Signature verification failed with 'PackageIntegrityCheckFailed' error.

[pdpark]

Type: Bug

Ever since upgrading to the most recent release of vscode I cannot install or upgrade any vscode extensions.

Cannot install ... extension because Visual Studio Code cannot verify the extension signature

Signature verification failed with 'PackageIntegrityCheckFailed' error.

VS Code version: Code 1.94.0 (Universal) (d78a74b, 2024-10-02T13:08:12.626Z)
OS version: Darwin arm64 23.6.0
Modes:

System Info

Item	Value
CPUs	Apple M1 Pro (10 x 2400)
GPU Status	2d_canvas: enabled canvas_oop_rasterization: enabled_on direct_rendering_display_compositor: disabled_off_ok gpu_compositing: enabled multiple_raster_threads: enabled_on opengl: enabled_on rasterization: enabled raw_draw: disabled_off_ok skia_graphite: disabled_off video_decode: enabled video_encode: enabled webgl: enabled webgl2: enabled webgpu: enabled webnn: disabled_off
Load (avg)	2, 2, 2
Memory (System)	32.00GB (1.83GB free)
Process Argv	--crash-reporter-id dfc65e10-fbb4-4b6c-919e-dce0edfa49eb
Screen Reader	no
VM	0%

Extensions (23)

Extension	Author (truncated)	Version
unique-lines	bib	1.0.0
ruff	cha	2024.50.0
gitlens	eam	15.5.1
terraform	has	2.32.3
vscode-duplicate	mrm	1.2.1
vscode-docker	ms-	1.29.3
debugpy	ms-	2024.10.0
isort	ms-	2023.10.1
python	ms-	2024.14.1
vscode-pylance	ms-	2024.9.2
datawrangler	ms-	1.10.0
jupyter	ms-	2024.8.1
jupyter-renderers	ms-	1.0.19
vscode-jupyter-cell-tags	ms-	0.1.9
remote-ssh	ms-	0.114.3
remote-ssh-edit	ms-	0.87.0
remote-explorer	ms-	0.4.3
vscode-thunder-client	ran	2.27.0
vscode-xml	red	0.27.1
vscode-yaml	red	1.15.0
stardog-rdf-grammars	sta	0.2.1
even-better-toml	tam	0.19.2
gistfs	vsl	0.6.0

A/B Experiments

vsliv368:30146709
vspor879:30202332
vspor708:30202333
vspor363:30204092
vscod805:30301674
binariesv615:30325510
vsaa593:30376534
py29gd2263:31024239
c4g48928:30535728
azure-dev_surveyone:30548225
a9j8j154:30646983
962ge761:30959799
pythongtdpath:30769146
pythonnoceb:30805159
asynctok:30898717
pythonmypyd1:30879173
2e7ec940:31000449
pythontbext0:30879054
accentitlementsc:30995553
dsvsc016:30899300
dsvsc017:30899301
dsvsc018:30899302
cppperfnew:31000557
dsvsc020:30976470
pythonait:31006305
dsvsc021:30996838
bdiig495:31013172
a69g1124:31058053
dvdeprecation:31068756
dwnewjupytercf:31046870
2f103344:31071589
impr_priority:31102340
nativerepl1:31139838
refactort:31108082
pythonrstrctxt:31112756
flighttreat:31134774
wkspc-onlycs-t:31132770
nativeloc2:31134642
wkspc-ranged-t:31151552
cf971741:31144450
defaultse:31146405
iacca2:31150323
notype1:31151523
cc771715:31146322

[sandy081]

• Are you seeing this error for all extensions or specific extensions?
• Can you please enable log level to trace (F1 > Developer: Set Log Level... > Trace) and reproduce the issue and share with us following log - F1 > Open View... > Shared

CC @isidorn

[pdpark]

• It is happening with all extensions. Started after installing the September update.
• Here's what I can share from the trace for now - will share the rest if needed/approved:

2024-10-09 19:06:28.809 [info] Extension signature verification result for ms-python.python: PackageIntegrityCheckFailed. Executed: true. Duration: 240ms.
2024-10-09 19:06:28.809 [trace] Extension signature verification output for ms-python.python:
Package file size:  10570071
Signature archive file size:  119770
Manifest file size:  486193
Signature file size:  19230
Manifest file hash:  CdPiqhl5ahk57W3WOKcac5245LyJvHXI8MB7hGdYG/4=
Signature file hash:  shC5tAmkkyNxA2KADbhjX5VEMqaiMejTJptzbP6HkIs=
Package file hash:  CH90EsBQko8Wvpq5yAuarkad4fvroPfj9mstl9qS7/M=
ManifestPackageIntegrityPolicy failed:  unexpected package size.
Exit code:  PackageIntegrityCheckFailed

[sandy081]

@dtivel Can you please check what is going wrong here?

[pdpark]

Full trace log attached: vscode_ext_install_trace.log

BTW: a colleague is seeing the same thing in his trace log - Exit code: PackageIntegrityCheckFailed - when he installs an extension, but his install succeeds.

[dtivel]

@sandy081, this is the important clue:

ManifestPackageIntegrityPolicy failed:  unexpected package size.

The signature and manifest files look to be correct for the desired version. However, the VSIX file size is unexpected. Any idea why?

From the log, I see Microsoft.VisualStudio.Code.Manifest and Microsoft.VisualStudio.Services.VsixSignature assets being downloaded, but I don't see Microsoft.VisualStudio.Services.VSIXPackage assets being downloaded. Is there a stale VSIX package on disk? A partially downloaded package on disk?

[sandy081]

but I don't see Microsoft.VisualStudio.Services.VSIXPackage assets being downloaded. Is there a stale VSIX package on disk? A partially downloaded package on disk?

Let me ask the user

@pdpark Can you please open following folder and let us know what files you have there

• F1 > Developer: Open User Data Folder > CachedExtensionVSIXs

[pdpark]

There were a number of files, like this one:

I moved all the files in the cache folder to the trash and tried the installs again. They failed with the same error, and there are now new files in the cache folder.

BTW: I also tried downloading the VSIX files for a few extensions and installing those with the extensions menu option: "Install from VSIX...". These attempts also failed with the same message.

[pdpark]

I have confirmed two vscode users get this error in their trace log but the install succeeds. One is is on the same version I am, the other is on 1.93.

In both cases, when they open their settings.json file, they have no settings.

I have this in the left pane when viewing my settings.json file:

  // When enabled, extensions are verified to be signed before getting installed.
  "extensions.verifySignature": true,

If the default for this setting is true, why would the extension install succeed for them even though the trace shows the signature validation failed?

[pdpark]

I'm not the only developer impacted by this at our company. Any suggestions for moving forward other than just setting "extensions.verifySignature": false?

[pdpark]

FYI: a developer not having this issue does not even see extensions.verifySignature as an option in the left pane when viewing his settings.json file after setting:

"workbench.settings.useSplitJSON": true,
"workbench.settings.editor": "json",

[sandy081]

I also tried downloading the VSIX files for a few extensions and installing those with the extensions menu option: "Install from VSIX...". These attempts also failed with the same message.

Can you please share those VSIXs with us?

[geethavaleti]

Still happening to me, Can't update copilot, many extensions. Is this issue fixed?

[pdpark]

I also tried downloading the VSIX files for a few extensions and installing those with the extensions menu option: "Install from VSIX...". These attempts also failed with the same message.

Can you please share those VSIXs with us?

They should be the same as you would get if you download them yourself, but I've attached the files to this comment. I had to change the file extensions to .txt - github would not allow the selection of .vsix files for upload.

GitHub.copilot-1.238.0.txt
ms-python.python-2024.17.2024101101@darwin-arm64.txt
ms-python.vscode-pylance-2024.10.100.txt

[sandy081]

They should be the same as you would get if you download them yourself,

I believe they are not as they seem to be verified properly for me. Thanks for the zips.

[pdpark]

They should be the same as you would get if you download them yourself,

I believe they are not as they seem to be verified properly for me. Thanks for the zips.

I'm not sure why you believe that they are not the same files you would have gotten had you downloaded them when I did. They could be identical to the files you would have downloaded at the time and the signature verification could still fail for me and succeed for you if the problem is somewhere in the signature verification process and occurs only under specific circumstances which happen to differ between us.

[juantarquino-ssb]

Same thing is happening to our team with the recent update. The error seems to be due to a different package size. Trace below:

2024-11-07 10:08:12.217 [trace] Verifying extension signature for github.copilot...
2024-11-07 10:08:12.471 [info] Extension signature verification result for github.copilot-chat: PackageIntegrityCheckFailed. Executed: true. Duration: 365ms.
2024-11-07 10:08:12.471 [trace] Extension signature verification output for github.copilot-chat:
Package file size:  5189517
Signature archive file size:  14209
Manifest file size:  9149
Signature file size:  19226
Manifest file hash:  N/XgOx08PlR6Q4ZSqGonNx3Cc7jwNbWjYECl+lDO0sU=
Signature file hash:  eS+cJ9p35E4mX2+oIdlBOjueVBc3p7akCLC4r3H2yA0=
Package file hash:  x4Tyzd8pggHzUsCIygHjKQWfkkIknSPpH4lnf2v/rfY=
ManifestPackageIntegrityPolicy failed:  unexpected package size.
Exit code:  PackageIntegrityCheckFailed

[sandy081]

@juantarquino-ssb Does this happens with all extensions or only with copilot chat extension?

[juantarquino-ssb]

@juantarquino-ssb Does this happens with all extensions or only with copilot chat extension?

It happens with all of the extensions, not just the copilot chat extension.

[sandy081]

@juantarquino-ssb Can you please try our insiders and let us know if you are able to reproduce the same?

[dtivel]

I see from the original post that this reproed on macOS. Is anyone experiencing the same issue on Linux or Windows?

[jordanjohnson56]

I am experiencing the same issue on Windows 10 trying to install any extensions. I am on 64-bit VS Code version 1.95.3.

2024-12-02 11:08:55.050 [info] Extension signature verification result for ms-toolsai.jupyter: PackageIntegrityCheckFailed. Executed: true. Duration: 108ms.
2024-12-02 11:08:55.050 [trace] Extension signature verification output for ms-toolsai.jupyter:
Package file size:  7151890
Signature archive file size:  19837
Manifest file size:  26414
Signature file size:  19225
Manifest file hash:  o4sdIPr87N1D5L8QiA8+E1/7Qe5DganJUJ6UEEmJUaE=
Signature file hash:  LW5izGfuWuseBdkXWvXRXCJYLrkqpkiiQ979vMk8x/8=
Package file hash:  Q9ahcHNv41jNI/6BjKdWbtnXwSg68RGp9QYUDq7Kuok=
ManifestPackageIntegrityPolicy failed:  unexpected package size.
Exit code:  PackageIntegrityCheckFailed

[chucknelson]

Same issue on MacOS with all extension updates - noticed a few weeks ago when none of the extensions were auto-updating as expected.

Version info:

Version: 1.95.3 (Universal)
Commit: f1a4fb101478ce6ec82fe9627c43efbf9e98c813
Date: 2024-11-13T14:50:04.152Z (2 wks ago)
Electron: 32.2.1
ElectronBuildId: 10427718
Chromium: 128.0.6613.186
Node.js: 20.18.0
V8: 12.8.374.38-electron.0
OS: Darwin arm64 23.6.0

[sandy081]

Can you please try our insiders and let me know if you are seeing the issue?

[juantarquino-ssb]

The insider's version results in the same issue for me (PackageIntegrityCheckFailed).

[sandy081]

@juantarquino-ssb Can you please share the VSIX of the extension that is causing PackageIntegrityCheckFailed error. You can get the VSIX from following location

• Run command F1 > Developer: Open User Data Folder
• Navigate to CachedExtensionVSIXs/.trash/ folder
• Share the VSIX from there

[juantarquino-ssb]

github.copilot-1.246.0.zip

Here is the GitHub copilot VSIX from that CachedExtensionVSIXs/.trash/ folder. Please note that the PackageIntegrityCheckFailed issue happens with all extensions, not just GitHub copilot, I just used this one as an example.

[sandy081]

Can you also please share the file github.copilot-1.246.0.sigzip from that folder?

[juantarquino-ssb]

github.copilot-1.246.0.sigzip

That is interesting, I do not see a "github.copilot-1.246.0.sigzip" in that folder. Is there a way to check if VS Code was able to download that github.copilot-1.246.0.sigzip file?

[sandy081]

Probably it would have got deleted on VS Code Insiders restart. Can you please try installing the extension again and check the folder?

[sprowell]

Having this problem as well, but only on macOS. Tried removing the software, removing ~/.vscode and other folders, making sure macOS is up to date (15.1.1 (24B91)), rebooting, downloading a fresh copy of the Insider's Edition (downloaded 9 December 2024), and installing. Attempted to install the C/C++ extension... and same problem.

Edit. Repeated this process and determined that extensions install correctly on 1.93, but not on 1.94. I've checked this on two macs (one Apple Silicon and one Intel, both running 15.1.1) with the same results. Unsurprisingly, if I let Code update itself, extensions can no longer be installed. Set updates to manual, performed settings sync, and everything is working. Will stay on 1.93 until the issue is fixed. If it is helpful for me to test out other versions, let me know.

[sandy081]

If you are able to reproduce the problem with VS Code Insiders Edition, can you please share following data

• Try to install an extension that fails with the reported error
• Run command F1 > Developer: Open User Data Folder
• Navigate to CachedExtensionVSIXs/.trash/ folder
• Share the VSIX and .sigzip files of the corresponding extension

[sprowell]

If you are able to reproduce the problem with VS Code Insiders Edition, can you please share following data

* Try to install an extension that fails with the reported error 
* Run command `F1 > Developer: Open User Data Folder`
* Navigate to `CachedExtensionVSIXs/.trash/` folder
* Share the VSIX and .sigzip files of the corresponding extension

Installed Insiders Edition (downloaded today, 9 December 2024, 1.96.0-insider, commit 475a...6b0e). Tried to install Vim extension (vscodevim.vim, 1.29.0). Failed with the same error ("Signature verification failed with 'PackageIntegrityCheckFailed' error.").

Here are the files from .trash: vscodevim.vim-1.29.0.zip