{"record":{"id":"2148c9a4a13eed7a","repo":"jdx/mise","slug":"macos-binary-signature-verification-failed-invali","errorCode":null,"errorMessage":"macOS binary signature verification failed (invalid signature or incorrect identifier): {}","messagePattern":"macOS binary signature verification failed \\(invalid signature or incorrect identifier\\): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/cli/self_update.rs","lineNumber":761,"sourceCode":"            warn!(\"codesign command not found in PATH, skipping binary signature verification\");\n            warn!(\"This is unusual on macOS - consider verifying your system installation\");\n            return Ok(());\n        }\n\n        // Verify signature and identifier in one step using --test-requirement\n        let output = Command::new(\"codesign\")\n            .args([\n                \"--verify\",\n                \"--deep\",\n                \"--strict\",\n                \"-R=identifier \\\"dev.jdx.mise\\\"\",\n            ])\n            .arg(binary_path)\n            .output()?;\n\n        if !output.status.success() {\n            let stderr = String::from_utf8_lossy(&output.stderr);\n            bail!(\n                \"macOS binary signature verification failed (invalid signature or incorrect identifier): {}\",\n                stderr.trim()\n            );\n        }\n\n        debug!(\"macOS binary signature verified successfully\");\n        Ok(())\n    }\n}\n\n#[cfg(test)]\nmod release_asset_tests {\n    use super::*;\n    use self_update::update::Release;\n\n    #[test]\n    fn archive_names_match_release_platforms() {\n        for (os, arch, build_target, platform) in [","sourceCodeStart":743,"sourceCodeEnd":779,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/cli/self_update.rs#L743-L779","documentation":"After downloading a new macOS binary, self-update verifies its code signature with the codesign tool, checking both signature validity and the expected bundle identifier. If codesign exits non-zero, the downloaded artifact is corrupt, tampered with, or not the mise binary mise expected, so it bails instead of replacing the running binary.","triggerScenarios":"codesign verification of the downloaded binary fails — corrupted download, truncated file, CDN/proxy serving wrong artifact, or a release signed with an unexpected identifier.","commonSituations":"Flaky networks producing partial downloads; corporate proxies intercepting HTTPS; running a modified/re-signed mise build; new release published with a signature change.","solutions":["Retry `mise self-update` to re-download","Verify connectivity / disable intercepting proxies","Download and install fresh via the official install script","Check the GitHub release for known signature issues"],"exampleFix":"null","handlingStrategy":"retry","validationCode":"curl -fLO <release-url> && codesign -dv --verbose=2 ./downloaded-binary 2>&1 | grep -q 'Identifier=mise' || redownload","typeGuard":null,"tryCatchPattern":"for i in 1 2 3; do mise self-update && break || sleep 5; done","preventionTips":["Use stable networking or retry on flaky connections","Avoid MITM proxies when downloading release artifacts","Verify release integrity manually after failed self-updates"],"tags":["macos","self-update","code-signing","verification"],"backgroundTag":"checksum-mismatch","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}