ruvnet/ruflo · error

[PluginDiscovery] Registry signature verification failed for

Error message

[PluginDiscovery] Registry signature verification failed for ${registry.name} (CID ${cid}); falling back to demo registry.

What it means

Log warning in discoverRegistry: signature verification of the fetched plugin registry (by CID) failed, and the code fails closed — instead of using an unverified registry (attacker-swappable via a compromised gateway), it falls back to the demo registry.

Source

Thrown at v3/@claude-flow/cli/src/plugins/store/discovery.ts:189

        }
        console.log(`[PluginDiscovery] Resolved IPNS to CID: ${cid}`);
      }

      // Fetch registry from IPFS
      const registryData = await fetchFromIPFS<PluginRegistry>(cid, registry.gateway);
      if (!registryData) {
        return this.createDemoRegistryAsync(registry);
      }

      // Verify registry signature when required.
      // Fail closed on missing/invalid signature — silently warning and using
      // an unverified registry would let a compromised IPFS gateway (or any
      // on-path attacker) swap in attacker-mapped plugin entries that the
      // installer would then load unsandboxed.
      if (this.config.requireVerification) {
        const verified = await this.verifyRegistrySignature(registryData, registry.publicKey);
        if (!verified) {
          console.warn(
            `[PluginDiscovery] Registry signature verification failed for ` +
              `${registry.name} (CID ${cid}); falling back to demo registry.`,
          );
          return this.createDemoRegistryAsync(registry);
        }
      }

      // Cache the result
      this.cache.set(registry.ipnsName, {
        registry: registryData,
        timestamp: Date.now(),
      });

      return {
        success: true,
        registry: registryData,
        cid,
        source: registry.name,

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Verify the registry signing key and CID source; the demo registry is used as fallback and should not be trusted for real installs.

When it happens

Trigger: Thrown at v3/@claude-flow/cli/src/plugins/store/discovery.ts:189 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/f20aa19931813fc9. Report an issue: GitHub.