jdx/mise · error · eyre::Report

codesign failed for {}: {}

Error message

codesign failed for {}: {}

What it means

On macOS (notably Apple Silicon), after patching binaries during relocation mise re-applies an ad-hoc code signature with `codesign --sign - --force --preserve-metadata=...`. If codesign exits nonzero, the error carries its stderr. Aborting is correct: an unsigned or malformed arm64 binary would be killed by the kernel on next launch anyway.

Source

Thrown at src/system/packages/brew/relocate.rs:307

/// the kernel kills binaries whose signature doesn't match their contents.
pub fn codesign(files: &[PathBuf]) -> Result<()> {
    for file in files {
        let res = crate::cmd::cmd(
            "/usr/bin/codesign",
            [
                "--sign",
                "-",
                "--force",
                "--preserve-metadata=entitlements,requirements,flags,runtime",
                &file.to_string_lossy(),
            ],
        )
        .stderr_capture()
        .stdout_capture()
        .unchecked()
        .run()?;
        if !res.status.success() {
            bail!(
                "codesign failed for {}: {}",
                file.display(),
                String::from_utf8_lossy(&res.stderr).trim()
            );
        }
    }
    Ok(())
}

#[cfg(test)]
pub(super) mod tests {
    use super::*;
    use std::io::{Cursor, Read, Write};
    use std::os::unix::fs::PermissionsExt;

    /// fixed macOS-style replacements so tests behave the same on all hosts
    pub(in super::super) fn test_replacements() -> Vec<Replacement> {
        vec![

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

1. Read the included stderr — it names the specific codesign complaint (invalid Mach-O, unsupported format, etc.)
2. Clear mise's brew bottle cache to force a clean re-download in case of corruption
3. Verify manually with `codesign -vv <file>`; if codesign itself is broken, reinstall Xcode Command Line Tools
4. Fall back to installing the formula with native Homebrew on that machine

match relocate_and_sign(...).await {
    Err(e) if e.to_string().contains("codesign failed") => {
        // clear the suspect bottle, retry once; if it still fails, install with native brew
        crate::file::remove_all(&bottle_path).ok();
        relocate_and_sign(...).await.map_err(|e| e.wrap_err("codesign still failing — reinstall Xcode CLT or use native brew"))
    }
    other => other,
}

When it happens

Trigger: run_codesign executes after relocation on arm64 macOS; codesign fails because the patched Mach-O is malformed (corrupt download), entitlements/requirements cannot be preserved, or the codesign tool itself is broken (damaged Xcode CLT).

Common situations: Corrupt or truncated bottle downloads making the Mach-O invalid; macOS upgrades leaving Command Line Tools broken; CI hosts with security policies restricting codesign; binaries whose embedded provisioning data cannot be re-signed ad hoc.

Related errors

• cannot relocate {}: not enough padding to grow load commands
• macOS binary signature verification failed (invalid signatur
• app target is outside an allowed Applications directory: {}
• font target is outside the platform font directory: {}
• cannot relocate {}: rpath must grow but the dynamic string t

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/75a51508cf1c8013. Report an issue: GitHub.