record":{"id":"55aa573e3d9a65c1","repo":"duplicati/duplicati","slug":"no-signing-keys-are-available-cannot-check-update","errorCode":null,"errorMessage":"No signing keys are available, cannot check update","messagePattern":"No signing keys are available, cannot check update","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"warning","filePath":"Duplicati/Library/AutoUpdater/UpdaterManager.cs","lineNumber":220,"sourceCode":"                // but does not require that they adopt the channel system\r\n                var match = AutoUpdateSettings.MATCH_AUTOUPDATE_URL.Match(url);\r\n                if (match.Success)\r\n                {\r\n                    var mg = match.Groups[AutoUpdateSettings.MATCH_UPDATE_URL_CHANNEL_GROUP];\r\n\r\n                    // Replace the channel name with the chosen channel\r\n                    url =\r\n                        url.Substring(0, mg.Index)\r\n                        +\r\n                        channel.ToString().ToLowerInvariant()\r\n                        +\r\n                        url.Substring(mg.Index + mg.Length);\r\n                }\r\n\r\n                try\r\n                {\r\n                    if (SIGN_KEYS.Length == 0)\r\n                        throw new Exception(\"No signing keys are available, cannot check update\");\r\n\r\n                    using (var tmpfile = new TempFile())\r\n                    {\r\n\r\n                        using var request = new HttpRequestMessage(HttpMethod.Get, url);\r\n\r\n                        request.Headers.Add(System.Net.HttpRequestHeader.UserAgent.ToString(), string.Format(\"{0} v{1}{2}\", APPNAME, SelfVersion.Version, string.IsNullOrWhiteSpace(DataFolderManager.InstallID) ? \"\" : \" -\" + DataFolderManager.InstallID));\r\n                        request.Headers.Add(\"X-Install-ID\", DataFolderManager.InstallID);\r\n                        request.Headers.Add(\"X-Package-Type-ID\", PackageTypeId);\r\n\r\n                        using var timeoutToken = new CancellationTokenSource();\r\n                        timeoutToken.CancelAfter(TimeSpan.FromSeconds(SHORT_OPERATION_TIMEOUT_SECONDS));\r\n                        using (var client = HttpClientHelper.CreateClient())\r\n                        {\r\n                            client.Timeout = Timeout.InfiniteTimeSpan;\r\n                            client.DownloadFile(request, tmpfile, null, timeoutToken.Token).Await();\r\n                        }\r\n\r","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/duplicati/duplicati/blob/3f348be3e33f5d72d414e3ad55839c2ba34dda67/Duplicati/Library/AutoUpdater/UpdaterManager.cs#L202-L238","documentation":"Thrown by UpdaterManager.CheckForUpdate when the SIGN_KEYS array is empty, meaning this build was compiled with no update-signing keys embedded. Without signing keys the updater cannot verify a manifest signature, so it refuses to check for updates rather than trust an unsigned manifest.","triggerScenarios":"CheckForUpdate is called, and at the top of the per-URL try block it tests SIGN_KEYS.Length == 0 and throws. This is a build-time configuration issue: the assembly was produced without the signing-key resource, typical of local or CI debug builds.","commonSituations":"A self-compiled or development build that did not include the release signing keys; a fork or custom build that stripped the key resource; building from source without the key-injection step present in the official release pipeline.","solutions":["Use an official signed release build of Duplicati instead of a locally compiled one for production update checks.","If you control the build, inject the signing-key resource so SIGN_KEYS is populated, or disable automatic update checking for unsigned builds.","Set AutoUpdateSettings/CheckForUpdates to false to avoid invoking CheckForUpdate on builds without keys.","For a private deployment, configure MANIFEST_URLS and SIGN_KEYS to your own keypair so verification can proceed."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Detect an unsigned build before attempting update checks\nif (UpdaterManager.SIGN_KEYS == null || UpdaterManager.SIGN_KEYS.Length == 0)\n{\n    Log.Information(\"This build has no signing keys; skipping update check\");\n    return; // do not call CheckForUpdate\n}","typeGuard":null,"tryCatchPattern":"try\n{\n    var update = UpdaterManager.CheckForUpdate(channel);\n}\ncatch (Exception ex) when (ex.Message == \"No signing keys are available, cannot check update\")\n{\n    // Expected for dev/unsigned builds; disable auto-update rather than retry\n    Log.Information(\"No signing keys present; automatic updates disabled on this build\");\n}","preventionTips":["Use official signed release builds in production so update checks have keys to verify against.","Disable auto-update checks on unsigned/dev builds to avoid this error.","For private deployments, embed your own signing key into the build's SIGN_KEYS."],"tags":["auto-updater","signing","build-config","security"],"backgroundTag":null,"analyzedSha":"3f348be3e33f5d72d414e3ad55839c2ba34dda67","analyzedAt":"2026-08-13T16:48:27.008Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}