ruvnet/ruflo · error

[Download] Warning: Signature verification failed!

Error message

[Download] Warning: Signature verification failed!

What it means

Log warning in downloadPattern: the pattern's signature does not verify against its published public key (content not authenticated); the download is treated as unverified and may be rejected depending on config.

Source

Thrown at v3/@claude-flow/cli/src/transfer/store/download.ts:112

          console.warn(`[Download] Warning: Checksum verification failed!`);
          if (this.config.requireVerification) {
            return {
              success: false,
              pattern,
              verified: false,
              size: content.length,
            };
          }
        } else {
          console.log(`[Download] Checksum verified!`);
        }
      }

      // Verify signature if available
      if (pattern.signature && pattern.publicKey) {
        const sigVerified = this.verifySignature(content, pattern.signature, pattern.publicKey);
        if (!sigVerified) {
          console.warn(`[Download] Warning: Signature verification failed!`);
        } else {
          console.log(`[Download] Signature verified!`);
        }
      }

      // Write to file
      fs.writeFileSync(outputPath, content);
      console.log(`[Download] Written to: ${outputPath}`);

      // Update cache
      this.downloadCache.set(pattern.cid, {
        path: outputPath,
        downloadedAt: Date.now(),
      });

      // Import if requested
      let imported = false;
      if (options.import) {

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Do not use the downloaded artifact; verify the signing key and source — a failed signature may indicate tampering.

When it happens

Trigger: Thrown at v3/@claude-flow/cli/src/transfer/store/download.ts:112 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/597ea946d40900d6. Report an issue: GitHub.