{"record":{"id":"b80d440e58f408ee","repo":"JanDeDobbeleer/oh-my-posh","slug":"failed-to-verify-checksums-signature","errorCode":null,"errorMessage":"failed to verify checksums signature","messagePattern":"failed to verify checksums signature","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cli/upgrade/verify.go","lineNumber":79,"sourceCode":"}\n\nfunc verify(cfg *Config, asset string, binary []byte) error {\n\tchecksums, err := cfg.DownloadAsset(\"checksums.txt\")\n\tif err != nil {\n\t\tlog.Debug(\"failed to download checksums\")\n\t\treturn err\n\t}\n\n\tsignature, err := cfg.DownloadAsset(\"checksums.txt.sig\")\n\tif err != nil {\n\t\tlog.Debug(\"failed to download checksums signature\")\n\t\treturn err\n\t}\n\n\tOK := validateSignature(checksums, signature)\n\tif !OK {\n\t\tlog.Debug(\"failed to verify checksums signature\")\n\t\treturn fmt.Errorf(\"failed to verify checksums signature\")\n\t}\n\n\treturn validateChecksum(asset, checksums, binary)\n}\n\nfunc validateSignature(data, signature []byte) bool {\n\ted25519PublicKey, err := loadPublicKey()\n\tif err != nil {\n\t\tlog.Debug(\"failed to load public key\")\n\t\tlog.Error(err)\n\t\treturn false\n\t}\n\n\treturn ed25519.Verify(*ed25519PublicKey, data, signature)\n}\n\nfunc loadPublicKey() (*ed25519.PublicKey, error) {\n\tblock, _ := pem.Decode(publicKey)","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/JanDeDobbeleer/oh-my-posh/blob/0976794618c5ed95de0985dded50de1b4dc914cb/src/cli/upgrade/verify.go#L61-L97","documentation":"The updater verifies that the downloaded SHA256 checksums file was signed with the project's ed25519 key. `validateSignature` returns false when the cryptographic signature check fails, and `verify` surfaces this generic error. This protects against tampered or truncated downloads.","triggerScenarios":"downloadAndVerify downloads checksums.txt and its .sig, then validateSignature returns false — signature bytes corrupted in transit, checksums file modified (MITM/proxy), or the downloaded signature does not match the embedded public key's signing scheme.","commonSituations":"Corporate TLS-inspection proxies altering the payload; incomplete/corrupted download; a release where the signature was regenerated with a different key than the binary embeds.","solutions":["Re-run the upgrade — transient corruption is fixed by re-downloading","Bypass intercepting proxies (disable TLS inspection or use a direct connection)","Verify manually: compare the asset checksum on the GitHub release page","Upgrade via a package manager instead of the self-updater if it persists"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := cli.Upgrade(); err != nil {\n    if strings.Contains(err.Error(), \"failed to verify checksums signature\") {\n        // suspect corrupted/tampered download: retry once, then fall back to manual install\n    }\n}","preventionTips":["Avoid TLS-intercepting proxies during upgrades","Re-download on any network interruption rather than caching partial files","Fall back to a package manager for verified installs"],"tags":["security","signature","ed25519","upgrade"],"backgroundTag":"signature-verification-failed","analyzedSha":"0976794618c5ed95de0985dded50de1b4dc914cb","analyzedAt":"2026-08-31T23:41:19.708Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}