{"record":{"id":"91168905bf9b0b01","repo":"JuliusBrussee/caveman","slug":"signature-check-failed-for-artifact-refusing","errorCode":null,"errorMessage":"signature check failed for ${artifact} — refusing to install; partial download deleted","messagePattern":"signature check failed for (.+?) — refusing to install; partial download deleted","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/cli/src/index.ts","lineNumber":2227,"sourceCode":"\n  if (!verifyChecksumSignature(checksumsRaw!, signatureRaw!)) {\n    throw new Error(\"signature check failed for checksums.txt — refusing to install; partial download deleted\");\n  }\n\n  let checksums: Map<string, string>;\n  try {\n    checksums = parseSignedChecksums(checksumsRaw!);\n  } catch {\n    throw new Error(\"signature check failed for checksums.txt — refusing to install; partial download deleted\");\n  }\n\n  const installed: InstalledBinary[] = [];\n  const artifactDigests: Record<string, string> = {};\n  for (const name of INSTALL_BINARIES) {\n    const artifact = `${name}_${platform.os}_${platform.arch}`;\n    const expected = checksums.get(artifact);\n    if (!expected) {\n      throw new Error(`signature check failed for ${artifact} — refusing to install; partial download deleted`);\n    }\n    const target = join(binDir, binaryInstallFilename(name, platform.os));\n    artifactDigests[name] = expected;\n    if (sha256File(target) === expected) {\n      installed.push({ name, path: target, sha256: expected, status: \"already installed\" });\n      continue;\n    }\n\n    const partial = `${target}.part`;\n    cleanupPartial(partial);\n    installProgressStart(name, platform);\n    let result: { sha256: string; bytes: number };\n    try {\n      result = await downloadReleaseBinary(`${releaseBase}/${artifact}`, partial, timeoutSeconds);\n    } catch (error) {\n      cleanupPartial(partial);\n      setupInstallFailure(error, timeoutSeconds);\n    }","sourceCodeStart":2209,"sourceCodeEnd":2245,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/packages/cli/src/index.ts#L2209-L2245","documentation":"Before downloading each binary, the installer looks up `<name>_<os>_<arch>` in the parsed checksums map; if the artifact key is absent it throws this error. It means the release does not publish a checksummed artifact for the current platform, and the CLI refuses to install an unverifiable binary.","triggerScenarios":"`caveman setup --install` on a platform/os-arch combination missing from the release (e.g. a new or uncommon arch like linux/riscv64, freebsd, or a musl variant spelled differently), or a release that only ships a subset of platform artifacts.","commonSituations":"Running on exotic hardware or an OS the release pipeline does not target; an arm64 Windows or 32-bit machine; a partial release where some artifacts failed to upload but checksums were regenerated from what exists.","solutions":["Check the release's checksums.txt for your `<binary>_<os>_<arch>` key to confirm the platform is unsupported","Build the Go binaries from source and place them on PATH or in ~/.caveman/bin (scripts/install-local-cli.sh does this)","Set CAVEMAN_PROXY_BIN / CAVEMAN_ENGINE_BIN / CAVEMAN_MCP_BIN env overrides to locally built binaries","Request/follow an upstream release adding your platform"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before install, confirm the platform artifact exists in checksums.txt:\nconst res = await fetch(`${releaseBase}/checksums.txt`);\nconst text = await res.text();\nconst key = `${binaryName}_${process.platform}_${process.arch}`;\nif (!text.includes(key)) {\n  console.error(`no release artifact for ${key} — build from source instead`);\n}","typeGuard":"function isMissingPlatformArtifactError(e: unknown): boolean {\n  return e instanceof Error && e.message.startsWith(\"signature check failed for \") && e.message.includes(\"_\" + process.platform) ;\n}","tryCatchPattern":"try {\n  await runCavemanSetupInstall();\n} catch (e) {\n  if (isMissingPlatformArtifactError(e)) buildFromSourceAndSetEnvOverrides();\n  else throw e;\n}","preventionTips":["Check the release's supported platform matrix before adopting caveman on unusual OS/arch","Prefer building Go binaries from source (install-local-cli.sh) on unsupported platforms","Use CAVEMAN_PROXY_BIN/CAVEMAN_ENGINE_BIN/CAVEMAN_MCP_BIN overrides for custom builds"],"tags":["install","platform-support","checksum"],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}