duplicati/duplicati · warning · Exception

No signing keys are available, cannot check update

Error message

No signing keys are available, cannot check update

What it means

Thrown by UpdaterManager.CheckForUpdate when the SIGN_KEYS array is empty, meaning this build was compiled with no update-signing keys embedded. Without signing keys the updater cannot verify a manifest signature, so it refuses to check for updates rather than trust an unsigned manifest.

Source

Thrown at Duplicati/Library/AutoUpdater/UpdaterManager.cs:220

                // but does not require that they adopt the channel system
                var match = AutoUpdateSettings.MATCH_AUTOUPDATE_URL.Match(url);
                if (match.Success)
                {
                    var mg = match.Groups[AutoUpdateSettings.MATCH_UPDATE_URL_CHANNEL_GROUP];

                    // Replace the channel name with the chosen channel
                    url =
                        url.Substring(0, mg.Index)
                        +
                        channel.ToString().ToLowerInvariant()
                        +
                        url.Substring(mg.Index + mg.Length);
                }

                try
                {
                    if (SIGN_KEYS.Length == 0)
                        throw new Exception("No signing keys are available, cannot check update");

                    using (var tmpfile = new TempFile())
                    {

                        using var request = new HttpRequestMessage(HttpMethod.Get, url);

                        request.Headers.Add(System.Net.HttpRequestHeader.UserAgent.ToString(), string.Format("{0} v{1}{2}", APPNAME, SelfVersion.Version, string.IsNullOrWhiteSpace(DataFolderManager.InstallID) ? "" : " -" + DataFolderManager.InstallID));
                        request.Headers.Add("X-Install-ID", DataFolderManager.InstallID);
                        request.Headers.Add("X-Package-Type-ID", PackageTypeId);

                        using var timeoutToken = new CancellationTokenSource();
                        timeoutToken.CancelAfter(TimeSpan.FromSeconds(SHORT_OPERATION_TIMEOUT_SECONDS));
                        using (var client = HttpClientHelper.CreateClient())
                        {
                            client.Timeout = Timeout.InfiniteTimeSpan;
                            client.DownloadFile(request, tmpfile, null, timeoutToken.Token).Await();
                        }

View on GitHub (pinned to 3f348be3e3)

Solutions

1. Use an official signed release build of Duplicati instead of a locally compiled one for production update checks.
2. If you control the build, inject the signing-key resource so SIGN_KEYS is populated, or disable automatic update checking for unsigned builds.
3. Set AutoUpdateSettings/CheckForUpdates to false to avoid invoking CheckForUpdate on builds without keys.
4. For a private deployment, configure MANIFEST_URLS and SIGN_KEYS to your own keypair so verification can proceed.

// Detect an unsigned build before attempting update checks
if (UpdaterManager.SIGN_KEYS == null || UpdaterManager.SIGN_KEYS.Length == 0)
{
    Log.Information("This build has no signing keys; skipping update check");
    return; // do not call CheckForUpdate
}

try
{
    var update = UpdaterManager.CheckForUpdate(channel);
}
catch (Exception ex) when (ex.Message == "No signing keys are available, cannot check update")
{
    // Expected for dev/unsigned builds; disable auto-update rather than retry
    Log.Information("No signing keys present; automatic updates disabled on this build");
}

When it happens

Trigger: CheckForUpdate is called, and at the top of the per-URL try block it tests SIGN_KEYS.Length == 0 and throws. This is a build-time configuration issue: the assembly was produced without the signing-key resource, typical of local or CI debug builds.

Common situations: A self-compiled or development build that did not include the release signing keys; a fork or custom build that stripped the key resource; building from source without the key-injection step present in the official release pipeline.

Related errors

• No valid signature found in manifest file
• Installed manifest signature is invalid
• Damaged or corrupted file, sha256 mismatch for {0}
• InsecureDataFolderPermissions
• InsecurePreloadFilePermissions

AI-assisted analysis of duplicati/duplicati@3f348be3e3 (2026-08-13). Data as JSON: /api/errors/55aa573e3d9a65c1. Report an issue: GitHub.