{"record":{"id":"fff22394d6e1dc37","repo":"JanDeDobbeleer/oh-my-posh","slug":"invalid-public-key-format-v","errorCode":null,"errorMessage":"invalid public key format: %v","messagePattern":"invalid public key format: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cli/upgrade/verify.go","lineNumber":112,"sourceCode":"}\n\nfunc loadPublicKey() (*ed25519.PublicKey, error) {\n\tblock, _ := pem.Decode(publicKey)\n\tif block == nil {\n\t\tlog.Debug(\"failed to decode PEM block\")\n\t\treturn nil, fmt.Errorf(\"error parsing PEM block: key not found\")\n\t}\n\n\tpubKey, err := x509.ParsePKIXPublicKey(block.Bytes)\n\tif err != nil {\n\t\tlog.Debug(\"failed to parse public key\")\n\t\treturn nil, fmt.Errorf(\"error parsing public key: %v\", err)\n\t}\n\n\ted25519PubKey, ok := pubKey.(ed25519.PublicKey)\n\tif !ok {\n\t\tlog.Debug(\"failed to convert public key to ed25519\")\n\t\treturn nil, fmt.Errorf(\"invalid public key format: %v\", err)\n\t}\n\n\treturn &ed25519PubKey, nil\n}\n\nfunc validateChecksum(asset string, sha256sums, binary []byte) error {\n\tvar assetChecksum string\n\tchecksums := strings.SplitSeq(string(sha256sums), \"\\n\")\n\n\tfor line := range checksums {\n\t\tif !strings.HasSuffix(line, asset) {\n\t\t\tcontinue\n\t\t}\n\n\t\tassetChecksum = strings.Fields(line)[0]\n\t\tbreak\n\t}\n","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/JanDeDobbeleer/oh-my-posh/blob/0976794618c5ed95de0985dded50de1b4dc914cb/src/cli/upgrade/verify.go#L94-L130","documentation":"The parsed public key must be an ed25519.PublicKey for signature validation. If the PKIX parse succeeded but produced a different key type (RSA, ECDSA, etc.), loadPublicKey returns this error. Note the format string prints `err`, which at this point is nil, so the message will read \"invalid public key format: %!v(MISSING)\"-style output — a minor logging bug in the source.","triggerScenarios":"validateSignature → loadPublicKey when the embedded PEM contains a valid PKIX key of a non-ed25519 type.","commonSituations":"The signing key was rotated or regenerated as RSA/ECDSA while the binary expects ed25519; building from source with a swapped key file.","solutions":["Reinstall the official binary whose embedded key type matches the release signatures","If building from source, regenerate the embedded key as ed25519: `openssl genpkey -algorithm ed25519`","Report a key-rotation mismatch if it appears in an official build"],"exampleFix":"// before (RSA key where ed25519 is required)\nopenssl genpkey -algorithm RSA -out key.pem\n// after\nopenssl genpkey -algorithm ed25519 -out key.pem","handlingStrategy":"validation","validationCode":"pub, err := x509.ParsePKIXPublicKey(block.Bytes)\nif err != nil { return err }\nif _, ok := pub.(ed25519.PublicKey); !ok { return errors.New(\"key is not ed25519\") }","typeGuard":"func isEd25519(pub any) bool { _, ok := pub.(ed25519.PublicKey); return ok }","tryCatchPattern":"if err := cli.Upgrade(); err != nil {\n    if strings.Contains(err.Error(), \"invalid public key format\") {\n        // signing key type mismatch: reinstall matching official release\n    }\n}","preventionTips":["Keep the embedded key and release signatures generated with the same ed25519 key","When rotating keys, regenerate both the embedded PEM and the release signatures together","Verify release signatures out-of-band when building from source"],"tags":["security","ed25519","key-type","upgrade"],"backgroundTag":"invalid-public-key-format","analyzedSha":"0976794618c5ed95de0985dded50de1b4dc914cb","analyzedAt":"2026-08-31T23:41:19.708Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}