pnpm/pnpm · error · PnpmError

PNPM_ENGINE_IDENTITY_UNVERIFIABLE

PNPM_ENGINE_IDENTITY_UNVERIFIABLE

Error message

Cannot verify the identity of pnpm@${pnpmVersion}: its integrity metadata is missing from pnpm-lock.yaml.

What it means

Error "Cannot verify the identity of pnpm@${pnpmVersion}: its integrity metadata is missing from pnpm-lock.yaml." thrown in pnpm/pnpm.

Source

Thrown at pnpm11/engine/pm/commands/src/self-updater/verifyPnpmEngineIdentity.ts:87

 * pnpm can install a tarball without integrity, so a missing integrity must
 * fail closed rather than silently exempt that component from verification.
 * For engine packages resolved from the canonical npm registry itself, even an
 * unreachable registry fails closed (with `PNPM_ENGINE_IDENTITY_UNVERIFIABLE`):
 * the lockfile integrity is project-controlled, so it is not a safe fallback.
 * This runs only when the engine is actually being installed (a store cache
 * miss), so it does not add a network round trip to every command.
 */
export async function verifyPnpmEngineIdentity (
  envLockfile: EnvLockfile,
  pnpmVersion: string,
  opts: VerifyPnpmEngineIdentityOptions
): Promise<void> {
  const trustedKeys = opts.trustedKeys ?? getNpmSigningKeys()
  if (trustedKeys.length === 0) return // test seam: no trusted keys means skip

  const toVerify = collectEnginePackagesToVerify(envLockfile, opts.registries)
  if (toVerify.length === 0) {
    throw new PnpmError(
      'PNPM_ENGINE_IDENTITY_UNVERIFIABLE',
      `Cannot verify the identity of pnpm@${pnpmVersion}: its integrity metadata is missing from pnpm-lock.yaml.`
    )
  }

  const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri ?? {})
  let result
  try {
    result = await verifyInstalledPackageSignatures(toVerify, trustedKeys, getAuthHeader, {
      ...opts,
      fallbackRegistry: CANONICAL_NPM_REGISTRY,
    })
  } catch (err: unknown) {
    // Fail closed: we will not run a downloaded pnpm we could not verify, even
    // when the failure is "could not reach the registry". The lockfile integrity
    // is project-controlled, so it is not a safe fallback.
    throw new PnpmError(
      'PNPM_ENGINE_IDENTITY_UNVERIFIABLE',

View on GitHub (pinned to 5b11d3a15b)

When it happens

Trigger: Thrown at pnpm11/engine/pm/commands/src/self-updater/verifyPnpmEngineIdentity.ts:87 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of pnpm/pnpm@5b11d3a15b (2026-08-16). Data as JSON: /api/errors/5a6603cd7a3f0020. Report an issue: GitHub.