goreleaser/goreleaser · error

invalid list of artifacts to sign: %s

Error message

invalid list of artifacts to sign: %s

What it means

The sign pipe filters which artifacts to sign via the `artifacts` config field, which accepts a fixed set of values (checksum, all, source, package, archive, binary, sbom, none). Any other value causes this error listing the invalid configured value. It is a configuration validation error raised while building the artifact filters.

Source

Thrown at internal/pipe/sign/sign.go:126

				filters = append(
					filters,
					artifact.And(
						artifact.ByTypes(artifact.ReleaseUploadableTypes()...),
						artifact.Not(artifact.ByTypes(artifact.Signature, artifact.Certificate)),
					),
				)
			case "archive":
				filters = append(filters, artifact.ByType(artifact.UploadableArchive))
			case "binary":
				filters = append(filters, artifact.ByType(artifact.UploadableBinary))
			case "sbom":
				filters = append(filters, artifact.ByType(artifact.SBOM))
			case "package":
				filters = append(filters, artifact.ByType(artifact.LinuxPackage))
			case "none": // TODO(caarlos0): this is not very useful, lets remove it.
				return pipe.ErrSkipSignEnabled
			default:
				return fmt.Errorf("invalid list of artifacts to sign: %s", cfg.Artifacts)
			}

			filters = append(filters, artifact.ByIDs(cfg.IDs...))
			return sign(ctx, cfg, ctx.Artifacts.Filter(artifact.And(filters...)).List())
		})
	}
	err := g.Wait()
	if err != nil && !pipe.IsSkip(err) {
		return err
	}

	if rerr := ctx.Artifacts.Refresh(); rerr != nil {
		return rerr
	}
	return err
}

func sign(ctx *context.Context, cfg config.Sign, artifacts []*artifact.Artifact) error {

View on GitHub (pinned to f5edd73956)

Solutions

1. Set artifacts to one of the allowed values: all, checksum, source, package, archive, binary, sbom, none
2. Run `goreleaser check` to validate the config schema before releasing
3. Consult the GoReleaser sign pipe docs for the version in use, since accepted values changed across majors
4. If you intended to skip signing, use `artifacts: none`

Example fix

# before
signs:
  - artifacts: bins
    certificate: "${artifact}.pem"
# after
signs:
  - artifacts: checksum
    certificate: "${artifact}.pem"

// Validate sign artifacts values before running goreleaser
valid := map[string]bool{
	"all": true, "checksum": true, "source": true, "package": true,
	"archive": true, "binary": true, "sbom": true, "none": true,
}
for _, s := range cfg.Signs {
	for _, a := range s.Artifacts {
		if !valid[strings.ToLower(a)] {
			return fmt.Errorf("signs.artifacts %q invalid; use all|checksum|source|package|archive|binary|sbom|none", a)
		}
	}
}

func isValidSignArtifacts(v string) bool {
	switch v {
	case "all", "checksum", "source", "package", "archive", "binary", "sbom", "none":
		return true
	}
	return false
}

if err := run(ctx); err != nil {
	if strings.Contains(err.Error(), "invalid list of artifacts to sign") {
		log.Fatalf("fix signs.artifacts in .goreleaser.yaml: %v", err)
	}
	return err
}

When it happens

Trigger: A `signs:` (or similar) config block contains `artifacts: <value>` where value is not one of: all, checksum, source, package, archive, binary, sbom, none — e.g. a typo like `artifact:` pluralization mistakes, or `artifacts: bins`.

Common situations: Typo (`archives` vs `archive`, `checksus` vs `checksum`); copying config from an older GoReleaser version where allowed values differed; YAML indentation making a list render as an unexpected value.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• 'server' is a required config key
• 'category_id' is a required config key
• no tags provided
• no app_id provided for flatpak
• no runtime provided for flatpak

AI-assisted analysis of goreleaser/goreleaser@f5edd73956 (2026-09-05). Data as JSON: /api/errors/3816a80344ff5a98. Report an issue: GitHub.