{"record":{"id":"c377f9ebb14e964e","repo":"restic/restic","slug":"gpg-signature-verification-of-the-file-sha256sums","errorCode":null,"errorMessage":"GPG signature verification of the file SHA256SUMS failed","messagePattern":"GPG signature verification of the file SHA256SUMS failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/selfupdate/download.go","lineNumber":150,"sourceCode":"\tprintf(\"latest version is %v\\n\", rel.Version)\n\n\t_, sha256sums, err := getGithubDataFile(ctx, rel.Assets, \"SHA256SUMS\", printf)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\t_, sig, err := getGithubDataFile(ctx, rel.Assets, \"SHA256SUMS.asc\", printf)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tok, err := GPGVerify(sha256sums, sig)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tif !ok {\n\t\treturn \"\", errors.New(\"GPG signature verification of the file SHA256SUMS failed\")\n\t}\n\n\tprintf(\"GPG signature verification succeeded\\n\")\n\n\text := \"bz2\"\n\tif runtime.GOOS == \"windows\" {\n\t\text = \"zip\"\n\t}\n\n\tsuffix := fmt.Sprintf(\"%s_%s.%s\", runtime.GOOS, runtime.GOARCH, ext)\n\tdownloadFilename, buf, err := getGithubDataFile(ctx, rel.Assets, suffix, printf)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tprintf(\"downloaded %v\\n\", downloadFilename)\n\n\twantHash, err := findHash(sha256sums, downloadFilename)","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/restic/restic/blob/a80be1478a4c537f8396e0db2b05120aa78f11e0/internal/selfupdate/download.go#L132-L168","documentation":"During self-update, restic downloads SHA256SUMS and SHA256SUMS.asc and runs GPGVerify on them. If verification executes but yields ok == false, this error is returned: the signature does not match the signed data, or it was not made by a key restic trusts. This is a hard security stop before any binary is installed.","triggerScenarios":"`restic self-update` where the SHA256SUMS content or its .asc signature was altered in transit (MITM, re-writing proxy), or the signature was produced by an unknown/untrusted key so verification resolves to false.","commonSituations":"Man-in-the-middle tampering with GitHub asset downloads; mirrors or caches that regenerate assets; local GPG keyring of trusted release keys outdated after a signing-key rotation.","solutions":["Treat it seriously first: verify network path (DNS, proxy, TLS) is not intercepting github.com traffic","Update restic via a trusted channel (package manager, or manual download from the official releases page verified with the published fingerprints)","If caused by signing-key rotation, upgrade via distro package or build from signed source until the trusted key set catches up","Do not bypass or ignore the failure; report persistent verified-mismatch to the restic maintainers"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never bypass GPG verification failures; treat them as possible tampering","Update via package manager or manually verified downloads when self-update fails","Keep track of restic's release-signing key rotations via official announcements"],"tags":["security","gpg","self-update","signature","supply-chain"],"backgroundTag":null,"analyzedSha":"a80be1478a4c537f8396e0db2b05120aa78f11e0","analyzedAt":"2026-08-15T15:30:29.928Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}