Windows ACC Upgrade fails during ACC Plugin/asset signature verification - Known Error

Windows ACC Upgrade fails during ACC Plugin/asset signature verification Description Signature Verification of the ACC Plugins (aka Senu Assets) used by the Upgrade checks fails, preventing the check running, and failing the Agent Client collector upgrade.

Check/Asset involved: For Windows: "Agent Upgrade - MSI", using plugin "acc-f-upgrade-msi"

Steps to Reproduce

install windows agent 2.8.0 enable plugin signature verification install acc-f version 2.9.0 navigate to agent record click on upgrade agent link upgrade fails with : " Agent upgrade Failed. Check output: error getting plugin for check: couldn't verify asset (skipped fetching certificates and retrying): error verifying plugin with public signature: read {temp folder path}\sensu-asset{number} The handle is invalid." The sensu-asset number, and temp folder will be different on each ACC, e.g.

Agent upgrade Failed. Check output: error getting plugin for check: still couldn't verify asset after fetching certificates: error verifying plugin with public signature: read C:\Users\SNDISC~1\AppData\Local\Temp\sensu-asset059440948: The handle is invalid.

Also seen by looking in the acc.log directly, you see the Asset Verify, and then in the Agent Upgrade - MSI/runUpgrade.rb check execution passing that error back to the instance:

[INFO] [asset-manager] Finished with downloading and installing certificates from the MID server [ERROR] [agent] [error getting plugin for check: still couldn't verify asset after fetching certificates: error verifying plugin with public signature : read C:\Users\SERVIC~1\AppData\Local\Temp\sensu-asset387311406: The handle is invalid .] sending failure [INFO] [agent] [application/json] [{"timestamp":1651776308,"entity":{"entity_class":"agent","system":{"hostname":"xxxxxx","os":"windows","platform":"Microsoft Windows Server 2019 Standard","platform_family":"Server","platform_version":"10.0.17763 Build 17763","network":{"interfaces":[{"name":"Ethernet0","mac":"00:50:56:b7:fe:ef","addresses":["10.0.x.x/24"]},{"name":"Loopback Pseudo-Interface 1","addresses":["::1/128","127.0.0.1/8"]}]},"arch":"amd64"},"subscriptions":[],"last_seen":1651776133,"deregister":false,"deregistration":{},"user":"agent","redact":[....],"metadata":{"name":"9b4a345567ac8f30","namespace":"default"},"sensu_agent_version":"2.8.2"},"check":{"command":" runUpgrade.rb -v 2.9.0","handlers":[],"high_flap_threshold":0,"interval":60,"low_flap_threshold":0,"publish":false,"runtime_assets":null,"subscriptions":[],"proxy_entity_name":"","check_hooks":null,"stdin":false,"subdue":null,"ttl":0,"timeout":600000,"round_robin":false,"executed":1651776307,"history":null,"issued":0,"output":" error getting plugin for check : still couldn't verify asset after fetching certificates : error verifying plugin with public signature: read C:\\Users\\SERVIC~1\\AppData\\Local\\Temp\\sensu-asset387311406: The handle is invalid.","status":3,"total_state_change":0,"last_ok":0,"occurrences":0,"occurrences_watermark":0,"output_metric_format":"","output_metric_handlers":null,"env_vars":null,"metadata":{"name":"f9aa6e511b138190c8d42139b04bcb25_5f74fe90533d45100112ddeeff7b1229_c43a2619db9b4d90eeb2f16c68961997","namespace":"default","labels":{"requestId":"f9aa6e511b138190c8d42139b04bcb25","exec_mode":"shell","priority":"1","instance_script":"true","check_full_name":" Agent Upgrade - MSI ","ci_id":"c43a2619db9b4d90eeb2f16c68961997","params_upgrade_seq":"e9aa6e511b138190c8d42139b04bcb23","check_type_id":"b69143c853a901100112ddeeff7b125b","params_background":"false"}}},"metadata":{"namespace":"default"}}] [event] sending message

The error is also see when the upgrade checks' ACC Plugin/asset is fetched from the MID Server:

[INFO] [agent] scheduling check execution, name: Agent Upgrade - MSI , id: 744c6371db881d50ba094c9d13961922_5f74fe90533d45100112ddeeff7b1229_716fae09874ec95008f455b73cbb35e5 [INFO] [ https://x.y.z:8085/static/acc_plugin/windows/all/all/all/ acc-f-upgrade -msi.tar.gz ] [asset-manager] [200 OK] finished fetching asset [ERROR] [agent] [error getting plugin for check: couldn't verify asset (skipped fetching certificates and retrying): error verifying plugin with public signature: read C:\Users\SNDISC~1\AppData\Local\Temp\sensu-asset399269372: The handle is invalid.] sending failure

Workaround This problem is currently under review. You can contact ServiceNow Technical Support or subscribe to this Known Error article by clicking the Subscribe button at the top right of this article to be notified when more information becomes available.

This problem occurs when plugin verification is active. You can confirm what the ACC settings are by clicking Grab Agent Config related link on the Agent form. See the docs .

The workaround is to temporarily disable plugin verification in the acc.yml file of the affected ACC installs Change this: #verify-plugin-signature: true To this: verify-plugin-signature: false