Unable to install extension if it is platform specific

[cboitel]

Discovered while trying to install hashicorp.terraform extension:

• installs correctly on local host, or on remote ssh
• if inside a devcontainer, ends up with a signature verification issue

While digging, I found out that:

• platform isn't detected inside devcontainer
• this leads to vscode being unable to download platform specific version
• since Hashicorp left an old version of the extension (non-platform specific), vscode fallbacks to that old version which is unsigned and leads to the signature verification error

• VSCode Version: latest 1.103.1
• Local OS Version: MacOS and Linux
• Remote OS Version: Ubuntu 24.04 (docker.io)
• Remote Extension/Connection Type: Dev Containers on Remote SSH
• Logs: HashicorpTerraformVSCodeExtension.log.pdf

Steps to Reproduce:

1. Setup a devcontainer locally or on a remote ssh host
2. Try to install hashicorp.terraform extension
3. You get the dialog box, cannot install extension due to invalid signature.

VScode extension traces provided (one with devcontainer, one without) shows:

1. vscode looks for extension on marketplace at https://marketplace.visualstudio.com/_apis/public/gallery/vscode/hashicorp/terraform/latest
2. detects local platform
3. when in devcontainer, it somehow fails to detect platform and fallbacks on 2.19.0 version of extension (the only version being non platform specific) which is unsigned and leads to that "verification error" dialog box
4. locally or on remote ssh, platform is detected and it selects the 2.34.5 version, correctly downloads and verifies signature

If hashicorp had not kept that old version on the marketplace, i guess extension would fail to be loaded.

Does this issue occur when you try this locally?: Yes Does this issue occur when you try this locally and all extensions are disabled?: No (need at least devcontainer extension)

[ferrarimarco]

Hi. I can reproduce this when running an Alpine-based devcontainer as well.

[sandy081]

@cboitel Can you please check if you are still able to reproduce this issue?

[cboitel]

Hi, just tested and same result => extract from log below

[19:09:47] Installing extension: hashicorp.terraform {
  isMachineScoped: false,
  installPreReleaseVersion: false,
  pinned: false,
  donotVerifySignature: false,
  context: { clientTargetPlatform: 'darwin-arm64' },
  isApplicationScoped: false,
  profileLocation: Br {
    scheme: 'file',
    authority: '',
    path: '/home/xxxx/.vscode-server/extensions/extensions.json',
    query: '',
    fragment: '',
    _formatted: 'file:///home/xxxx/.vscode-server/extensions/extensions.json',
    _fsPath: '/home/xxx/.vscode-server/extensions/extensions.json'
  },
  productVersion: { version: '1.107.0', date: '2025-12-10T07:43:47.883Z' }
}
[19:09:57] Error while installing the extension hashicorp.terraform Signature verification failed with 'NotSigned' error. file:///home/xxxxxx/.vscode-server/extensions/extensions.json
rejected promise not handled within 1 second: SignatureVerificationFailed: Signature verification failed with 'NotSigned' error.
stack trace: SignatureVerificationFailed: Signature verification failed with 'NotSigned' error.
    at Il.Cb (file:///vscode/vscode-server/bin/linux-alpine/618725e67565b290ba4da6fe2d29f8fa1d4e3622/out/server-main.js:55:16694)
    at async Il.Bb (file:///vscode/vscode-server/bin/linux-alpine/618725e67565b290ba4da6fe2d29f8fa1d4e3622/out/server-main.js:55:15224)
[19:09:58] SignatureVerificationFailed: Signature verification failed with 'NotSigned' error.
    at Il.Cb (file:///vscode/vscode-server/bin/linux-alpine/618725e67565b290ba4da6fe2d29f8fa1d4e3622/out/server-main.js:55:16694)
    at async Il.Bb (file:///vscode/vscode-server/bin/linux-alpine/618725e67565b290ba4da6fe2d29f8fa1d4e3622/out/server-main.js:55:15224) {
  code: 'SignatureVerificationFailed'
}

[sandy081]

Error while installing the extension hashicorp.terraform Signature verification failed with 'NotSigned' error.

Which log is this?

[ferrarimarco]

@sandy081 Hi, thanks for your support. I get similar logs from the "Server" panel when installing this extension in a devcontainer:

2025-12-16 21:50:03.835 [info] Getting Manifest... hashicorp.terraform
2025-12-16 21:50:04.232 [info] Installing extension: hashicorp.terraform {"isMachineScoped":false,"installPreReleaseVersion":false,"pinned":false,"donotVerifySignature":false,"context":{"clientTargetPlatform":"linux-x64"},"isApplicationScoped":false,"profileLocation":{"$mid":1,"fsPath":"/github/home/.vscode-server/extensions/extensions.json","external":"file:///github/home/.vscode-server/extensions/extensions.json","path":"/github/home/.vscode-server/extensions/extensions.json","scheme":"file"},"productVersion":{"version":"1.102.0","date":"2025-07-09T22:10:34.600Z"}}
2025-12-16 21:50:04.718 [error] Error while installing the extension hashicorp.terraform Signature verification failed with 'NotSigned' error. file:///github/home/.vscode-server/extensions/extensions.json
2025-12-16 21:50:05.722 [error] SignatureVerificationFailed: Signature verification failed with 'NotSigned' error.
    at Kc.Bb (file:///vscode/vscode-server/bin/linux-alpine/cb0c47c0cfaad0757385834bd89d410c78a856c0/out/server-main.js:55:16693)
    at async Kc.Ab (file:///vscode/vscode-server/bin/linux-alpine/cb0c47c0cfaad0757385834bd89d410c78a856c0/out/server-main.js:55:15223)

The devcontainer is based on Alpine, in case this is helpful.

[sandy081]

Is it happening only with this extension - hashicorp.terraform or also with other extensions ?

[cboitel]

Logs are from "dev containers" panel in terminal (appears when starting in dev container).

As mentioned and extracted from logs attached, this is happening with hashicorp.terraform since it uses platform specific versions and also left an old/unsigned/non-platform version of the extension on the market place.

Root cause is that in dev container, platform detection fails and will lead to select wrong or no version of extension on the market place.

When platform detection doesn't fail (as it happens locally or via remote ssh), vscode selects the right version and everything is fine.