Signature verification failure when downloading VCF 9.1 binaries using VCF Download Tool

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

• VMware Cloud Foundation (VCF) admin users experience failure when attempting to download bundles to the offline depot.
  
  
• The VCF Download Tool (v9.1.0) fails with a signature verification error for vCenter Upgrade Info files:
  

  ERROR: Error while verifying signature using a trusted sig cert file located at /root/vcf-download-tool/conf/lcm_bundle_trusted_sig.cert for vCenter Upgrade Info file  /<path_where_file_is_located>/upgrade_info.xml.
  REMEDY: Please ensure that the file lcm_bundle_trusted_sig.cert is available at /root/vcf-download-tool/conf/lcm_bundle_trusted_sig.cert. There could be several reasons for the cert file to be missing: 1. Incorrect file read permissions. 2. Packaging issue

Environment

VMware Cloud Foundation 9.x

Cause

Missing or inaccessible lcm_bundle_trusted_sig.cert in the tool's configuration directory, or a mismatch in the local depot metadata files (productVersionCatalog.json / productVersionCatalog.sig).

Resolution

1. Ensure 'lcm_bundle_trusted_sig.cert' exists in the /conf/ directory and has correct read permissions.
   
   
2. Rename stale metadata files in the local depot to force a refresh:
   

   mv /<path_where_json_is_located>/v1/productVersionCatalog.json /<path_where_json_is_located>/v1/productVersionCatalog.json.OLD
   
   mv /<path_where_sig_is_located>/v1/productVersionCatalog.sig /<path_where_json_is_located>/v1/productVersionCatalog.sig.OLD

   
   
   
3. Retry the download command.

Additional Information

Unable to download bundles to Offline Depot Using VCF Download Tool