{"record":{"id":"4f3c164b56770037","repo":"pnpm/pnpm","slug":"pnpm-engine-identity-unverifiable-pnpm-engine-iden","errorCode":"PNPM_ENGINE_IDENTITY_UNVERIFIABLE|PNPM_ENGINE_IDENTITY_MISMATCH","errorMessage":"Refusing to run pnpm@${pnpmVersion}: its npm registry signature could not be verified (${describe(result.failures)}). The bytes selected by this project's lockfile/registry do not match a published, signed pnpm release.","messagePattern":"Refusing to run pnpm@(.+?): its npm registry signature could not be verified \\((.+?)\\)\\. The bytes selected by this project's lockfile/registry do not match a published, signed pnpm release\\.","errorType":"exception","errorClass":"PnpmError","httpStatus":null,"severity":"error","filePath":"pnpm11/engine/pm/commands/src/self-updater/verifyPnpmEngineIdentity.ts","lineNumber":121,"sourceCode":"    // is project-controlled, so it is not a safe fallback.\n    throw new PnpmError(\n      'PNPM_ENGINE_IDENTITY_UNVERIFIABLE',\n      `Refusing to run pnpm@${pnpmVersion}: its npm registry signature could not be verified (${String(err)}).`,\n      { hint: 'The registry signing keys / packument must be reachable to verify the pnpm release. Set `pmOnFail` to `ignore` to skip the version switch.' }\n    )\n  }\n  if (result.verified) return\n\n  if (result.failures.every(isTolerableWithoutSignature)) {\n    globalWarn(\n      `The authenticity of pnpm@${pnpmVersion} could not be verified against npm's registry signatures: ${describe(result.failures)}. ` +\n      'Proceeding anyway, because the release was resolved through the registry configured in your own (non-project) configuration and stays pinned by its integrity checksum.'\n    )\n    return\n  }\n\n  const onlyUnreachable = result.failures.every((f) => f.category === 'unreachable')\n  throw new PnpmError(\n    onlyUnreachable ? 'PNPM_ENGINE_IDENTITY_UNVERIFIABLE' : 'PNPM_ENGINE_IDENTITY_MISMATCH',\n    `Refusing to run pnpm@${pnpmVersion}: its npm registry signature could not be verified ` +\n    `(${describe(result.failures)}). The bytes selected by this project's lockfile/registry do not match a published, signed pnpm release.`,\n    { hint: 'This can indicate a tampered lockfile or a malicious/unreachable registry. Set `pmOnFail` to `ignore` to skip the version switch if this is unexpected.' }\n  )\n}\n\n/**\n * Whether the engine may run despite `failure`: no signature was obtainable\n * (nothing suspicious was observed — as opposed to a signature that exists but\n * does not validate, or a canonical registry answering that no signed release\n * exists), and the package resolves through a registry the user configured\n * themselves. See the trust rationale on {@link verifyPnpmEngineIdentity}.\n */\nfunction isTolerableWithoutSignature (failure: InstalledSignatureFailure): boolean {\n  return (failure.category === 'unreachable' || failure.category === 'uncovered') &&\n    !equalRegistries(failure.registry, CANONICAL_NPM_REGISTRY)\n}","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/pnpm/pnpm/blob/5b11d3a15b9022a2109cb18ed96a5d652630371f/pnpm11/engine/pm/commands/src/self-updater/verifyPnpmEngineIdentity.ts#L103-L139","documentation":"Error \"Refusing to run pnpm@${pnpmVersion}: its npm registry signature could not be verified (${describe(result.failures)}). The bytes selected by this project's lockfile/registry do not match a published, signed pnpm release.\" thrown in pnpm/pnpm.","triggerScenarios":"Thrown at pnpm11/engine/pm/commands/src/self-updater/verifyPnpmEngineIdentity.ts:121 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5b11d3a15b9022a2109cb18ed96a5d652630371f","analyzedAt":"2026-08-16T13:18:59.198Z","schemaVersion":2},"datasetVersion":"2026-08-16T18:17:16.020Z"}