netbirdio/netbird · error

failed to verify artifact: %w

Error message

failed to verify artifact: %w

What it means

Generic wrapper from the verify-artifact RunE around handleVerifyArtifact. It wraps public key or bundle parsing, reading the artifact or signature file, signature decoding, or reposign.ValidateArtifact failures: future-dated or too-old signature timestamps, 'signing Key ... expired at', 'signature verification failed for Key ...', or 'no signing Key found with ID ...' when the key list does not contain the signer's key.

Source

Thrown at client/cmd/signer/artifactsign.go:51

	Long: `Sign a software artifact (e.g., update bundle or binary) using the artifact's private key.
This command produces a detached signature that can be verified using the corresponding artifact public key.`,
	SilenceUsage: true,
	RunE: func(cmd *cobra.Command, args []string) error {
		if err := handleSignArtifact(cmd, signArtifactPrivKeyFile, signArtifactArtifactFile); err != nil {
			return fmt.Errorf("failed to sign artifact: %w", err)
		}
		return nil
	},
}

var verifyArtifactCmd = &cobra.Command{
	Use:          "verify-artifact",
	Short:        "Verify an artifact signature using an artifact public key",
	Long:         `Verify a software artifact signature using the artifact's public key.`,
	SilenceUsage: true,
	RunE: func(cmd *cobra.Command, args []string) error {
		if err := handleVerifyArtifact(cmd, verifyArtifactPubKeyFile, verifyArtifactFile, verifyArtifactSignatureFile); err != nil {
			return fmt.Errorf("failed to verify artifact: %w", err)
		}
		return nil
	},
}

var verifyArtifactKeyCmd = &cobra.Command{
	Use:   "verify-artifact-key",
	Short: "Verify an artifact public key was signed by a root key",
	Long: `Verify that an artifact public key (or bundle) was properly signed by a root key.
This validates the chain of trust from the root key to the artifact key.`,
	SilenceUsage: true,
	RunE: func(cmd *cobra.Command, args []string) error {
		if err := handleVerifyArtifactKey(cmd, verifyArtifactKeyPubKeyFile, verifyArtifactKeyRootPubKeyFile, verifyArtifactKeySignatureFile, verifyArtifactKeyRevocationFile); err != nil {
			return fmt.Errorf("failed to verify artifact key: %w", err)
		}
		return nil
	},
}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Read the chained ValidateArtifact message; 'no signing Key found with ID' means the verifier's key set is stale — distribute the new pub key or bundle
2. Fix clock sync if the message says the timestamp is in the future
3. Re-sign recent artifacts if the signature is rejected as too old or the key had expired at signing time
4. Confirm the artifact and .signature paths belong to the same build

// Publish the current signing pub key/bundle to verifiers before rotating
// and assert the signature's KeyID exists in the verifier key set after each rotation

err := verifyArtifactCmd.Execute()
if err != nil {
    msg := err.Error()
    switch {
    case strings.Contains(msg, "no signing Key found with ID"):
        // verifier key set is stale: fetch the updated bundle
    case strings.Contains(msg, "timestamp is in the future"):
        // fix NTP on this host, then retry
    case strings.Contains(msg, "revoked"), strings.Contains(msg, "expired"):
        // reject the artifact: key revoked or expired at signing time
    default:
        return err
    }
}

When it happens

Trigger: Verifying with a public key set that lacks the key that produced the signature; system clock skew (future timestamp rejection); signature older than the accepted window; mismatched artifact/signature pair; expired artifact key at signature time.

Common situations: Rolling a signing key without publishing the new public key/bundle to verifiers; NTP drift on the verifying host; re-verification of old artifacts after the signing key expired.

Related errors

• failed to verify artifact key: %w
• --expiration must be a positive duration (e.g., 720h, 365d,
• failed to create artifact key: %w
• at least one --artifact-pub-key-file must be provided
• failed to bundle public keys: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/a35a95e6bba5a5b2. Report an issue: GitHub.