pnpm/pnpm · error · PnpmError

PNPM_ENGINE_IDENTITY_UNVERIFIABLE|PNPM_ENGINE_IDENTITY_MISMATCH

PNPM_ENGINE_IDENTITY_UNVERIFIABLE|PNPM_ENGINE_IDENTITY_MISMATCH

Error message

Refusing to run pnpm@${pnpmVersion}: its npm registry signature could not be verified (${describe(result.failures)}). The bytes selected by this project's lockfile/registry do not match a published, signed pnpm release.

What it means

Error "Refusing to run pnpm@${pnpmVersion}: its npm registry signature could not be verified (${describe(result.failures)}). The bytes selected by this project's lockfile/registry do not match a published, signed pnpm release." thrown in pnpm/pnpm.

Source

Thrown at pnpm11/engine/pm/commands/src/self-updater/verifyPnpmEngineIdentity.ts:121

    // is project-controlled, so it is not a safe fallback.
    throw new PnpmError(
      'PNPM_ENGINE_IDENTITY_UNVERIFIABLE',
      `Refusing to run pnpm@${pnpmVersion}: its npm registry signature could not be verified (${String(err)}).`,
      { hint: 'The registry signing keys / packument must be reachable to verify the pnpm release. Set `pmOnFail` to `ignore` to skip the version switch.' }
    )
  }
  if (result.verified) return

  if (result.failures.every(isTolerableWithoutSignature)) {
    globalWarn(
      `The authenticity of pnpm@${pnpmVersion} could not be verified against npm's registry signatures: ${describe(result.failures)}. ` +
      'Proceeding anyway, because the release was resolved through the registry configured in your own (non-project) configuration and stays pinned by its integrity checksum.'
    )
    return
  }

  const onlyUnreachable = result.failures.every((f) => f.category === 'unreachable')
  throw new PnpmError(
    onlyUnreachable ? 'PNPM_ENGINE_IDENTITY_UNVERIFIABLE' : 'PNPM_ENGINE_IDENTITY_MISMATCH',
    `Refusing to run pnpm@${pnpmVersion}: its npm registry signature could not be verified ` +
    `(${describe(result.failures)}). The bytes selected by this project's lockfile/registry do not match a published, signed pnpm release.`,
    { hint: 'This can indicate a tampered lockfile or a malicious/unreachable registry. Set `pmOnFail` to `ignore` to skip the version switch if this is unexpected.' }
  )
}

/**
 * Whether the engine may run despite `failure`: no signature was obtainable
 * (nothing suspicious was observed — as opposed to a signature that exists but
 * does not validate, or a canonical registry answering that no signed release
 * exists), and the package resolves through a registry the user configured
 * themselves. See the trust rationale on {@link verifyPnpmEngineIdentity}.
 */
function isTolerableWithoutSignature (failure: InstalledSignatureFailure): boolean {
  return (failure.category === 'unreachable' || failure.category === 'uncovered') &&
    !equalRegistries(failure.registry, CANONICAL_NPM_REGISTRY)
}

View on GitHub (pinned to 5b11d3a15b)

When it happens

Trigger: Thrown at pnpm11/engine/pm/commands/src/self-updater/verifyPnpmEngineIdentity.ts:121 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of pnpm/pnpm@5b11d3a15b (2026-08-16). Data as JSON: /api/errors/4f3c164b56770037. Report an issue: GitHub.