{"record":{"id":"91168905bf9b0b01","repo":"JuliusBrussee/caveman","slug":"signature-check-failed-for-artifact-refusing","errorCode":null,"errorMessage":"signature check failed for ${artifact} — refusing to install; partial download deleted","messagePattern":"signature check failed for (.+?) — refusing to install; partial download deleted","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/cli/src/index.ts","lineNumber":2464,"sourceCode":"\n  if (!verifyChecksumSignature(checksumsRaw!, signatureRaw!)) {\n    throw new Error(\"signature check failed for checksums.txt — refusing to install; partial download deleted\");\n  }\n\n  let checksums: Map<string, string>;\n  try {\n    checksums = parseSignedChecksums(checksumsRaw!);\n  } catch {\n    throw new Error(\"signature check failed for checksums.txt — refusing to install; partial download deleted\");\n  }\n\n  const installed: InstalledBinary[] = [];\n  const artifactDigests: Record<string, string> = {};\n  for (const name of INSTALL_BINARIES) {\n    const artifact = `${name}_${platform.os}_${platform.arch}`;\n    const expected = checksums.get(artifact);\n    if (!expected) {\n      throw new Error(`signature check failed for ${artifact} — refusing to install; partial download deleted`);\n    }\n    const target = join(binDir, binaryInstallFilename(name, platform.os));\n    artifactDigests[name] = expected;\n    if (sha256File(target) === expected) {\n      installed.push({ name, path: target, sha256: expected, status: \"already installed\" });\n      continue;\n    }\n\n    const partial = `${target}.part`;\n    cleanupPartial(partial);\n    installProgressStart(name, platform);\n    let result: { sha256: string; bytes: number };\n    try {\n      result = await downloadReleaseBinary(`${releaseBase}/${artifact}`, partial, timeoutSeconds);\n    } catch (error) {\n      cleanupPartial(partial);\n      setupInstallFailure(error, timeoutSeconds);\n    }","sourceCodeStart":2446,"sourceCodeEnd":2482,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/packages/cli/src/index.ts#L2446-L2482","documentation":"For each binary in INSTALL_BINARIES the installer looks up '<name>_<os>_<arch>' in the parsed checksum map. If the entry for this exact platform artifact is missing, it throws this 'signature check failed' error rather than installing an unverified binary.","triggerScenarios":"checksums.get(`${name}_${platform.os}_${platform.arch}`) returns undefined — the manifest has no digest line for the current OS/arch combination (e.g. a newly released platform not yet covered, or an os/arch string mismatch).","commonSituations":"Running on a newer platform (e.g. linux/arm64) before the release added its checksum entry; typo'd or renamed artifact in the release; older pinned manifest missing the artifact.","solutions":["Check checksums.txt for a line matching <name>_<os>_<arch> for your platform.","Update the CLI/installer to the latest version that supports your platform.","Verify platform detection (process.platform/process.arch mapping) matches the artifact naming scheme.","If you own the release, add the missing artifact and regenerate the signed checksums."],"exampleFix":"// manifest missing entry\n// before: checksums.txt lacks 'caveman_linux_arm64'\n// after: release pipeline includes:\necho \"$(sha256sum caveman_linux_arm64)\" >> checksums.txt && re-sign","handlingStrategy":"validation","validationCode":"const artifact = `caveman_${process.platform}_${process.arch}`;\nconst manifest = await (await fetch(CHECKSUMS_URL)).text();\nif (!manifest.includes(artifact)) console.warn(`no checksum entry for ${artifact}; update installer`);","typeGuard":null,"tryCatchPattern":"try { await install() } catch (e) { if (/signature check failed for .+/.test(String(e.message))) console.error('Platform artifact missing from manifest — upgrade the installer or use a supported platform'); }","preventionTips":["Confirm your OS/arch is supported before installing on new hardware (e.g. linux/arm64).","Keep the CLI updated so platform coverage matches current releases.","Check the manifest naming scheme when cross-installing."],"tags":["checksum","platform","install","integrity"],"backgroundTag":"checksum-mismatch","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}