jdx/mise · critical

macOS binary signature verification failed (invalid…

Error message

macOS binary signature verification failed (invalid signature or incorrect identifier): {}

What it means

After downloading a new macOS binary, self-update verifies its code signature with the codesign tool, checking both signature validity and the expected bundle identifier. If codesign exits non-zero, the downloaded artifact is corrupt, tampered with, or not the mise binary mise expected, so it bails instead of replacing the running binary.

Solutions

1. Retry `mise self-update` to re-download
2. Verify connectivity / disable intercepting proxies
3. Download and install fresh via the official install script
4. Check the GitHub release for known signature issues

Example fix

null

curl -fLO <release-url> && codesign -dv --verbose=2 ./downloaded-binary 2>&1 | grep -q 'Identifier=mise' || redownload

for i in 1 2 3; do mise self-update && break || sleep 5; done

When it happens

Trigger: codesign verification of the downloaded binary fails — corrupted download, truncated file, CDN/proxy serving wrong artifact, or a release signed with an unexpected identifier.

Common situations: Flaky networks producing partial downloads; corporate proxies intercepting HTTPS; running a modified/re-signed mise build; new release published with a signature change.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• the embedded notification helper is not Developer ID signed
• another process is installing the mise notification helper
• : API metadata has no tap_git_head
• app target is outside an allowed Applications directory
• [bootstrap.macos.dock].apps: expected a path relative to…

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/2148c9a4a13eed7a. Report an issue: GitHub.

Appendix: source

Thrown at src/cli/self_update.rs:761

            warn!("codesign command not found in PATH, skipping binary signature verification");
            warn!("This is unusual on macOS - consider verifying your system installation");
            return Ok(());
        }

        // Verify signature and identifier in one step using --test-requirement
        let output = Command::new("codesign")
            .args([
                "--verify",
                "--deep",
                "--strict",
                "-R=identifier \"dev.jdx.mise\"",
            ])
            .arg(binary_path)
            .output()?;

        if !output.status.success() {
            let stderr = String::from_utf8_lossy(&output.stderr);
            bail!(
                "macOS binary signature verification failed (invalid signature or incorrect identifier): {}",
                stderr.trim()
            );
        }

        debug!("macOS binary signature verified successfully");
        Ok(())
    }
}

#[cfg(test)]
mod release_asset_tests {
    use super::*;
    use self_update::update::Release;

    #[test]
    fn archive_names_match_release_platforms() {
        for (os, arch, build_target, platform) in [

View on GitHub (pinned to 533346cc37)