Extension installation fails to verify signature on REMOTE release

[jlynchMicron]

Does this issue occur when all extensions are disabled?: No

• VS Code Version: 1.75.0
• OS Version: CentOS Version 7

Steps to Reproduce:

1. Open up new VScode remote session.
2. Try to update any extension.

Tagging maintainer per request: @dtivel

Important note: Using identical corporate proxy settings for both environments, which worked before latest VScode update 1.75.

Windows 11 Host (extensions install fine):

Linux Remote SSH Session (extensions not installing, note the python extension):

[cuzox]

Facing same issue

[eleanorjboyd]

Hello! We are seeing a few people facing this issue. The error message is Signature Untrusted. We will keep this issue as the main issue to track the progress here.

Currently, the workaround seems to be to downgrading vscode. As seen from user @inh3 Same issue. Downgraded VSCode to 1.74.3 to restore functionality. in #173215.

The issue is also reported on the remote-release extension here: #173215

[dtivel]

Does the file at /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem contain certificates?

[jlynchMicron]

Does the file at /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem contain certificates?

Yes, it appears to have my organizations certificate in it based on the comment.

[dtivel]

It probably does not have this root certificate. Can you confirm?

-----BEGIN CERTIFICATE-----
MIIFkDCCA3igAwIBAgIQBZsbV56OITLiOQe9p3d1XDANBgkqhkiG9w0BAQwFADBi
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg
RzQwHhcNMTMwODAxMTIwMDAwWhcNMzgwMTE1MTIwMDAwWjBiMQswCQYDVQQGEwJV
UzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQu
Y29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwggIiMA0GCSqG
SIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAiMGkz7MKnJS7JIT3y
ithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnnyyhHS5F/WBTxSD1If
xp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE5nQ7bXHiLQwb7iDV
ySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm7nfISKhmV1efVFiO
DCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5w3jHtrHEtWoYOAMQ
jdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsDdV14Ztk6MUSaM0C/
CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1ZXUJ2h4mXaXpI8OCi
EhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS00mFt6zPZxd9LBADM
fRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hkpjPRiQfhvbfmQ6QY
uKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m800ERElvlEFDrMcXK
chYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+isX4KJpn15GkvmB0t
9dmpsh3lGwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB
hjAdBgNVHQ4EFgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wDQYJKoZIhvcNAQEMBQAD
ggIBALth2X2pbL4XxJEbw6GiAI3jZGgPVs93rnD5/ZpKmbnJeFwMDF/k5hQpVgs2
SV1EY+CtnJYYZhsjDT156W1r1lT40jzBQ0CuHVD1UvyQO7uYmWlrx8GnqGikJ9yd
+SeuMIW59mdNOj6PWTkiU0TryF0Dyu1Qen1iIQqAyHNm0aAFYF/opbSnr6j3bTWc
fFqK1qI4mfN4i/RN0iAL3gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa
sjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N
cCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N
0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie
4u1Ki7wb/UdKDd9nZn6yW0HQO+T0O/QEY+nvwlQAUaCKKsnOeMzV6ocEGLPOr0mI
r/OSmbaz5mEP0oUA51Aa5BuVnRmhuZyxm7EAHu/QD09CbMkKvO5D+jpxpchNJqU1
/YldvIViHTLSoCtU7ZpXwdv6EM8Zt4tKG48BtieVU+i2iW1bvGjUI+iLUaJW+fCm
gKDWHrO8Dw9TdSmq6hN35N6MgSGtBxBHEa2HPQfRdbzP82Z+
-----END CERTIFICATE-----

[jlynchMicron]

It looks like it does not have that one:

[dtivel]

The code signing certificate that VS Marketplace uses to repository sign extensions chains to this root, so trusting this root will resolve the Untrusted error you're seeing.

To verify extensions signed with this certificate, VS Code requires a certificate trust store that is valid for code signing.

Linux doesn't reliably have this, so VS Code defaults to using its own built-in trust store. This built-in trust store is effectively a snapshot of the Windows trust store that is valid for code signing and contains this root certificate.

For the Linux distributions (like Red Hat and CentOS) that do have this established system (root-owned) code signing trust store, we want to respect it. The intent here is to reuse a system-managed trust store if we can.

/etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem

I see a few options:

• Add the root certificate to your PEM file. This is a system-wide change, so you should be comfortable with the change.
• Set the extensions.verifySignature option to false in the right setting file (remote, in your case). This should be considered a short-term workaround, and the option may disappear in the future.
• Downgrade to 1.74.3.

For now, I'd choose the 2nd option.

CC @isidorn

[jlynchMicron]

@dtivel, thank you for looking into this! Yeah I don't think my organization would let us tamper with the system root certificate.

I can go with option 2 for now, but if that option disappears in the future, I'm not sure what options we will have down the road.

[jlynchMicron]

• Set the extensions.verifySignature option to false in the right setting file (remote, in your case). This should be considered a short-term workaround, and the option may disappear in the future.

Do I have to do anything to enable it? It does not look like VScode is recognizing it as a "real" setting:

[dtivel]

It looks correct. Make sure you put it in your remote settings if you're having problems on the remote side. You can leave local settings as-is (enabled).