Error: BUNDLE_SIGNATURE_VERIFICATION_FAILED in VCF Download Tool for Component Metadata

Products

• VMware Cloud Foundation

Issue/Introduction

VCF Download Tool (v9.1.0 and higher) may fail with the error below- error while verifying signatures for vCenter upgrade information files:

"BUNDLE_SIGNATURE_VERIFICATION_FAILED"

This issue occurs when component-specific metadata within the local depot store becomes stale or mismatched, preventing the tool from validating the file against the trusted certificate (lcm_bundle_trusted_sig.cert), even if the global product catalog is synchronized

Environment

• VMware Cloud Foundation (VCF) 9.x
• VCF Download Tool 9.1.0 or higher
• Windows environment (Depot store paths defined in c:\temp\...)

Cause

Stale or mismatched metadata files located within the specific component subdirectories of the local depot store prevent the tool from validating signatures during the download process.

Resolution

To resolve this issue, force the VCF Download Tool to re-synchronize the specific component metadata by renaming the affected directories.

1. Navigate to the local depot store directory (e.g., c:\temp\Vmware-depot-2\).
2. Locate the temporary staging directory and rename it to force a refresh: rename c:\temp\Vmware-depot-2\local\tmpDir tmpDir.OLD
3. Navigate to the specific component metadata directory identified in the error logs (e.g., for vCenter): c:\temp\Vmware-depot-2\PROD\COMP\VCENTER\vmw\[component-uuid]\
4. Rename this specific folder to .OLD.
5. Retry the VCF Download Tool command. The tool will recreate these directories and synchronize a fresh, valid copy of the component metadata and signature files.

Additional Information

• Refer to KB 423319 for general troubleshooting regarding Offline Depot bundle downloads.
• If the issue persists, review the vdt.log file located in the logs subdirectory for specific Java stack traces or file access permissions.
• For further assistance, Contact Broadcom Support.