Code signing

Nextcloud supports code signing for the core releases, and for Nextcloud applications. Code signing gives our users an additional layer of security by ensuring that nobody other than authorized persons can push updates.

It also ensures that all upgrades have been executed properly, so that no files are left behind, and all old files are properly replaced. In the past, invalid updates were a significant source of errors when updating Nextcloud.


Why did Nextcloud add code signing?

By supporting Code Signing we add another layer of security by ensuring that nobody other than authorized persons can push updates for applications, and ensuring proper upgrades.

Do we lock down Nextcloud?

The Nextcloud project is open source and always will be. We do not want to make it more difficult for our users to run Nextcloud. Any code signing errors on upgrades will not prevent Nextcloud from running, but will display a warning on the Admin page. For applications that are not tagged “Official” the code signing process is optional.

Not open source anymore?

The Nextcloud project is open source and always will be. The code signing process is optional, though highly recommended. The code check for the core parts of Nextcloud is enabled when the Nextcloud release version branch has been set to stable.

For custom distributions of Nextcloud it is recommended to change the release version branch in version.php to something else than “stable”.

Is code signing mandatory for apps?

Code signing is required for all applications on

Fixing invalid code integrity messages

A code integrity error message (“Some files have not passed the integrity check…”) appears on your Nextcloud admin page under “Overview”, which provides the following options:

  1. Link to this documentation entry.

  2. Show a list of invalid files.

  3. Trigger a rescan.

Links for resolving code integrity warnings.

To debug issues caused by the code integrity check click on “List of invalid files…”, and you will be shown a text document listing the different issues. The content of the file will look similar to the following example:

Technical information
The following list covers which files have failed the integrity check. Please read
the previous linked documentation to learn more about the errors and how to fix

- core
              - /index.php
              - /version.php
      - EXTRA_FILE
              - /test.php
- calendar
              - OC\IntegrityCheck\Exceptions\InvalidSignatureException
              - Signature data not found.

Raw output
    [core] => Array
            [INVALID_HASH] => Array
                    [/index.php] => Array
                            [expected] =>
                            [current] =>

                    [/version.php] => Array
                            [expected] =>
                            [current] =>


            [EXTRA_FILE] => Array
                    [/test.php] => Array
                            [expected] =>
                            [current] =>



    [calendar] => Array
            [EXCEPTION] => Array
                    [class] => OC\IntegrityCheck\Exceptions\InvalidSignature
                    [message] => Signature data not found.



In above error output it can be seen that:

  1. In the Nextcloud core (that is, the Nextcloud server itself) the files “index.php” and “version.php” do have the wrong version.

  2. In the Nextcloud core the unrequired extra file “/test.php” has been found.

  3. It was not possible to verify the signature of the calendar application.

The solution is to upload the correct “index.php” and “version.php” files, and delete the “test.php” file. For the calendar exception contact the developer of the application. For other means on how to receive support please take a look at After fixing these problems verify by clicking “Rescan…”.


When using a FTP client to upload those files make sure it is using the Binary transfer mode instead of the ASCII transfer mode.


Rescans are triggered at installation, and by updates. You may run scans manually with the occ command. The first command scans the Nextcloud server files, and the second command scans the named app. There is not yet a command to manually scan all apps:

occ integrity:check-core
occ integrity:check-app $appid

See Using the occ command to learn more about using occ.



Please don’t modify the mentioned signature.json itself.

The following errors can be encountered when trying to verify a code signature.


    • The file has a different hash than specified within signature.json. This usually happens when the file has been modified after writing the signature data.


    • The file cannot be found but has been specified within signature.json. Either a required file has been left out, or signature.json needs to be edited.


    • The file does not exist in signature.json. This usually happens when a file has been removed and signature.json has not been updated. It also happens if you have placed additional files in your Nextcloud installation folder.


    • Another exception has prevented the code verification. There are currently these following exceptions:

      • Signature data not found.

        • The app has mandatory code signing enforced but no signature.json file has been found in its appinfo folder.

      • Certificate is not valid.

        • The certificate has not been issued by the official Nextcloud Code Signing Root Authority.

      • Certificate is not valid for required scope. (Requested: %s, current: %s)

        • The certificate is not valid for the defined application. Certificates are only valid for the defined app identifier and cannot be used for others.

      • Signature could not get verified.

        • There was a problem with verifying the signature of signature.json.