`docx-darwin-arm64` v0.25.0 ships with an invalid code signature; macOS 27 SIGKILLs it on exec (`Killed: 9`, exit 137)

[jpagh]

First, I want to thank you for this tool. It's great and I really appreciate it. It's helped me do a lot of work on .docx files. Here's the issue I encountered after updating to macOS 27 last night.

---

Environment

• macOS 27.0, build 26A428 (ProductVersion 27.0), Apple Silicon (arm64)
• mise 2026.9.8
• Tool: github:kklimuk/docx-cli 0.25.0, release asset docx-darwin-arm64 (73,654,306 bytes on disk)
• Installed with mise install --force github:kklimuk/docx-cli

Symptom

Every invocation — docx --help, docx --version, and no args — dies immediately with zero stdout/stderr:

Killed: 9          # exit code 137

Diagnosis

codesign --verify --verbose and spctl -a -vv -t exec both report:

.../github-kklimuk-docx-cli/0.25.0/docx: invalid signature (code or signature have been modified)

codesign -dvvv (captured from the broken install, before the workaround):

Executable=/Users/jack/.local/share/mise/installs/github-kklimuk-docx-cli/0.25.0/docx
Identifier=a.out
Format=Mach-O thin (arm64)
CodeDirectory v=20400 size=571070 flags=0x20002(adhoc,linker-signed) hashes=17843+0 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=5cd42f283dbf53a2682f636299c0480a9af4bf12
CandidateCDHashFull sha256=5cd42f283dbf53a2682f636299c0480a9af4bf12b721faf786feab3ffc59eaf7
CMSDigest=5cd42f283dbf53a2682f636299c0480a9af4bf12
CDHash=5cd42f283dbf53a2682f636299c0480a9af4bf12
Signature=adhoc
Info.plist=not bound
TeamIdentifier=not set
Sealed Resources=none
Internal requirements=none

Additional notes:

• Only xattr is com.apple.provenance; there is no com.apple.quarantine, so this is not Gatekeeper first-run quarantine — macOS is refusing to exec a Mach-O whose embedded ad-hoc signature doesn't validate.
• Reproduced on a clean reinstall (mise install --force re-downloaded the 73.7 MB asset), so it's the published artifact, not a corrupted local install.
• SHA-256 of the freshly downloaded broken binary: prefix 69cdf0bad1b477f5… (I didn't capture the full digest; the file has since been re-signed). Full hash can be captured with the curl repro below.
• Workaround proving the payload itself is fine: codesign --force --sign - <binary> then codesign --verify says valid on disk / satisfies its Designated Requirement, and docx --version prints 0.25.0.

Likely root cause

The artifact carries the default Rust linker-signed ad-hoc signature (Identifier=a.out, flags=adhoch,linker-signed), but the CodeDirectory hashes no longer match the shipped bytes — i.e. something modified the Mach-O after the linker signed it (strip/objcopy/repack/artifact post-processing). Older macOS versions may have tolerated this; macOS 27 SIGKILLs it at exec. The fix upstream is to re-sign after any post-link modification (or sign/notarize with a Developer ID), and ideally publish a SHA-256.

Minimal repro

# macOS 27.x on Apple Silicon
curl -L -o /tmp/docx-darwin-arm64 \
  https://github.com/kklimuk/docx-cli/releases/download/v0.25.0/docx-darwin-arm64
shasum -a 256 /tmp/docx-darwin-arm64
codesign -dvvv /tmp/docx-darwin-arm64
codesign --verify --verbose /tmp/docx-darwin-arm64   # → invalid signature
chmod +x /tmp/docx-darwin-arm64
/tmp/docx-darwin-arm64 --version                     # → Killed: 9, exit 137
codesign --force --sign - /tmp/docx-darwin-arm64
/tmp/docx-darwin-arm64 --version                     # → works