{"record":{"id":"c0737c064cd97766","repo":"JanDeDobbeleer/oh-my-posh","slug":"error-parsing-public-key-v","errorCode":null,"errorMessage":"error parsing public key: %v","messagePattern":"error parsing public key: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cli/upgrade/verify.go","lineNumber":106,"sourceCode":"\t\tlog.Debug(\"failed to load public key\")\n\t\tlog.Error(err)\n\t\treturn false\n\t}\n\n\treturn ed25519.Verify(*ed25519PublicKey, data, signature)\n}\n\nfunc loadPublicKey() (*ed25519.PublicKey, error) {\n\tblock, _ := pem.Decode(publicKey)\n\tif block == nil {\n\t\tlog.Debug(\"failed to decode PEM block\")\n\t\treturn nil, fmt.Errorf(\"error parsing PEM block: key not found\")\n\t}\n\n\tpubKey, err := x509.ParsePKIXPublicKey(block.Bytes)\n\tif err != nil {\n\t\tlog.Debug(\"failed to parse public key\")\n\t\treturn nil, fmt.Errorf(\"error parsing public key: %v\", err)\n\t}\n\n\ted25519PubKey, ok := pubKey.(ed25519.PublicKey)\n\tif !ok {\n\t\tlog.Debug(\"failed to convert public key to ed25519\")\n\t\treturn nil, fmt.Errorf(\"invalid public key format: %v\", err)\n\t}\n\n\treturn &ed25519PubKey, nil\n}\n\nfunc validateChecksum(asset string, sha256sums, binary []byte) error {\n\tvar assetChecksum string\n\tchecksums := strings.SplitSeq(string(sha256sums), \"\\n\")\n\n\tfor line := range checksums {\n\t\tif !strings.HasSuffix(line, asset) {\n\t\t\tcontinue","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/JanDeDobbeleer/oh-my-posh/blob/0976794618c5ed95de0985dded50de1b4dc914cb/src/cli/upgrade/verify.go#L88-L124","documentation":"After the PEM block decodes successfully, its DER bytes are parsed as a PKIX public key. If x509.ParsePKIXPublicKey cannot parse them, loadPublicKey fails with this error including the parser's message. Like the PEM error, this points to a bad embedded key rather than user configuration.","triggerScenarios":"validateSignature → loadPublicKey when the embedded key's DER payload is malformed, truncated, or not a PKIX SubjectPublicKeyInfo structure.","commonSituations":"Corrupted/partially downloaded binary; a hand-edited or rebuilt binary where the key material was replaced with a non-PKIX format (e.g. raw ed25519 or PKCS#1).","solutions":["Reinstall from the official release to restore the correct embedded key","If building from source, ensure the key file is exported in PKIX (SPKI) format, e.g. `openssl pkey -pubout`","Verify binary integrity via its checksum"],"exampleFix":"// before (raw ed25519 key breaks PKIX parsing)\nopenssl pkey -in key.pem -out pub.key -outform DER\n// after (export PKIX/SPKI public key)\nopenssl pkey -in key.pem -pubout -out pub.pem","handlingStrategy":"fallback","validationCode":"// validate key material before use\nblock, _ := pem.Decode(pubPEM)\nif block == nil { return errors.New(\"not PEM\") }\nif _, err := x509.ParsePKIXPublicKey(block.Bytes); err != nil { return err }","typeGuard":null,"tryCatchPattern":"if err := cli.Upgrade(); err != nil {\n    if strings.Contains(err.Error(), \"error parsing public key\") {\n        // embedded key malformed: reinstall official binary\n    }\n}","preventionTips":["Never hand-edit or repack the binary","When building from source, export keys in PKIX/SPKI format (openssl pkey -pubout)","Verify binary checksums to catch corruption early"],"tags":["security","x509","public-key","upgrade"],"backgroundTag":"public-key-parse-failed","analyzedSha":"0976794618c5ed95de0985dded50de1b4dc914cb","analyzedAt":"2026-08-31T23:41:19.708Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}