{"record":{"id":"f20aa19931813fc9","repo":"ruvnet/ruflo","slug":"plugindiscovery-registry-signature-verification","errorCode":null,"errorMessage":"[PluginDiscovery] Registry signature verification failed for ${registry.name} (CID ${cid}); falling back to demo registry.","messagePattern":"\\[PluginDiscovery\\] Registry signature verification failed for (.+?) \\(CID (.+?)\\); falling back to demo registry\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/cli/src/plugins/store/discovery.ts","lineNumber":189,"sourceCode":"        }\n        console.log(`[PluginDiscovery] Resolved IPNS to CID: ${cid}`);\n      }\n\n      // Fetch registry from IPFS\n      const registryData = await fetchFromIPFS<PluginRegistry>(cid, registry.gateway);\n      if (!registryData) {\n        return this.createDemoRegistryAsync(registry);\n      }\n\n      // Verify registry signature when required.\n      // Fail closed on missing/invalid signature — silently warning and using\n      // an unverified registry would let a compromised IPFS gateway (or any\n      // on-path attacker) swap in attacker-mapped plugin entries that the\n      // installer would then load unsandboxed.\n      if (this.config.requireVerification) {\n        const verified = await this.verifyRegistrySignature(registryData, registry.publicKey);\n        if (!verified) {\n          console.warn(\n            `[PluginDiscovery] Registry signature verification failed for ` +\n              `${registry.name} (CID ${cid}); falling back to demo registry.`,\n          );\n          return this.createDemoRegistryAsync(registry);\n        }\n      }\n\n      // Cache the result\n      this.cache.set(registry.ipnsName, {\n        registry: registryData,\n        timestamp: Date.now(),\n      });\n\n      return {\n        success: true,\n        registry: registryData,\n        cid,\n        source: registry.name,","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/cli/src/plugins/store/discovery.ts#L171-L207","documentation":"Log warning in discoverRegistry: signature verification of the fetched plugin registry (by CID) failed, and the code fails closed — instead of using an unverified registry (attacker-swappable via a compromised gateway), it falls back to the demo registry.","triggerScenarios":"Thrown at v3/@claude-flow/cli/src/plugins/store/discovery.ts:189 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the registry signing key and CID source; the demo registry is used as fallback and should not be trusted for real installs."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}