Signature verification failed with 'PackageIntegrityCheckFailed' error.

[pdpark]

Type: Bug

Ever since upgrading to the most recent release of vscode I cannot install or upgrade any vscode extensions.

Cannot install ... extension because Visual Studio Code cannot verify the extension signature

Signature verification failed with 'PackageIntegrityCheckFailed' error.

VS Code version: Code 1.94.0 (Universal) (d78a74bcdfad14d5d3b1b782f87255d802b57511, 2024-10-02T13:08:12.626Z) OS version: Darwin arm64 23.6.0 Modes:

System Info

|Item|Value| |---|---| |CPUs|Apple M1 Pro (10 x 2400)| |GPU Status|2d_canvas: enabled
canvas_oop_rasterization: enabled_on
direct_rendering_display_compositor: disabled_off_ok
gpu_compositing: enabled
multiple_raster_threads: enabled_on
opengl: enabled_on
rasterization: enabled
raw_draw: disabled_off_ok
skia_graphite: disabled_off
video_decode: enabled
video_encode: enabled
webgl: enabled
webgl2: enabled
webgpu: enabled
webnn: disabled_off| |Load (avg)|2, 2, 2| |Memory (System)|32.00GB (1.83GB free)| |Process Argv|--crash-reporter-id dfc65e10-fbb4-4b6c-919e-dce0edfa49eb| |Screen Reader|no| |VM|0%|

Extensions (23)

Extension|Author (truncated)|Version ---|---|--- unique-lines|bib|1.0.0 ruff|cha|2024.50.0 gitlens|eam|15.5.1 terraform|has|2.32.3 vscode-duplicate|mrm|1.2.1 vscode-docker|ms-|1.29.3 debugpy|ms-|2024.10.0 isort|ms-|2023.10.1 python|ms-|2024.14.1 vscode-pylance|ms-|2024.9.2 datawrangler|ms-|1.10.0 jupyter|ms-|2024.8.1 jupyter-renderers|ms-|1.0.19 vscode-jupyter-cell-tags|ms-|0.1.9 remote-ssh|ms-|0.114.3 remote-ssh-edit|ms-|0.87.0 remote-explorer|ms-|0.4.3 vscode-thunder-client|ran|2.27.0 vscode-xml|red|0.27.1 vscode-yaml|red|1.15.0 stardog-rdf-grammars|sta|0.2.1 even-better-toml|tam|0.19.2 gistfs|vsl|0.6.0

A/B Experiments

``` vsliv368:30146709 vspor879:30202332 vspor708:30202333 vspor363:30204092 vscod805:30301674 binariesv615:30325510 vsaa593:30376534 py29gd2263:31024239 c4g48928:30535728 azure-dev_surveyone:30548225 a9j8j154:30646983 962ge761:30959799 pythongtdpath:30769146 pythonnoceb:30805159 asynctok:30898717 pythonmypyd1:30879173 2e7ec940:31000449 pythontbext0:30879054 accentitlementsc:30995553 dsvsc016:30899300 dsvsc017:30899301 dsvsc018:30899302 cppperfnew:31000557 dsvsc020:30976470 pythonait:31006305 dsvsc021:30996838 bdiig495:31013172 a69g1124:31058053 dvdeprecation:31068756 dwnewjupytercf:31046870 2f103344:31071589 impr_priority:31102340 nativerepl1:31139838 refactort:31108082 pythonrstrctxt:31112756 flighttreat:31134774 wkspc-onlycs-t:31132770 nativeloc2:31134642 wkspc-ranged-t:31151552 cf971741:31144450 defaultse:31146405 iacca2:31150323 notype1:31151523 cc771715:31146322 ```

[sandy081]

• Are you seeing this error for all extensions or specific extensions?
• Can you please enable log level to trace (F1 > Developer: Set Log Level... > Trace) and reproduce the issue and share with us following log - F1 > Open View... > Shared

CC @isidorn

[pdpark]

• It is happening with all extensions. Started after installing the September update.
• Here's what I can share from the trace for now - will share the rest if needed/approved:

  2024-10-09 19:06:28.809 [info] Extension signature verification result for ms-python.python: PackageIntegrityCheckFailed. Executed: true. Duration: 240ms.
  2024-10-09 19:06:28.809 [trace] Extension signature verification output for ms-python.python:
  Package file size:  10570071
  Signature archive file size:  119770
  Manifest file size:  486193
  Signature file size:  19230
  Manifest file hash:  CdPiqhl5ahk57W3WOKcac5245LyJvHXI8MB7hGdYG/4=
  Signature file hash:  shC5tAmkkyNxA2KADbhjX5VEMqaiMejTJptzbP6HkIs=
  Package file hash:  CH90EsBQko8Wvpq5yAuarkad4fvroPfj9mstl9qS7/M=
  ManifestPackageIntegrityPolicy failed:  unexpected package size.
  Exit code:  PackageIntegrityCheckFailed

[sandy081]

@dtivel Can you please check what is going wrong here?

[pdpark]

Full trace log attached: vscode_ext_install_trace.log

BTW: a colleague is seeing the same thing in his trace log - Exit code: PackageIntegrityCheckFailed - when he installs an extension, but his install succeeds.

[dtivel]

@sandy081, this is the important clue:

ManifestPackageIntegrityPolicy failed:  unexpected package size.

The signature and manifest files look to be correct for the desired version. However, the VSIX file size is unexpected. Any idea why?

From the log, I see Microsoft.VisualStudio.Code.Manifest and Microsoft.VisualStudio.Services.VsixSignature assets being downloaded, but I don't see Microsoft.VisualStudio.Services.VSIXPackage assets being downloaded. Is there a stale VSIX package on disk? A partially downloaded package on disk?

[sandy081]

but I don't see Microsoft.VisualStudio.Services.VSIXPackage assets being downloaded. Is there a stale VSIX package on disk? A partially downloaded package on disk?

Let me ask the user

@pdpark Can you please open following folder and let us know what files you have there

• F1 > Developer: Open User Data Folder > CachedExtensionVSIXs

[pdpark]

There were a number of files, like this one:

I moved all the files in the cache folder to the trash and tried the installs again. They failed with the same error, and there are now new files in the cache folder.

BTW: I also tried downloading the VSIX files for a few extensions and installing those with the extensions menu option: "Install from VSIX...". These attempts also failed with the same message.

[pdpark]

I have confirmed two vscode users get this error in their trace log but the install succeeds. One is is on the same version I am, the other is on 1.93.

In both cases, when they open their settings.json file, they have no settings.

I have this in the left pane when viewing my settings.json file:

  // When enabled, extensions are verified to be signed before getting installed.
  "extensions.verifySignature": true,

If the default for this setting is true, why would the extension install succeed for them even though the trace shows the signature validation failed?

[pdpark]

I'm not the only developer impacted by this at our company. Any suggestions for moving forward other than just setting "extensions.verifySignature": false?

[pdpark]

FYI: a developer not having this issue does not even see extensions.verifySignature as an option in the left pane when viewing his settings.json file after setting:

"workbench.settings.useSplitJSON": true,
"workbench.settings.editor": "json",