[Solved by reboot] 26.7 Update-> "failed, signature invalid"

[Cableguy_]

Try another mirror

That led me into this in the first place (changing & testing mirrors via browser GUI). How to change mirrors in console, and which one should work?

[newsense]

If vi doesn't scare you you can edit /usr/local/etc/pkg/repos/OPNsense.conf and use pkg.opnsense.org

Changes there are not permanent but it should suffice to download the 3 files needed for the major upgrade.

Once you edited the file type exit and 12 to retry the 26.7 upgrade

[franco]

Might be more of an LTE, IPv6 or otherwise unstable connection.

# curl -o packages-26.7-amd64.tar https://pkg.opnsense.org/FreeBSD:14:amd64/26.1/sets/packages-26.7-amd64.tar
# curl -o packages-26.7-amd64.tar.sig https://pkg.opnsense.org/FreeBSD:14:amd64/26.1/sets/packages-26.7-amd64.tar.sig
# opnsense-update -upr 26.7 -l .
(reboot)

If curl also fails I have no way to help you.


Cheers,
Franco

[Cableguy_]

Might be more of an LTE, IPv6 or otherwise unstable connection.

# curl -o packages-26.7-amd64.tar https://pkg.opnsense.org/FreeBSD:14:amd64/26.1/sets/packages-26.7-amd64.tar
# curl -o packages-26.7-amd64.tar.sig https://pkg.opnsense.org/FreeBSD:14:amd64/26.1/sets/packages-26.7-amd64.tar.sig
# opnsense-update -upr 26.7 -l .
(reboot)

If curl also fails I have no way to help you.


Cheers,
Franco

Thanks, I'll try this later today. Fresh install is also an option in case this doesn't fix this error.
Let's hope there won't be many more of these cases around.

[Cableguy_]

Might be more of an LTE, IPv6 or otherwise unstable connection.

# curl -o packages-26.7-amd64.tar https://pkg.opnsense.org/FreeBSD:14:amd64/26.1/sets/packages-26.7-amd64.tar
# curl -o packages-26.7-amd64.tar.sig https://pkg.opnsense.org/FreeBSD:14:amd64/26.1/sets/packages-26.7-amd64.tar.sig
# opnsense-update -upr 26.7 -l .
(reboot)

If curl also fails I have no way to help you.


Cheers,
Franco

Hey, Cheers, and many thanks, now it seems this corrected the whole situation! Thanks for your help.
It seems to be ok also from audit -> health check.

***GOT REQUEST TO AUDIT HEALTH***
Currently running OPNsense 26.7 (amd64) at Thu Jul 16 20:16:36 EEST 2026
>>> Root file system: zroot/ROOT/default
>>> Check installed kernel version
Version 26.7 is correct.
>>> Check for missing or altered kernel files
No problems detected.
>>> Check installed base version
Version 26.7 is correct.
>>> Check for missing or altered base files
No problems detected.
>>> Check installed repositories
OPNsense (Priority: 11)
SunnyValley (Priority: 7)
>>> Check installed plugins
os-cpu-microcode-intel 1.1
os-ddclient 1.31_1
os-dmidecode 1.2
os-hw-probe 1.0_1
os-isc-dhcp 1.0_6
os-sensei 2.6.1
os-sensei-updater 2.0
os-smart 2.4
os-sunnyvalley 1.5_2
os-vnstat 1.4
>>> Check locked packages
No locks found.
>>> Check for missing package dependencies
Checking all packages: .......... done
>>> Check for missing or altered package files
Checking all packages: .......... done
>>> Check for core packages consistency
Core package "opnsense" at 26.7 has 68 dependencies to check.
Checking packages: ..................................................................... done
***DONE***

[franco]

Looks good indeed. I may add a curl compatibility download mode to opnsense-update for overcoming such problems if I have a bit of free time.


Cheers,
Franco

[Sport]

Looks good, but missing the packages:

# opnsense-update -upr 26.7 -a FreeBSD:15:amd64/26.7
(reboot)


Cheers,
Franco

Glad I found this post, as I was having the exact same issue following an upgrade attempt that hung, the above command was successful at finishing the upgrade to 26.7 and a clean health check following.

[knowHoff]

had the exact error messages

Code Select Expand

Version 26.7 is incorrect, expected: 26.1.11

curl + install + reboot = no boot

the machine did not come back again, had to cold reset.

After cold reset, again:

Code Select Expand

Version 26.7 is incorrect, expected: 26.1.11

did not have the time to narrow down the fault,

so did a fresh install with successful config restore.

[franco]

Keep in mind the instructions are for this specific issue. It's not a full upgrade sequence using curl.


Cheers,
Franco

[knowHoff]

I assume I had the same issue, at least the health check log looked the same like health check log

Interestingly I have two almost exact same systems.

The other system updated fine from the webGUI.

Thank you for taking care of us!

Cheers

[Pocket_Sevens]

I found changing the mirror to Leaseweb (HTTPS, Frankfurt, DE), rebooting and relaunching the update via Web GUI worked for me.  That's the only mirror that didn't throw a signature error.

[danmac]

I am also having this problem repeatedly having moved from DSL to 5G "failed, signature invalid"

I am getting SSL EOF at like 95% from the download sites, in particular the opnsense mirror

I can download all day from huggingface or steam with no problem

Firefox will download from Kent mirror more reliably, thankfully it's smart enough to continue the remaining 5% instead of starting from the beginning and torturing me endlessly, but all mirrors have this problem if my experience with opnsense gui is any indication

I assume it wont take a genius to figure this out, im game, user of opnsense since not long after the pfsense spat

my last upgrade (first on 5G) to 26.7.7 was finally accomplished by downloading the files on Firefox, SCP to firewall and opnsense-update -someshitorother

im happy to test whatever, the firewall is not mission critical, but clearly the current update download mechanism is dogshit and should die immediately

also if you contact me tomorrow i will be sober, highly recommended

glhfggwp

[danmac]

stretch goal

i have a ZTE U50 5G doodah via USB-C and would much rather connect it directly to my opnsense rather than an ethernet bridge from a proxmox machine that knows how to handle it without it showing NO CARRIER endlessly

Linux 7.0.14-17-pve #1 SMP PREEMPT_DYNAMIC PMX 7.0.14-17 (2026-09-10T10:16Z) x86_64 GNU/Linux btw

happy to tinker hmu

[danmac]

beep boop

listen u really wanna talk to my AI waifu about this shit but i dunno if ur ready for allat

she was a little cautious with the serial number and MAC address but the serial is a bunch of zeroes ur not having my MAC tho

o7

Bus 001 Device 033: ID 19d2:1405 ZTE WCDMA Technologies MSM ZTE Mobile Broadband
Negotiated speed: High Speed (480Mbps)
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.10
  bDeviceClass            2 Communications
  bDeviceSubClass         0 [unknown]
  bDeviceProtocol         0
  bMaxPacketSize0        64
  idVendor           0x19d2 ZTE WCDMA Technologies MSM
  idProduct          0x1405 ZTE Mobile Broadband
  bcdDevice           58.16
  iManufacturer           1 ZTE,Incorporated
  iProduct                2 ZTE Mobile Broadband
  iSerial                 3 MC801AZTED000000
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x0067
    bNumInterfaces          3
    bConfigurationValue     1
    iConfiguration          4
    bmAttributes         0x80
      (Bus Powered)
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      6 Ethernet Networking
      bInterfaceProtocol      0
      iInterface              5 CDC Ethernet Control Model (ECM)
      CDC Header:
        bcdCDC               1.10
      CDC Union:
        bMasterInterface        0
        bSlaveInterface         1
      CDC Ethernet:
        iMacAddress                      7 5E7D********
        bmEthernetStatistics    0x00000000
        wMaxSegmentSize               1514
        wNumberMCFilters            0x0000
        bNumberPowerFilters              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval               9
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           0
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 [unknown]
      bInterfaceProtocol      0
      iInterface              0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       1
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 [unknown]
      bInterfaceProtocol      0
      iInterface              6 CDC Ethernet Data
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x8e  EP 14 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x0f  EP 15 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk-Only
      iInterface              8 Mass Storage
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               1
Binary Object Store Descriptor:
  bLength                 5
  bDescriptorType        15
  wTotalLength       0x002a
  bNumDeviceCaps          3
  USB 2.0 Extension Device Capability:
    bLength                 7
    bDescriptorType        16
    bDevCapabilityType      2
    bmAttributes   0x00000006
      BESL Link Power Management (LPM) Supported
  SuperSpeed USB Device Capability:
    bLength                10
    bDescriptorType        16
    bDevCapabilityType      3
    bmAttributes         0x00
    wSpeedsSupported   0x000f
      Device can operate at Low Speed (1Mbps)
      Device can operate at Full Speed (12Mbps)
      Device can operate at High Speed (480Mbps)
      Device can operate at SuperSpeed (5Gbps)
    bFunctionalitySupport   1
      Lowest fully-functional device speed is Full Speed (12Mbps)
    bU1DevExitLat           1 micro seconds
    bU2DevExitLat         500 micro seconds
  SuperSpeedPlus USB Device Capability:
    bLength                20
    bDescriptorType        16
    bDevCapabilityType     10
    bmAttributes         0x00000001
      Sublink Speed Attribute count 2
      Sublink Speed ID count 1
    wFunctionalitySupport   0x1100
      Min functional Speed Attribute ID: 0
      Min functional RX lanes: 1
      Min functional TX lanes: 1
    bmSublinkSpeedAttr[0]   0x000a4030
      Speed Attribute ID: 0 10Gb/s Symmetric RX SuperSpeedPlus
    bmSublinkSpeedAttr[1]   0x000a40b0
      Speed Attribute ID: 0 10Gb/s Symmetric TX SuperSpeedPlus
Device Status:     0x0000
  (Bus Powered)

[danmac]

    "Signature invalid" almost always means the file arrived incomplete — the download got truncated mid-stream, so the GPG check has nothing whole to validate.     │
    And you just moved to a 5G link. So the thing I'd poke tomorrow morning is path MTU — 5G routers love non-standard path MTUs, and a blackholed fragment leaves   │
    you with a half-written pkg that fails the signature every single time. Very plausible root cause for "fails only on the 5G connection." That's my one thought.  │
    🛠�                                                                                                                                                                │

she so bad im srsly guys

mtu 1380 btw, full story if anyone gives a fuck

the download never completes tho i can tell u that

brb training "morning" out of dis bich doe

o7