{"record":{"id":"e855d7bd4e59a8bd","repo":"ruvnet/ruflo","slug":"sha256sums-sig-failed-ed25519-verification-refus","errorCode":null,"errorMessage":"SHA256SUMS.sig failed Ed25519 verification — refusing to install","messagePattern":"SHA256SUMS\\.sig failed Ed25519 verification — refusing to install","errorType":"exception","errorClass":"ReleaseVerificationError","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/cli/src/proxy/verify.ts","lineNumber":79,"sourceCode":"  sigBase64: string;\n  assetBytes: Buffer;\n  assetFilename: string;\n  pubkeyPem?: string;\n}\n\nexport interface VerifyReleaseResult {\n  sha256: string;\n}\n\n/**\n * Full verification: signature over SHA256SUMS, then the asset's own hash\n * against the matching line. Throws `ReleaseVerificationError` on ANY\n * failure — there is no partial-trust outcome, matching ADR-307's \"refuses\n * on any mismatch\" requirement.\n */\nexport function verifyRelease(input: VerifyReleaseInput): VerifyReleaseResult {\n  if (!verifySha256SumsSignature(input.sumsBytes, input.sigBase64, input.pubkeyPem)) {\n    throw new ReleaseVerificationError('SHA256SUMS.sig failed Ed25519 verification — refusing to install');\n  }\n\n  const sums = parseSha256Sums(input.sumsBytes.toString('utf-8'));\n  const expected = sums[input.assetFilename];\n  if (!expected) {\n    throw new ReleaseVerificationError(`SHA256SUMS has no entry for ${input.assetFilename}`);\n  }\n\n  const actual = sha256Hex(input.assetBytes);\n  if (actual !== expected) {\n    throw new ReleaseVerificationError(\n      `sha256 mismatch for ${input.assetFilename}: expected ${expected.slice(0, 12)}…, got ${actual.slice(0, 12)}…`,\n    );\n  }\n\n  return { sha256: actual };\n}\n","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/ruvnet/ruflo/blob/6b01dc5a687b26b3e218f796de45ec51f8fa9e8c/v3/@claude-flow/cli/src/proxy/verify.ts#L61-L97","documentation":"Error \"SHA256SUMS.sig failed Ed25519 verification — refusing to install\" thrown in ruvnet/ruflo.","triggerScenarios":"Thrown at v3/@claude-flow/cli/src/proxy/verify.ts:79 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6b01dc5a687b26b3e218f796de45ec51f8fa9e8c","analyzedAt":"2026-08-12T13:20:50.148Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}