ruvnet/ruflo · error · ReleaseVerificationError

SHA256SUMS.sig failed Ed25519 verification — refusing to ins

Error message

SHA256SUMS.sig failed Ed25519 verification — refusing to install

What it means

Error "SHA256SUMS.sig failed Ed25519 verification — refusing to install" thrown in ruvnet/ruflo.

Source

Thrown at v3/@claude-flow/cli/src/proxy/verify.ts:79

  sigBase64: string;
  assetBytes: Buffer;
  assetFilename: string;
  pubkeyPem?: string;
}

export interface VerifyReleaseResult {
  sha256: string;
}

/**
 * Full verification: signature over SHA256SUMS, then the asset's own hash
 * against the matching line. Throws `ReleaseVerificationError` on ANY
 * failure — there is no partial-trust outcome, matching ADR-307's "refuses
 * on any mismatch" requirement.
 */
export function verifyRelease(input: VerifyReleaseInput): VerifyReleaseResult {
  if (!verifySha256SumsSignature(input.sumsBytes, input.sigBase64, input.pubkeyPem)) {
    throw new ReleaseVerificationError('SHA256SUMS.sig failed Ed25519 verification — refusing to install');
  }

  const sums = parseSha256Sums(input.sumsBytes.toString('utf-8'));
  const expected = sums[input.assetFilename];
  if (!expected) {
    throw new ReleaseVerificationError(`SHA256SUMS has no entry for ${input.assetFilename}`);
  }

  const actual = sha256Hex(input.assetBytes);
  if (actual !== expected) {
    throw new ReleaseVerificationError(
      `sha256 mismatch for ${input.assetFilename}: expected ${expected.slice(0, 12)}…, got ${actual.slice(0, 12)}…`,
    );
  }

  return { sha256: actual };
}

View on GitHub (pinned to 6b01dc5a68)

When it happens

Trigger: Thrown at v3/@claude-flow/cli/src/proxy/verify.ts:79 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@6b01dc5a68 (2026-08-12). Data as JSON: /api/errors/e855d7bd4e59a8bd. Report an issue: GitHub.