InvalidSignatureException
Tealk opened this issue Β· 41 comments
I get the following message since updating from v25.0.0rc5 to v25.0.0:
NC: 25.0.0
Related Resources 1.0.1
Technical information
=====================
The following list covers which files have failed the integrity check. Please read
the previous linked documentation to learn more about the errors and how to fix
them.
Results
=======
- related_resources
- EXCEPTION
- OC\IntegrityCheck\Exceptions\InvalidSignatureException
- Signature data not found.
Raw output
==========
Array
(
[related_resources] => Array
(
[EXCEPTION] => Array
(
[class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
[message] => Signature data not found.
)
)
)
Exact same problem on my site
Exactly the same for me
Exception comes with the fact that the RelatedResources app was updated after the release of NC25.0.0, which include v1.0.0 of the app.
Thanks, is there a way to solve the prob?
Just the same problem. Arround one week ago I switched to beta channel to upgrade NC from 24.x (stable) to 25.0.0-RC3 and switched back to stable right afterward. And today, after 25.0.0 stable was released, I 'upgraded' to this and get the InvalidSignatureExeption too.
using the browser and open example.com/index.php/settings/integrity/failed it shows at first only the error from the 'related_resources' app. But when using occ integrity:check-app <appname> there are several apps failing with 'Signature not found', Seems to be apps which had been updated durinng the short week I tried the RC3 from beta channel. e.g. mail, bookmarks, calendar, groupfolders.
And after these occ-checks, all tested and failed apps are shown on the /index.php/settings/integrity/failed page
So at the moment I think that the error is not necessarily caused by this plugin.
It IS caused by this app, since CLOUD/apps/related_resources doesn't contain a file signature.json β which is to be expected and pbviously was forgotten to include upon release.
+1
It seems the behavior of the server integrity check has changed. On 24 the same apps that now throw an error pass the check.
Same problem
Same issue after upgrading to Nextcloud 25 Stable channel.
$ ./occ integrity:check-app related_resources
- EXCEPTION:
- class: OC\IntegrityCheck\Exceptions\InvalidSignatureException
- message: Signature data not found.
$
+1
Just the same problem. Arround one week ago I switched to beta channel to upgrade NC from 24.x (stable) to 25.0.0-RC3 and switched back to stable right afterward. And today, after 25.0.0 stable was released, I 'upgraded' to this and get the InvalidSignatureExeption too.
Similar here. Interestingly I only have the error message in administration overview for one instance where I upgraded latest 24 to 25.0.0-RC3, then 25.0.0-RC5 and then 25.0.0. I do not have the error message in another instance that I updated directly from 24 to 25.0.0. Both now are set to stable channel which should enable the signature checking. And in both cases the app for not have the signature json file.
Same issue after upgrading to Nextcloud 25 Stable channel.
Alright, everyone who's affected: please add your π to the report #106 (comment) and refrain from commenting unless you have valuable debugging information. Thank you.
Why not disable the app Related Resources or does it add anything valuable to Nextcloud? π§
Why not disable the app Related Resources or does it add anything valuable to Nextcloud? π§
So I could, but that doesn't solve the error.
So I could, but that doesn't solve the error.
Seems so. I wonder why it still detects the app even though it's disabled.
Also deleting and re-downloading the app does not help. :/
The InvalidSignatureException is a notice that the files stored within your Nextcloud setup are not the exact same one than expected. The reason for this is that NC25.0.0 comes with RelatedResource v1.0.0 but because your app have upgraded to v1.0.1, the content within the folder of the apps have been modified during the upgrade.
It won't affect your Nextcloud, won't affect the behavior of the RelatedResource app. You just a simple notice.
Of course, we are investigating the issue but because it is benign we prioritize more urgent problems.
Also, and as said before, please fill this thread only to provide more details about the issue itself; there is others place on the internet to spread your harsh comments.
Can Nextcloud work without RelatedResource, what is the purpose of it?
Can Nextcloud work without
RelatedResource, what is the purpose of it?
check the README of the repository. It's not hard.
Thx for the kind advice, seems another useless dependency according to the README.md
The
InvalidSignatureExceptionis a notice that the files stored within your Nextcloud setup are not the exact same one than expected. The reason for this is that NC25.0.0 comes with RelatedResource v1.0.0 but because your app have upgraded to v1.0.1, the content within the folder of the apps have been modified during the upgrade.It won't affect your Nextcloud, won't affect the behavior of the RelatedResource app. You just a simple notice.
Of course, we are investigating the issue but because it is benign we prioritize more urgent problems.
Also, and as said before, please fill this thread only to provide more details about the issue itself; there is others place on the internet to spread your harsh comments.
What is the point of code signing if we start telling users to disregard integrity warnings right from the start? I understand this is not a critical bug, but it is also the only default Nextcloud app that has ever triggered this warning for me, as seems to be the case for others. It's a heavy burden to bear and it should not be so easily dismissed.
What is the point of code signing if we start telling users to disregard integrity warnings right from the start? I understand this is not a critical bug, but it is also the only default Nextcloud app that has ever triggered this warning for me, as seems to be the case for others. It's a heavy burden to bear and it should not be so easily dismissed.
Well played; twisting my answer about a notice that does not affect the normal operation of your Nextcloud to justify the aggressiveness/insults of some on a bug report...
Please keep it civilized and use other social networks for your hate.
+1
Woof, if anything I only see spam, no hate.
It really gives me StackOverflow vibes to have valid thoughts be labeled as insults.
Reading this issue from the sideline gives me an uncomfortable feeling.
I and others value open source maintenance a lot!
Thank you for your work @ArtificialOwl.
Hi, as all here I have the same problem...
What is a little puzzling for me: I find related_resources 1.0.0 in /var/www/html/apps and the updated version 1.0.1 in /var/www/html/custom_apps.
Is this correct?
Trying to keep discussion on-topic but I know this is also not useful debugging information, but are we able to downgrade the app to the 1.0.0 version?
We can grab the zip file of the nextcloud software from the site, but I'm not sure if we replace it in the custom_apps folder, or just delete the custom apps version? or something else entirely.
If possible, I'd prefer to leave it at 1.0.0 for now and not have a red error message, and leave it like that until this can be resolved via official means.
fixed in 1.0.2
fixed in 1.0.2
I've upgraded the app to 1.0.2 on NC 25.0.0 and I still have the same issue (nothing appears in the right panel in Nextcloud Files) and I still got this errors (from Overview section) :
Il also still get a "Error getting related resources" warning in the upper right corner while opening the right panel of a file in Nextcloud Files (trying to fetch related resources) :
Signature check is fine on my instances with 1.0.2 using web (no error, or /settings/integrity/failed) and CLI occ integrity:check-app related_resources. I also get shown the related ressources:
fixed in 1.0.2
I've upgraded the app to 1.0.2 on NC 25.0.0 and I still have the same issue (nothing appears in the right panel in Nextcloud Files) and I still got this errors (from Overview section) : Il also still get a "Error getting related resources" warning in the upper right corner while opening the right panel of a file in Nextcloud Files (trying to fetch related resources) :
Have you run a 'Rescan' from the Admin Settings / Overview page ?
Is appinfo/signature.json present in the apps/related_resources folder ?
About the other issue, please create a new ticket with logs and details
fixed in 1.0.2
I've upgraded the app to 1.0.2 on NC 25.0.0 and I still have the same issue (nothing appears in the right panel in Nextcloud Files) and I still got this errors (from Overview section) : Il also still get a "Error getting related resources" warning in the upper right corner while opening the right panel of a file in Nextcloud Files (trying to fetch related resources) :
Have you run a 'Rescan' from the Admin Settings / Overview page ? Is
appinfo/signature.jsonpresent in theapps/related_resourcesfolder ?About the other issue, please create a new ticket with logs and details
@ArtificialOwl the signature.json file exists in the mentioned folder (and I ran the scan).
@Jerome-Herbinet I did some test on a fresh install of NC25 with custom_apps, but I could not reproduce your issue.
Can you try with a fresh install of the app:
./occ app:disable related_resources- remove the app from your apps (or custom_apps if available)
./occ app:enable related_resources./occ integrity:check-app related_resources
If you still have issues, can you create a new ticket specifying you are using 1.0.2 ?
In this ticket, can you describe your setup if anything is not basic ?
after upgrading to 1.0.2 and an additional occ integrity:check-app related_resources (!!!) the app is not longer in the list of apps which failed sinature check. But of course the red warning in admin/overview remains because of the other apps with same problem (mail, bookmarks, calendar, groupfolders). Maybe that is the problem of @Jerome-Herbinet
Thank you, @ArtificialOwl for your support!
I have the same problem, but in addition, I cannot update the apps.
Technical information
The following list covers which files have failed the integrity check. Please read
the previous linked documentation to learn more about the errors and how to fix
them.Results
- related_resources
- EXCEPTION
- OC\IntegrityCheck\Exceptions\InvalidSignatureException
- Signature data not found.
Raw output
==========
Array
(
[related_resources] => Array
(
[EXCEPTION] => Array
(
[class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
[message] => Signature data not found.
)
)
)
I also have a problem in the app manager, impossible to click because the button is disabled.
I also have a problem with the app password, I don't see any passwords via the browser, on the other hand in the extensions, they have there.
Version Nextcloud 25
Version Docker 5:20.10.20
Version Debian Linux 5.18.0-0.deb11.4-amd64
Version OMV 6.0.45-1
I don't think it can cause any problems, but I will clarify.
I am using Ngnix as a proxy, version 2.9.18
I also use adguardhome on my network, version v0.107.16
I also have a problem in the app manager, impossible to click because the button is disabled.
even pressing 'Enter' does not validate the password ? (I had that issue during RC release and I though it was fixed)
I also have a problem in the app manager, impossible to click because the button is disabled.
even pressing 'Enter' does not validate the password ? (I had that issue during RC release and I though it was fixed)
I've seen something similar, the button stays disabled, but yes, enter works in my case. Took me a while to figure out I could work it around with enter.
Hi,
I'm still pretty new to the whole NextCloud thingy so please excuse if this may not be as relevant as it was for me or be the wrong place to post this at all but.
I also had the error "Error getting related resources" message ant could not recover it as suggested by @ArtificalOwl earlier.
But with that information provided I was able to trac the error down. In the logs there was the following Error pointing out that the Circles Manager somewhere returned null.
[no app in context] Fehler: Exception: OCA\Circles\CirclesManager::getCurrentFederatedUser(): Return value must be of type OCA\Circles\IFederatedUser, null returned in file '/var/www/nextcloud/apps/circles/lib/CirclesManager.php' line 253 at <>
So, I disabled the app over /occ and removed the folder βcirclesβ from apps. Then I checked the web interface for recommendations. Here there was some surprise as the web interface was telling me that the app Circles is no longer official supported since version 21. As I started my journey with 24.0.5 a couple of days back, I wonder why this app was available at all. I did not install it on purpose.
The error message dose no longer shows up. But I wonder if there is any need or use of the Circles (over its intended purpose) app, and it should be installed?
What is the point of code signing
That indeed is to be looked at carefully. In Nextcloud, admins can install any app, whether signed or not, probably even wrongly signed apps will be installed. So no, at least to my knowledge and unlike Windows installer executables or macOS security settings, Nextcloud does not provide admins with means to harden their instance by only allowing signed apps, or even officially signed apps (by Nextcloud), or by app authors of the admin's choice. Please be aware of that.
if we start telling users to disregard integrity warnings
That IS a very valid point. However, I expect even hobbyist admins to have SOME wits about what software they run and that one should not install anything downloaded from arbitrary places. The app store requires app authors to sign their apps. So, yes, this should apply to Nextcloud internal apps, too, and should be made sure by Nextcloud.
twisting my answer about a notice that does not affect the normal operation
While this statement holds true from a pure IT operations POV, it does not take into account the valid point given above, and IT security operations would disagree for that reason.
https://docs.nextcloud.com/server/latest/admin_manual/issues/code_signing.html#code-signing
Probably, further discussion on app signing should either be in nextcloud/server or even on help.nextcloud.com.