jdx/mise · critical

macOS binary signature verification failed (invalid signatur

Error message

macOS binary signature verification failed (invalid signature or incorrect identifier): {}

What it means

On macOS, after downloading, self-update verifies the new binary with `codesign --verify --deep --strict -R=identifier "dev.jdx.mise"` — checking both that the signature is valid and that its designated identifier is exactly dev.jdx.mise. Non-zero exit bails with codesign's stderr. This guards Gatekeeper/notarization compatibility and against tampered or re-signed assets. (If codesign itself is missing, mise only warns and skips.)

Source

Thrown at src/cli/self_update.rs:460

            warn!("codesign command not found in PATH, skipping binary signature verification");
            warn!("This is unusual on macOS - consider verifying your system installation");
            return Ok(());
        }

        // Verify signature and identifier in one step using --test-requirement
        let output = Command::new("codesign")
            .args([
                "--verify",
                "--deep",
                "--strict",
                "-R=identifier \"dev.jdx.mise\"",
            ])
            .arg(binary_path)
            .output()?;

        if !output.status.success() {
            let stderr = String::from_utf8_lossy(&output.stderr);
            bail!(
                "macOS binary signature verification failed (invalid signature or incorrect identifier): {}",
                stderr.trim()
            );
        }

        debug!("macOS binary signature verified successfully");
        Ok(())
    }
}

#[cfg(all(test, windows))]
mod tests {
    use super::*;
    use std::path::{Path, PathBuf};

    /// What `env::temp_dir()` hands back on Windows: a directory path of exactly `len`
    /// UTF-16 code units, trailing backslash included.
    fn temp_dir_of_len(len: usize) -> PathBuf {

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

1. Re-run `mise self-update` to re-download (transient corruption)
2. Inspect manually: `codesign -dv --verbose=4 <mise-binary>` and `codesign --verify --deep --strict -R='identifier "dev.jdx.mise"' <mise-binary>`
3. If it persists, reinstall mise from the official channel (curl script) — do not run an asset that fails this check
4. For custom builds, re-sign with identifier dev.jdx.mise or disable self-update for that install

# bash on macOS: pre-verify the current binary's signature before updating
codesign --verify --deep --strict -R='identifier "dev.jdx.mise"' "$(command -v mise)" \
  || echo "WARNING: existing mise signature already invalid" >&2

# bash: treat verification failure as fatal, never bypass it
if ! mise self-update; then
  echo "update failed verification; reinstalling from official channel" >&2
  curl https://mise.run | sh   # or your sanctioned reinstall path
  exit 1
fi

When it happens

Trigger: A corrupted download (signature invalid), a binary signed with a different identifier (custom/re-signed builds), or an asset modified in transit (MITM proxy, antivirus quarantine rewriting). Fires only on macOS during self-update's verification step.

Common situations: Corporate proxies/AV stripping or altering macOS signatures; locally built replacement binaries signed with an ad-hoc or different identifier; partial downloads; a compromised or mis-built release.

Related errors

• codesign failed for {}: {}
• Unknown config file type: {}
• expected closing parenthesis
• GitHub Actions OIDC request URL must use HTTPS
• remote cache URL must use HTTPS except for loopback developm

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/2148c9a4a13eed7a. Report an issue: GitHub.