fix: check for minisign before verification and show clear error #6

New issue

Open

opened 2026-05-17 12:08:09 +02:00 by michael · 0 comments

michael commented

2026-05-17 12:08:09 +02:00

Owner

Problem

sig.lua attempts to verify a signature but fails with a misleading error
when minisign is not installed:

[ERROR] sig: no key in keyring validated

The actual problem is that minisign is not installed, not that the key
is missing or invalid.

Fix

Check for minisign binary before attempting verification:

local rc, _ = io_:run_rc('command -v minisign')
if rc ~= 0 then
return nil, '[ERROR] sig: minisign not found'
.. ' -- install with: pkg_add minisign (OpenBSD)'
.. ' or: apt install minisign (Debian/Arch)'
end

Refs

DAW/merkwerk#30 (dependency detection)

## Problem sig.lua attempts to verify a signature but fails with a misleading error when minisign is not installed: [ERROR] sig: no key in keyring validated <path> The actual problem is that minisign is not installed, not that the key is missing or invalid. ## Fix Check for minisign binary before attempting verification: local rc, _ = io_:run_rc('command -v minisign') if rc ~= 0 then return nil, '[ERROR] sig: minisign not found' .. ' -- install with: pkg_add minisign (OpenBSD)' .. ' or: apt install minisign (Debian/Arch)' end ## Refs - DAW/merkwerk#30 (dependency detection)

michael added the

labels

2026-05-17 12:08:09 +02:00