live attestation currently requires Apple Silicon; Intel mac

Error message

live attestation currently requires Apple Silicon; Intel macOS is not supported

What it means

The darwin attestation provider's resolveRuntime refuses to run when runtime.GOARCH != 'arm64'. DeviceCheck attestation in this codepath depends on the ChatGPT app's bundled Apple-Silicon native module, so Intel Macs (amd64) are explicitly unsupported even though the OS is macOS.

Source

Thrown at backend/internal/platform/liveattestation/attestation_darwin.go:70

	if home, err := os.UserHomeDir(); err == nil && strings.TrimSpace(home) != "" {
		paths = append(paths, filepath.Join(home, "Applications", "ChatGPT.app"))
	}
	return &darwinProvider{
		appSessionID: uuid.NewString(),
		appPaths:     paths,
	}
}

func (p *darwinProvider) Check(ctx context.Context) error {
	checkCtx, cancel := context.WithTimeout(ctx, attestationTimeout)
	defer cancel()
	_, _, _, err := p.resolveRuntime(checkCtx)
	return err
}

func (p *darwinProvider) resolveRuntime(ctx context.Context) (string, string, string, error) {
	if runtime.GOARCH != "arm64" {
		return "", "", "", errors.New("live attestation currently requires Apple Silicon; Intel macOS is not supported")
	}
	appPath, err := p.findApplication()
	if err != nil {
		return "", "", "", err
	}
	resourcesPath := filepath.Join(appPath, "Contents", "Resources")
	nodePath := filepath.Join(resourcesPath, "cua_node", "bin", "node")
	modulePath := filepath.Join(resourcesPath, "native", "devicecheck.node")
	for filePath, label := range map[string]string{
		nodePath:   "bundled Node.js runtime",
		modulePath: "DeviceCheck native module",
	} {
		if info, statErr := os.Stat(filePath); statErr != nil || info.IsDir() {
			return "", "", "", fmt.Errorf("%w: ChatGPT app is missing its %s", ErrChatGPTAppMissing, label)
		}
	}
	bundleID, err := readBundleIdentifier(ctx, appPath)
	if err != nil {

View on GitHub (pinned to 073e92d171)

Solutions

Move Live serving to an Apple Silicon Mac (M1/M2/M3/M4).
If on Apple Silicon but still failing, ensure the Go toolchain targets arm64 natively (check `go env GOARCH`; avoid Rosetta terminals).
Disable Live accounts on Intel hosts and route that traffic to a supported deployment.
Surface errors.Is on this string early (startup Check) rather than at request time.

Example fix

# before: running under Rosetta (GOARCH=amd64 on an M-series Mac)
arch -x86_64 ./sub2api

# after: run natively
./sub2api   # GOARCH=arm64

Defensive patterns

Strategy: validation

Validate before calling

if runtime.GOOS == "darwin" && runtime.GOARCH != "arm64" {
    return errors.New("live attestation requires Apple Silicon; this host is " + runtime.GOARCH)
}

Try / catch

if err := provider.Check(ctx); err != nil {
    if strings.Contains(err.Error(), "Apple Silicon") {
        return configError("migrate Live traffic to an M-series Mac")
    }
    return err
}

Prevention

Run natively (arm64), not under Rosetta
Check `go env GOARCH` in deploy scripts
Standardize Live hosts on Apple Silicon

When it happens

Trigger: Running the binary on an Intel Mac (or under Rosetta forcing GOARCH=amd64) and invoking Check or Generate on the live provider; the first line of resolveRuntime returns this error before any filesystem probing.

Common situations: Older Intel MacBook deployments; universal binaries launched under Rosetta; CI on Intel macOS runners; team members with mixed Mac hardware.

Related errors

AI-assisted analysis of Wei-Shaw/sub2api@073e92d171 (2026-08-15). Data as JSON: /api/errors/da44ed53fba2519b. Report an issue: GitHub.