ruvnet/ruflo · error

[Discovery] Warning: Registry signature verification failed

Error message

[Discovery] Warning: Registry signature verification failed

What it means

Log warning in discoverRegistry: signature verification of a trusted registry failed (wrong signer key or tampered content); the discovery result marks the registry unverified so callers can reject or fall back.

Source

Thrown at v3/@claude-flow/cli/src/transfer/store/discovery.ts:119

    // Fetch registry from IPFS
    console.log(`[Discovery] Fetching from IPFS: ${resolution.cid}`);
    const registry = await this.fetchRegistry(resolution.cid, knownRegistry.gateway);

    if (!registry) {
      return {
        success: false,
        source: knownRegistry.name,
        fromCache: false,
        cid: resolution.cid,
        error: 'Failed to fetch registry from IPFS',
      };
    }

    // Verify registry if trusted
    if (knownRegistry.trusted && registry.registrySignature) {
      const verified = this.verifyRegistry(registry, knownRegistry.publicKey);
      if (!verified) {
        console.warn(`[Discovery] Warning: Registry signature verification failed`);
      }
    }

    // Cache the result
    this.cacheRegistry(knownRegistry.ipnsName, registry);

    return {
      success: true,
      registry,
      source: knownRegistry.name,
      fromCache: false,
      cid: resolution.cid,
    };
  }

  /**
   * Resolve IPNS name to CID via real IPFS gateway
   */

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Verify the registry signing key and source; a failed signature means the registry may be tampered with — do not install from it until verified.

When it happens

Trigger: Thrown at v3/@claude-flow/cli/src/transfer/store/discovery.ts:119 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/fee6b4b16b221401. Report an issue: GitHub.