[BUG] Official darwin-arm64 binaries fail or inconsistently pass codesign verification on macOS 26.5.2

Summary

Three unmodified darwin-arm64 Claude Code release artifacts downloaded directly from downloads.claude.ai fail strict Apple signature verification on macOS 26.5.2 arm64. A fresh 2.1.246 repeatability check produced one transient success immediately after download, followed by repeated failures against the same unchanged SHA-256; the result is therefore not uniformly deterministic.

For each version, the artifact's byte size and SHA-256 exactly match the corresponding Anthropic manifest. Each detached manifest signature produces GOODSIG and VALIDSIG under the full Claude Code release-signing fingerprint documented by Anthropic. The Mach-O contains the expected identifier and Anthropic Team ID, but codesign reports Authority=(unavailable) and failed strict-verification invocations exit 1.

This report does not assume whether the cause is artifact construction, notarization, certificate handling, or a macOS 26 verification-policy change. I have not yet tested the same bytes on macOS 15 or earlier.

Environment

Hardware architecture: arm64
ProductName: macOS
ProductVersion: 26.5.2
BuildVersion: 25F84

Expected behavior

Anthropic's installation documentation says macOS release binaries are signed by Anthropic PBC, notarized by Apple, and can be verified with:

codesign --verify --verbose ./claude

The exact artifact published by Anthropic should therefore pass signature verification on a supported macOS host, or the documentation should identify any version-specific compatibility limitation.

Documentation: <https://code.claude.com/docs/en/installation>

Reproduction

The example below uses 2.1.246. The same result occurred for 2.1.231 and 2.1.245.

VERSION=2.1.246
PLATFORM=darwin-arm64
TEST_DIR="$(mktemp -d)"

curl -fsSLo "$TEST_DIR/manifest.json" \
  "https://downloads.claude.ai/claude-code-releases/$VERSION/manifest.json"
curl -fsSLo "$TEST_DIR/manifest.json.sig" \
  "https://downloads.claude.ai/claude-code-releases/$VERSION/manifest.json.sig"
curl -fsSLo "$TEST_DIR/claude" \
  "https://downloads.claude.ai/claude-code-releases/$VERSION/$PLATFORM/claude"

jq -r '.platforms["darwin-arm64"] | [.checksum, .size] | @tsv' \
  "$TEST_DIR/manifest.json"
stat -f 'size=%z nlink=%l mode=%Sp' "$TEST_DIR/claude"
shasum -a 256 "$TEST_DIR/claude"
file "$TEST_DIR/claude"
codesign --verify --verbose=4 "$TEST_DIR/claude"
codesign --verify --strict --verbose=4 "$TEST_DIR/claude"
codesign -dv --verbose=4 "$TEST_DIR/claude"

I separately downloaded Anthropic's published release key, matched its full fingerprint to the installation documentation, imported it into a fresh temporary GPG home, and verified each detached manifest signature:

31DD DE24 DDFA B679 F42D 7BD2 BAA9 29FF 1A7E CACE

Results

| Version | Manifest signature | Manifest and artifact SHA-256 | Artifact size | nlink | codesign --verify --strict |
| --------- | ---------------------- | ------------------------------------------------------------------ | ------------: | ------: | ---------------------------- |
| 2.1.231 | GOODSIG + VALIDSIG | ba790279cab6ef77b713864d4bf5f764fcea87d3a3eb7591a41f741e45212b5c | 294,720,528 | 1 | exit 1 |
| 2.1.245 | GOODSIG + VALIDSIG | 9f7c2260251765a18d0b35198669dacc1912f6e8129a3b01f6b58d93365ff1f1 | 376,109,392 | 1 | exit 1 |
| 2.1.246 | GOODSIG + VALIDSIG | 7b09f01cb76a38e0e3a7c47c5d698d382162a5ff26538fc778683770caf9218b | 230,824,016 | 1 | exit 1 |

In the original verification, every artifact failed both the documented command and the stricter command with:

invalid signature (code or signature have been modified)
In architecture: arm64

Metadata inspection reports, for example on 2.1.246:

Identifier=com.anthropic.claude-code
Format=Mach-O thin (arm64)
flags=0x10000(runtime)
Authority=(unavailable)
TeamIdentifier=Q6L2SF6YDW

Fresh repeatability check on 2026-08-26

The exact 2.1.246 artifact was downloaded again into a fresh temporary directory. The manifest signature again produced GOODSIG and VALIDSIG; the signing fingerprint, size, and SHA-256 all matched the values above; the file was a single-link thin arm64 Mach-O.

The first codesign --verify --strict --verbose=4 invocation immediately after that download returned exit 0 with valid on disk and satisfies its Designated Requirement. A subsequent invocation against that same path and unchanged SHA-256 returned exit 1 with invalid signature (code or signature have been modified). Five additional strict checks of that artifact failed, as did five checks of a byte-identical copy. Retained 2.1.231 and 2.1.246 artifacts and the installed 2.1.245 bytes each failed three further strict checks.

No bytes changed between the transient success and subsequent failures. I do not know whether the result depends on macOS trust/provenance state, cache timing, or another host-side condition. This report therefore asks Anthropic to reproduce both the artifact failure and the observed result instability; it does not claim a uniform deterministic failure on every invocation.

Additional observations

• 2.1.231 was returned by Anthropic's stable channel endpoint when tested on 2026-08-25 and was unchanged when rechecked on 2026-08-26.
• 2.1.246 was returned by Anthropic's latest channel endpoint when tested on 2026-08-25 and was unchanged when rechecked on 2026-08-26.
• The versions are not consecutive; they are three sampled releases across this range.
• No binary was locally re-signed, patched, or installed for this reproduction.
• Changing file mode is not required to reproduce the verification failure.
• A separate user-filed report records the bare 2.1.232 native binary passing codesign --verify --strict on the same macOS 26.5.2 build. That adjacent result argues against assuming the operating-system version alone explains these failures, but it is not an exact-artifact A/B test: <https://github.com/anthropics/claude-code/issues/86706>

Questions

1. Are these standalone darwin-arm64 artifacts expected to pass codesign --verify --strict on macOS 26.5.2?
2. Can Anthropic reproduce the failure against these exact SHA-256 values?
3. Is there a currently published, signed and notarized standalone artifact recommended for macOS 26?
4. Can Anthropic publish raw output and exit status from the same strict-verification command against these exact artifacts on macOS 15 and macOS 26?
5. Is any trust, provenance, cache, or first-verification behavior expected to make strict verification of unchanged bytes return different results on successive invocations?

Security and privacy

This report contains only public release metadata, hashes, operating-system version, and signature-verification output. It contains no source code, repository path, username, credential, account identifier, billing information, or private data.