Tanzu CLI Plugin Inventory Database Fetch Failure with v1.2.0 and prior

Products

• VMware Tanzu Application Service

Issue/Introduction

As of June 9, 2026, users running Tanzu CLI version 1.2.0 or earlier will encounter an issue when attempting to fetch the plugin inventory database. This is due to a signature verification error that prevents the CLI client from retrieving the image projects.registry.vmware.com/tanzu_cli/plugins/plugin-inventory:latest.

The error message will appear as follows:

[!] Unable to verify the plugins discovery image signature: failed unmarshalling PEM encoded default public key: x509: failed to unmarshal elliptic curve point

[x] Fatal, plugins discovery image signature verification failed. The `tanzu` CLI can not ensure the integrity of the plugins to be installed. To ignore this validation please append "projects.registry.vmware.com/tanzu_cli/plugins/plugin-inventory:latest" to the comma-separated list in the environment variable "TANZU_CLI_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_VERIFICATION_SKIP_LIST".  This is NOT RECOMMENDED and could put your environment at risk!

Environment

Tanzu CLI

Resolution

To resolve this issue, users have two available options:

Option 1: Upgrade Tanzu CLI to the latest version

We recommend upgrading to the latest version of Tanzu CLI. Please follow the installation steps outlined in our documentation to upgrade to version 1.3.0 or later.  The documentation can be found here https://github.com/vmware-tanzu/tanzu-cli/blob/main/docs/quickstart/install.md#installing-the-tanzu-cli

Option 2: Configure Tanzu CLI (<= v1.2.0) to Use the Updated Public Key

Alternatively, users can configure their existing Tanzu CLI installation to use the updated public key. To do this, follow these steps:

1. Create a new file containing the updated public key:

   cat > $HOME/.config/tanzu/cosign-public-key << EOF
   -----BEGIN PUBLIC KEY-----
   MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEXwvbGFvDXmZ95gngDOqUxkHrhOnT
   jvLHEhX0Nj542gExPUSBRKhh82DN/23qvMXLffg5Za8Q3+H5Xodth3oo4g==
   -----END PUBLIC KEY-----
   EOF

    

2. Set the `TANZU_CLI_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_PUBLIC_KEY_PATH` environment variable to point to the newly created file
   

   tanzu config set env.TANZU_CLI_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_PUBLIC_KEY_PATH $HOME/.config/tanzu/cosign-public-key

Important Note:

Ignoring the signature verification error by appending the image to the TANZU_CLI_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_VERIFICATION_SKIP_LIST environment variable is not recommended, as it may put your environment at risk. We strongly advise against this approach and recommend upgrading to the latest version of Tanzu CLI or configuring the updated public key instead.