{"record":{"id":"5a6603cd7a3f0020","repo":"pnpm/pnpm","slug":"pnpm-engine-identity-unverifiable","errorCode":"PNPM_ENGINE_IDENTITY_UNVERIFIABLE","errorMessage":"Cannot verify the identity of pnpm@${pnpmVersion}: its integrity metadata is missing from pnpm-lock.yaml.","messagePattern":"Cannot verify the identity of pnpm@(.+?): its integrity metadata is missing from pnpm-lock\\.yaml\\.","errorType":"exception","errorClass":"PnpmError","httpStatus":null,"severity":"error","filePath":"pnpm11/engine/pm/commands/src/self-updater/verifyPnpmEngineIdentity.ts","lineNumber":87,"sourceCode":" * pnpm can install a tarball without integrity, so a missing integrity must\n * fail closed rather than silently exempt that component from verification.\n * For engine packages resolved from the canonical npm registry itself, even an\n * unreachable registry fails closed (with `PNPM_ENGINE_IDENTITY_UNVERIFIABLE`):\n * the lockfile integrity is project-controlled, so it is not a safe fallback.\n * This runs only when the engine is actually being installed (a store cache\n * miss), so it does not add a network round trip to every command.\n */\nexport async function verifyPnpmEngineIdentity (\n  envLockfile: EnvLockfile,\n  pnpmVersion: string,\n  opts: VerifyPnpmEngineIdentityOptions\n): Promise<void> {\n  const trustedKeys = opts.trustedKeys ?? getNpmSigningKeys()\n  if (trustedKeys.length === 0) return // test seam: no trusted keys means skip\n\n  const toVerify = collectEnginePackagesToVerify(envLockfile, opts.registries)\n  if (toVerify.length === 0) {\n    throw new PnpmError(\n      'PNPM_ENGINE_IDENTITY_UNVERIFIABLE',\n      `Cannot verify the identity of pnpm@${pnpmVersion}: its integrity metadata is missing from pnpm-lock.yaml.`\n    )\n  }\n\n  const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri ?? {})\n  let result\n  try {\n    result = await verifyInstalledPackageSignatures(toVerify, trustedKeys, getAuthHeader, {\n      ...opts,\n      fallbackRegistry: CANONICAL_NPM_REGISTRY,\n    })\n  } catch (err: unknown) {\n    // Fail closed: we will not run a downloaded pnpm we could not verify, even\n    // when the failure is \"could not reach the registry\". The lockfile integrity\n    // is project-controlled, so it is not a safe fallback.\n    throw new PnpmError(\n      'PNPM_ENGINE_IDENTITY_UNVERIFIABLE',","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/pnpm/pnpm/blob/5b11d3a15b9022a2109cb18ed96a5d652630371f/pnpm11/engine/pm/commands/src/self-updater/verifyPnpmEngineIdentity.ts#L69-L105","documentation":"Error \"Cannot verify the identity of pnpm@${pnpmVersion}: its integrity metadata is missing from pnpm-lock.yaml.\" thrown in pnpm/pnpm.","triggerScenarios":"Thrown at pnpm11/engine/pm/commands/src/self-updater/verifyPnpmEngineIdentity.ts:87 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5b11d3a15b9022a2109cb18ed96a5d652630371f","analyzedAt":"2026-08-16T13:18:59.198Z","schemaVersion":2},"datasetVersion":"2026-08-16T18:17:16.020Z"}