ruvnet/ruflo · error

[IPFS] Signature verification failed:

Error message

[IPFS] Signature verification failed:

What it means

Log warning in verifyEd25519Signature: the ed25519 verification itself threw (bad key hex, malformed signature, missing module) rather than verifying to false; the function treats the input as unverifiable and returns false.

Source

Thrown at v3/@claude-flow/cli/src/transfer/ipfs/client.ts:345

  signature: string,
  publicKey: string
): Promise<boolean> {
  try {
    // Dynamic import to avoid bundling @noble/ed25519 if not used
    const ed = await import('@noble/ed25519');

    // Handle prefixed public key (e.g., "ed25519:abc123...")
    const pubKeyHex = publicKey.replace(/^ed25519:/, '');

    const isValid = await ed.verifyAsync(
      Buffer.from(signature, 'hex'),
      new TextEncoder().encode(message),
      Buffer.from(pubKeyHex, 'hex')
    );

    return isValid;
  } catch (error) {
    console.warn('[IPFS] Signature verification failed:', error);
    return false;
  }
}

/**
 * Parse CID to extract metadata
 */
export function parseCID(cid: string): {
  version: 0 | 1;
  codec: string;
  hash: string;
} | null {
  if (!isValidCID(cid)) {
    return null;
  }

  if (cid.startsWith('Qm')) {
    return {

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Do not trust the fetched content: verify the signing key and CID source; a failed signature means the payload may be tampered with or the trusted key list is wrong.

When it happens

Trigger: Thrown at v3/@claude-flow/cli/src/transfer/ipfs/client.ts:345 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/ff08dad4cdf1a04f. Report an issue: GitHub.