{"record":{"id":"9a18417862e5cbaf","repo":"paperclipai/paperclip","slug":"cloud-runtime-identity-signing-key-is-invalid","errorCode":null,"errorMessage":"Cloud runtime identity signing key is invalid","messagePattern":"Cloud runtime identity signing key is invalid","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/src/services/cloud-runtime-identity.ts","lineNumber":255,"sourceCode":"  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    throw new Error(\"PAPERCLIP_CLOUD_RUNTIME_IDENTITY_JWKS is invalid\");\n  }\n  const keys = parsed && typeof parsed === \"object\" && !Array.isArray(parsed)\n    ? (parsed as { keys?: unknown }).keys\n    : undefined;\n  if (!Array.isArray(keys)) throw new Error(\"PAPERCLIP_CLOUD_RUNTIME_IDENTITY_JWKS is invalid\");\n  const matches = keys.filter((candidate): candidate is JsonWebKey & { kid: string } => {\n    if (!candidate || typeof candidate !== \"object\" || Array.isArray(candidate)) return false;\n    const key = candidate as JsonWebKey & { kid?: unknown };\n    return key.kid === kid;\n  });\n  if (matches.length !== 1) throw new Error(\"Cloud runtime identity uses an unknown signing key\");\n  const jwk = matches[0];\n  if (jwk.kty !== \"OKP\" || jwk.crv !== \"Ed25519\" || jwk.use !== \"sig\" || jwk.alg !== \"EdDSA\" || !jwk.x || jwk.d) {\n    throw new Error(\"Cloud runtime identity signing key is invalid\");\n  }\n  return createPublicKey({ key: jwk, format: \"jwk\" });\n}\n\nfunction verifyClaims(input: {\n  compactJws: string;\n  env: NodeJS.ProcessEnv;\n  now: Date;\n}): RuntimeIdentityClaims {\n  const parts = input.compactJws.split(\".\");\n  if (parts.length !== 3 || parts.some((part) => part.length === 0)) {\n    throw new Error(\"Cloud runtime identity assertion is not a compact JWS\");\n  }\n  const [encodedHeader, encodedPayload, encodedSignature] = parts;\n  const header = decodeJsonPart(encodedHeader, \"protected header\");\n  if (\n    header.alg !== \"EdDSA\"\n    || header.typ !== CLOUD_RUNTIME_IDENTITY_JWS_TYPE","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/services/cloud-runtime-identity.ts#L237-L273","documentation":"Same function and conditions as error 614 (JWKS entry not a valid Ed25519 sig public key), surfaced here as its own indexed throw site at line 255. Any deviation in kty/crv/use/alg, a missing x, or presence of the private d field on the matched JWK produces this message.","triggerScenarios":"Identical to error 614: matched JWK fails the strict check jwk.kty === 'OKP' && jwk.crv === 'Ed25519' && jwk.use === 'sig' && jwk.alg === 'EdDSA' && !!jwk.x && !jwk.d.","commonSituations":"Identical to error 614: wrong key type in JWKS, leaked private key material in the env var, missing use/alg metadata after hand-editing or transformation of the JWKS.","solutions":["Use the canonical public JWKS from the Cloud control plane verbatim","Strip any private component (d) and add use:\"sig\" and alg:\"EdDSA\" to the JWK","Validate the JWK locally with createPublicKey({key:jwk,format:'jwk'}) before deploying it","Rotate to a freshly generated Ed25519 keypair if the existing key material is wrong type"],"exampleFix":"// before\njwk.use === undefined // omitted\n// after\n{\"kty\":\"OKP\",\"crv\":\"Ed25519\",\"use\":\"sig\",\"alg\":\"EdDSA\",\"kid\":\"k1\",\"x\":\"<base64url>\"}","handlingStrategy":"validation","validationCode":"// same guard as 614 — run it against every JWKS entry at startup\nconst ok = (JSON.parse(jwks) as { keys: unknown[] }).keys.every(k =>\n  typeof k === \"object\" && k !== null && (k as any).kty === \"OKP\" && (k as any).crv === \"Ed25519\"\n  && (k as any).use === \"sig\" && (k as any).alg === \"EdDSA\" && typeof (k as any).x === \"string\" && !(\"d\" in (k as any)));","typeGuard":null,"tryCatchPattern":"try {\n  verifyCloudRuntimeIdentityAssertion({ compactJws: assertion, expectedPreviousOrigin: prev });\n} catch (e) {\n  if (String((e as Error).message).includes(\"signing key is invalid\")) {\n    logger.error(\"Rejecting identity assertion: JWKS key material does not meet Ed25519 sig requirements\", { error: e });\n  } else throw e;\n}","preventionTips":["Treat the control-plane JWKS as immutable config — copy verbatim, never hand-edit fields","Strip private components before publishing any JWK","Add a lint/startup check asserting every key is kty OKP, crv Ed25519, use sig, alg EdDSA","Rotate keys with the official tooling so metadata fields are always populated"],"tags":["jwks","ed25519","key-validation","security"],"backgroundTag":"invalid-config-value","analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-09-10T03:14:50.855Z","contentChangedAt":"2026-09-10T03:14:50.855Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}