live attestation is only supported when Sub2API runs on macO

Error message

live attestation is only supported when Sub2API runs on macOS; Windows support is not implemented yet

What it means

ErrUnsupportedPlatform is returned by the liveattestation Provider when Sub2API is built/run on any OS other than macOS. Live-ChatGPT requests require Apple's DeviceCheck attestation, and only a macOS implementation exists (build-tag gated); Windows and Linux return this sentinel from Check/Generate.

Source

Thrown at backend/internal/platform/liveattestation/attestation.go:9

package liveattestation

import (
	"context"
	"errors"
)

var (
	ErrUnsupportedPlatform = errors.New("live attestation is only supported when Sub2API runs on macOS; Windows support is not implemented yet")
	ErrChatGPTAppMissing   = errors.New("live attestation requires the official ChatGPT app on the Sub2API server")
)

// Provider 在发起 Live 请求前生成 ChatGPT DeviceCheck attestation。
type Provider interface {
	Check(ctx context.Context) error
	Generate(ctx context.Context) (string, error)
}

View on GitHub (pinned to 073e92d171)

Solutions

Run the Sub2API instance that serves Live traffic on an Apple Silicon macOS host.
Remove/disable Live provider accounts on non-macOS deployments so requests route elsewhere or fail fast with a clear config error.
Gate Live features in your deployment config per-OS to surface this at startup rather than at request time.
Match with errors.Is(err, liveattestation.ErrUnsupportedPlatform) to render a clear 'Live requires macOS' message.

Example fix

// before: Live enabled unconditionally
provider := live.New(cfg)

// after: fail fast with a clear message on unsupported OS
if _, err := provider.Check(ctx); err != nil {
    if errors.Is(err, liveattestation.ErrUnsupportedPlatform) {
        log.Fatal("live attestation unavailable: deploy on Apple Silicon macOS or disable Live accounts")
    }
}

Defensive patterns

Strategy: validation

Validate before calling

// startup guard for deployments
if runtime.GOOS != "darwin" && cfg.LiveEnabled {
    return fmt.Errorf("live attestation requires macOS; disable live accounts on %s", runtime.GOOS)
}

Try / catch

if err := provider.Check(ctx); err != nil {
    if errors.Is(err, liveattestation.ErrUnsupportedPlatform) {
        return configError("deploy on Apple Silicon macOS or disable the Live provider")
    }
    return err
}

Prevention

Fail fast at startup, not per-request
Document OS requirements next to Live account config
Use errors.Is against the sentinel

When it happens

Trigger: Deploying Sub2API on Linux or Windows and enabling/configuring the Live provider (or a Live account route); the platform-neutral file resolves because attestation_darwin.go is excluded by GOOS build tags, and the default provider returns ErrUnsupportedPlatform.

Common situations: Docker (Linux) deployments with Live accounts attached; CI environments attempting Live requests; migrating a working macOS setup to a Linux VPS; Windows Server deployments.

Related errors

AI-assisted analysis of Wei-Shaw/sub2api@073e92d171 (2026-08-15). Data as JSON: /api/errors/37156f77722ac897. Report an issue: GitHub.