facebook/flow · warning · Error

Failed to verify SHASUM256.txt against public key

Error message

Failed to verify SHASUM256.txt against public key

What it means

Before using a flow-bin binary, the extension verifies the package's SHASUM256.txt against the bundled public key (signing.pem) with a sha256 signature. On failure this error is thrown — but the surrounding function catches it and falls back to the historical PAST_FLOW_BIN_SHASUMS.txt, so it normally surfaces only as a log line ('Unable to verify SHASUM256.txt.sign').

Source

Thrown at packages/flow-for-vscode/src/utils/getVerifiedFlowBinPath.ts:77

async function getShasums(
  flowBinModulePath: string,
  logger: Logger,
): Promise<Buffer> {
  const extensionPath = getExtensionPath();
  try {
    // try verifying against SHASUM256.txt.sign
    const shasums = await readFile(
      path.join(flowBinModulePath, 'SHASUM256.txt'),
    );
    const shasumsSignatureBase64 = await readFile(
      path.join(flowBinModulePath, 'SHASUM256.txt.sign'),
      'ascii',
    );
    const shasumsSignature = Buffer.from(shasumsSignatureBase64, 'base64');
    const publicKey = await readFile(path.join(extensionPath, 'signing.pem'));
    if (!verify('sha256', shasums, publicKey, shasumsSignature)) {
      throw new Error('Failed to verify SHASUM256.txt against public key');
    }
    return shasums;
  } catch (err: any) {
    logger.info(`Unable to verify SHASUM256.txt.sign:\n${err.message}`);
    return readFile(path.join(extensionPath, 'PAST_FLOW_BIN_SHASUMS.txt'));
  }
}

function getShasum(
  shasums: string,
  flowBinDirName: string,
  flowBinName: string,
): string {
  const flowBinRelativePath = `${flowBinDirName}/${flowBinName}`;
  // eslint-disable-next-line require-unicode-regexp
  const shasumLines = shasums.split(/\r?\n/);
  const shasumLine = shasumLines.find((line) =>
    line.includes(flowBinRelativePath),

View on GitHub (pinned to d1341dac89)

Solutions

1. Usually no action — check the log line that follows; the fallback engages automatically
2. Align the extension and flow-bin versions so the shipped signature matches the extension's signing.pem
3. Update the VS Code Flow extension to obtain the current public key

import {access} from 'fs/promises';
import path from 'path';

async function signatureFilesPresent(flowBinModulePath: string): Promise<boolean> {
  try {
    await access(path.join(flowBinModulePath, 'SHASUM256.txt'));
    await access(path.join(flowBinModulePath, 'SHASUM256.txt.sign'));
    return true;
  } catch {
    return false;
  }
}

// the function already catches internally and falls back to
// PAST_FLOW_BIN_SHASUMS.txt; if you wrap it, only log:
try {
  const shasums = await getShasums(flowBinModulePath, logger);
} catch (err) {
  logger.warn(`checksum source unavailable: ${err.message}`);
  throw err;
}

When it happens

Trigger: SHASUM256.txt.sign missing or corrupt, signing.pem not matching the key that signed the shipped flow-bin (extension/package version skew), or tampered checksum files. The throw is internal; the fallback path engages.

Common situations: Mixing a very new flow-bin with an old extension (or vice versa) across a signing-key rotation; environments stripping .sign files; older flow-bin releases predating signing.

Related errors

• Hash of ${flowBinPath} does not match hash from SHASUM256.tx
• Failed to find SHASUM256.txt line containing ${flowBinRelati
• Pkg flow-bin not found in ${dirsToCheck.join(', ')}
• Failed to determine correct binary for platform ${process.pl
• Failed to find anything starting with ${dirPrefix} in ${flow

AI-assisted analysis of facebook/flow@d1341dac89 (2026-08-17). Data as JSON: /api/errors/3d5e9d3dc59236df. Report an issue: GitHub.