ruby/rubygems · error · Gem::Security::Exception

invalid signature

Error message

invalid signature

What it means

Error "invalid signature" thrown in ruby/rubygems.

Source

Thrown at lib/rubygems/security/policy.rb:76

    raise Gem::Security::Exception, "empty signing chain" if chain.empty?

    begin
      chain.each_cons 2 do |issuer, cert|
        check_cert cert, issuer, time
      end

      true
    rescue Gem::Security::Exception => e
      raise Gem::Security::Exception, "invalid signing chain: #{e.message}"
    end
  end

  ##
  # Verifies that +data+ matches the +signature+ created by +public_key+ and
  # the +digest+ algorithm.

  def check_data(public_key, digest, signature, data)
    raise Gem::Security::Exception, "invalid signature" unless
      public_key.verify digest, signature, data.digest

    true
  end

  ##
  # Ensures that +signer+ is valid for +time+ and was signed by the +issuer+.
  # If the +issuer+ is +nil+ no verification is performed.

  def check_cert(signer, issuer, time)
    raise Gem::Security::Exception, "missing signing certificate" unless
      signer

    message = "certificate #{signer.subject}"

    if (not_before = signer.not_before) && not_before > time
      raise Gem::Security::Exception,
            "#{message} not valid before #{not_before}"

View on GitHub (pinned to 86cbb817a3)

Solutions

1. The gem signature does not verify; re-download the gem from the official source
2. If you maintain the gem, re-sign it and republish

When it happens

Trigger: Thrown at lib/rubygems/security/policy.rb:76 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruby/rubygems@86cbb817a3 (2026-08-23). Data as JSON: /api/errors/33351aebfcbf4e74. Report an issue: GitHub.