GPG Signature Verification Failure in the VS Code Coder Extension

Last updated: June 25, 2026

Issue

After updating to VS Code Coder extension v1.10.0 or later, the extension fails to download or update the Coder CLI binary with a signature verification error. This prevents connecting to workspaces.

The error occurs because the GPG key used to sign Coder CLI releases expired. Starting with extension v1.10.0, the extension verifies the authenticity of the CLI binary using a bundled GPG public key. When that key expired, verification began failing for all users on affected versions.

Affected Versions:

  • VS Code Coder extension: v1.10.0 through v1.12.0
  • Fixed in: v1.12.1 (January 23, 2026)

Immediate Workaround

If you cannot update the extension right away, you can disable signature verification:

  1. Open VS Code Settings (Cmd + , on macOS or Ctrl + , on Windows/Linux).
  2. Search for coder.disableSignatureVerification.
  3. Check the box to enable the setting (set it to true).

This allows the CLI binary to download without GPG verification. Re-enable verification after updating the extension.
 

Solution

Update the VS Code Coder extension to v1.12.1 or later:

  1. Open VS Code.
  2. Go to the Extensions view (Cmd + Shift + X / Ctrl + Shift + X).
  3. Search for Coder.
  4. Click Update if an update is available.
  5. Reload VS Code when prompted.

If you previously set coder.disableSignatureVerification to true as a workaround, you can set it back to false after updating.
 

What Happened

The Coder VS Code extension verifies the GPG signature of the CLI binary every time it downloads a new version. This protects against tampered binaries. The verification uses a public key that is bundled inside the extension itself.

The GPG key used for signing had an expiration date that was reached. Two things needed to happen to fix this:

  1. The signing key's expiry was extended and the updated public key was bundled into the extension.
  2. A compatibility fix was applied to handle how the key renewal interacted with the OpenPGP.js library used for verification. Extending a GPG key's expiry creates a new internal signature on the key, which OpenPGP.js treated as a "reformatted key" and rejected. This is a known behavior in OpenPGP.js that differs from standard GPG tools.

Both fixes were included in extension version v1.12.1.