the installed ChatGPT app has an unexpected bundle identifie

Error message

the installed ChatGPT app has an unexpected bundle identifier

What it means

The darwin provider reads CFBundleIdentifier from the installed ChatGPT app's Info.plist via /usr/bin/plutil and requires it to start with 'com.openai.'. A different prefix means the app bundle at the discovered path is not an official OpenAI app, so attestation is refused rather than run against untrusted code.

Source

Thrown at backend/internal/platform/liveattestation/attestation_darwin.go:166

	return "", ErrChatGPTAppMissing
}

func readBundleIdentifier(ctx context.Context, appPath string) (string, error) {
	infoPlist := filepath.Join(appPath, "Contents", "Info.plist")
	output, err := exec.CommandContext(
		ctx,
		"/usr/bin/plutil",
		"-extract",
		"CFBundleIdentifier",
		"raw",
		infoPlist,
	).Output()
	if err != nil {
		return "", fmt.Errorf("%w: cannot read its bundle identifier", ErrChatGPTAppMissing)
	}
	bundleID := strings.TrimSpace(string(output))
	if !strings.HasPrefix(bundleID, "com.openai.") {
		return "", errors.New("the installed ChatGPT app has an unexpected bundle identifier")
	}
	return bundleID, nil
}

func (p *darwinProvider) readSignals(ctx context.Context) (deviceSignals, error) {
	const script = `ObjC.import("Foundation"); ObjC.import("AppKit");
const screen = $.NSScreen.mainScreen;
const frame = screen.frame;
JSON.stringify({
  locale: ObjC.unwrap($.NSLocale.currentLocale.localeIdentifier),
  languages: ObjC.deepUnwrap($.NSLocale.preferredLanguages),
  timezone: ObjC.unwrap($.NSTimeZone.localTimeZone.name),
  width: Number(frame.size.width),
  height: Number(frame.size.height),
  scale: Number(screen.backingScaleFactor)
})`
	output, err := exec.CommandContext(ctx, "/usr/bin/osascript", "-l", "JavaScript", "-e", script).Output()
	if err != nil {

View on GitHub (pinned to 073e92d171)

Solutions

Install the official ChatGPT app from openai.com into /Applications and remove impostor bundles.
If appPaths was overridden, reset it to the official install location.
Re-verify with `plutil -extract CFBundleIdentifier raw /Applications/ChatGPT.app/Contents/Info.plist` — it must print com.openai.*.
After replacing the app, re-run provider Check to confirm runtime resolution passes.

Example fix

# before: impostor bundle
$ plutil -extract CFBundleIdentifier raw ~/Apps/ChatGPT.app/Contents/Info.plist
com.someone.chatgpt-clone

# after: official app
$ plutil -extract CFBundleIdentifier raw /Applications/ChatGPT.app/Contents/Info.plist
com.openai.chat

Defensive patterns

Strategy: validation

Validate before calling

out, err := exec.Command("/usr/bin/plutil", "-extract", "CFBundleIdentifier", "raw",
    filepath.Join(appPath, "Contents", "Info.plist")).Output()
if err == nil && !strings.HasPrefix(strings.TrimSpace(string(out)), "com.openai.") {
    return fmt.Errorf("app at %s is not the official ChatGPT bundle", appPath)
}

Try / catch

if err := provider.Check(ctx); err != nil {
    if errors.Is(err, liveattestation.ErrChatGPTAppMissing) || strings.Contains(err.Error(), "unexpected bundle identifier") {
        return setupError("install the official ChatGPT app in /Applications")
    }
    return err
}

Prevention

Install the app from the official source only
Do not override appPaths to non-official bundles
Verify the bundle ID with plutil after every app update

When it happens

Trigger: appPaths points at a directory containing a renamed, repackaged, or third-party 'ChatGPT'-like app whose bundle ID differs (e.g. a fork, a stub, or a differently-signed clone). plutil succeeds, but the prefix check fails.

Common situations: App renamed/copied to satisfy the path probe; unofficial builds or cracked apps; leftover directories from beta channels with different bundle IDs; user pointing appPaths at a custom location holding something else.

Related errors

AI-assisted analysis of Wei-Shaw/sub2api@073e92d171 (2026-08-15). Data as JSON: /api/errors/75da40fbbc6b755b. Report an issue: GitHub.