macOS: zsh: bad CPU type in executable
The binary contains only Intel x86_64 code, and this Mac has an Apple silicon chip without Rosetta 2 installed. macOS offers to install Rosetta when you open an Intel app from the Finder, but a binary started from the terminal, a script or a CI runner just fails with this. It also catches old 32-bit binaries, which no Mac has run since Catalina, Rosetta or not. Apple has said Rosetta becomes far more limited after macOS 27, so an arm64 or universal build is the lasting fix.
Quick fix
Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.
# What architectures does the binary contain?
file ./tool
lipo -archs ./tool
# What is this Mac? arm64 means Apple silicon
uname -m
# Is Rosetta installed? (its daemon only exists when it is)
pgrep -q oahd && echo "Rosetta installed" || echo "Rosetta missing"
# Install Rosetta 2
softwareupdate --install-rosetta --agree-to-license
# Better: get a native build. Homebrew under /opt/homebrew is arm64
brew reinstall <formula>
# Is this shell itself running under Rosetta? i386 here means yes
archHow to diagnose Apple errors
macOS developer errors concentrate around three subsystems: the command line tools (xcrun and the active developer directory), the dynamic linker (dyld, library paths, and code signing), and Gatekeeper / notarisation. Apple Silicon added a fourth axis: architecture mismatches between arm64 and x86_64 binaries, which usually surface as confusing "library not loaded" or "bad CPU type" messages rather than as an explicit architecture error.
If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.
- Check the active developer directory first with
xcode-select -p. After every macOS or Xcode update this can point at a path that no longer exists, breaking git, compilers and package managers all at once. - For dyld errors, run
otool -L /path/to/binaryto list what it actually wants, then verify each path exists.DYLD_PRINT_LIBRARIES=1shows the resolution order at runtime. - Confirm architecture with
file /path/to/binaryanduname -m. On Apple Silicon, a Rosetta shell reportsx86_64and will silently install the wrong Homebrew prefix. - Homebrew lives at
/opt/homebrewon Apple Silicon and/usr/localon Intel. Permission errors under/usr/localon an M-series Mac almost always mean a Rosetta/native mix-up. - For Gatekeeper and notarisation, use
spctl -a -vvvto assess a bundle andxcrun notarytool logto get the actual rejection reason. The submission status alone tells you nothing useful.
Tools worth reaching for
xcode-select -potool -Lcodesign -dv --verbose=4spctl -a -vvvxcrun notarytool log
Authoritative references
Primary documentation for this error, worth reading before applying any fix in production.
Related Apple errors
- App Store Connect: ITMS-91053: Missing API declarationSince May 2024 Apple rejects uploads that call certain "required reason" APIs, such as…
- Homebrew: Cannot install under Rosetta 2 in ARM default prefixThe arm64 Homebrew in /opt/homebrew refuses to run in a translated process, which is what…
- Homebrew: Permission denied @ /usr/localHomebrew cannot write to its prefix because directory ownership is wrong, common on Intel…
- ld: symbol(s) not found for architecture arm64Compilation succeeded and the linker could not find a definition for something that was…
- macOS: "App" is damaged and can’t be opened. You should move it to the BinGatekeeper is reporting a failed signature or notarisation check on a quarantined download…
- macOS: cannot be opened because the developer cannot be verifiedGatekeeper blocked something that carries the quarantine attribute and is not notarised…
- macOS: dyld: Library not loadedThe dynamic linker could not find a shared library at the path baked into the binary, often…
- macOS: errSecAuthFailed / Keychain access deniedA code-signing or credential operation could not read the Keychain, common in CI when the…
Browse other categories
- HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
- JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
- Database 41Connections, deadlocks, constraints, replication and memory limits.
- AI 35Rate limits, context windows, GPU memory and model-serving failures.
- Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
- Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
- Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
- Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
- System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
- Cloud 25IAM permissions, quotas, service limits and credential failures.
- Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
- TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.
Something missing or wrong?
This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.