{"record":{"id":"2148c9a4a13eed7a","repo":"jdx/mise","slug":"macos-binary-signature-verification-failed-invali","errorCode":null,"errorMessage":"macOS binary signature verification failed (invalid signature or incorrect identifier): {}","messagePattern":"macOS binary signature verification failed \\(invalid signature or incorrect identifier\\): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/cli/self_update.rs","lineNumber":460,"sourceCode":"            warn!(\"codesign command not found in PATH, skipping binary signature verification\");\n            warn!(\"This is unusual on macOS - consider verifying your system installation\");\n            return Ok(());\n        }\n\n        // Verify signature and identifier in one step using --test-requirement\n        let output = Command::new(\"codesign\")\n            .args([\n                \"--verify\",\n                \"--deep\",\n                \"--strict\",\n                \"-R=identifier \\\"dev.jdx.mise\\\"\",\n            ])\n            .arg(binary_path)\n            .output()?;\n\n        if !output.status.success() {\n            let stderr = String::from_utf8_lossy(&output.stderr);\n            bail!(\n                \"macOS binary signature verification failed (invalid signature or incorrect identifier): {}\",\n                stderr.trim()\n            );\n        }\n\n        debug!(\"macOS binary signature verified successfully\");\n        Ok(())\n    }\n}\n\n#[cfg(all(test, windows))]\nmod tests {\n    use super::*;\n    use std::path::{Path, PathBuf};\n\n    /// What `env::temp_dir()` hands back on Windows: a directory path of exactly `len`\n    /// UTF-16 code units, trailing backslash included.\n    fn temp_dir_of_len(len: usize) -> PathBuf {","sourceCodeStart":442,"sourceCodeEnd":478,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/cli/self_update.rs#L442-L478","documentation":"On macOS, after downloading, self-update verifies the new binary with `codesign --verify --deep --strict -R=identifier \"dev.jdx.mise\"` — checking both that the signature is valid and that its designated identifier is exactly dev.jdx.mise. Non-zero exit bails with codesign's stderr. This guards Gatekeeper/notarization compatibility and against tampered or re-signed assets. (If codesign itself is missing, mise only warns and skips.)","triggerScenarios":"A corrupted download (signature invalid), a binary signed with a different identifier (custom/re-signed builds), or an asset modified in transit (MITM proxy, antivirus quarantine rewriting). Fires only on macOS during self-update's verification step.","commonSituations":"Corporate proxies/AV stripping or altering macOS signatures; locally built replacement binaries signed with an ad-hoc or different identifier; partial downloads; a compromised or mis-built release.","solutions":["Re-run `mise self-update` to re-download (transient corruption)","Inspect manually: `codesign -dv --verbose=4 <mise-binary>` and `codesign --verify --deep --strict -R='identifier \"dev.jdx.mise\"' <mise-binary>`","If it persists, reinstall mise from the official channel (curl script) — do not run an asset that fails this check","For custom builds, re-sign with identifier dev.jdx.mise or disable self-update for that install"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"# bash on macOS: pre-verify the current binary's signature before updating\ncodesign --verify --deep --strict -R='identifier \"dev.jdx.mise\"' \"$(command -v mise)\" \\\n  || echo \"WARNING: existing mise signature already invalid\" >&2","typeGuard":null,"tryCatchPattern":"# bash: treat verification failure as fatal, never bypass it\nif ! mise self-update; then\n  echo \"update failed verification; reinstalling from official channel\" >&2\n  curl https://mise.run | sh   # or your sanctioned reinstall path\n  exit 1\nfi","preventionTips":["Exclude mise binaries from AV/proxy rewriting and from ad-hoc re-signing pipelines","Treat any repeat of this error as a possible supply-chain incident: verify the downloaded asset before use"],"tags":["self-update","macos","codesign","security","signature-verification"],"backgroundTag":"macos-codesign-verification-failed","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}