{"record":{"id":"8d2b98760f26a44e","repo":"lima-vm/lima","slug":"binary-q-seems-signed-but-lacking-the-com-apple","errorCode":null,"errorMessage":"binary %#q seems signed but lacking the `com.apple.security.hypervisor` entitlement","messagePattern":"binary %#q seems signed but lacking the `com\\.apple\\.security\\.hypervisor` entitlement","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/driver/qemu/entitlementutil/entitlementutil.go","lineNumber":37,"sourceCode":"\n// IsSigned returns an error if the binary is not signed, or the sign is invalid,\n// or not associated with the \"com.apple.security.hypervisor\" entitlement.\nfunc IsSigned(ctx context.Context, qExe string) error {\n\tcmd := exec.CommandContext(ctx, \"codesign\", \"--verify\", qExe)\n\tout, err := cmd.CombinedOutput()\n\tlogrus.WithError(err).Debugf(\"Executed %v: out=%#q\", cmd.Args, string(out))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to run %v: %w (out=%#q)\", cmd.Args, err, string(out))\n\t}\n\n\tcmd = exec.CommandContext(ctx, \"codesign\", \"--display\", \"--entitlements\", \"-\", \"--xml\", qExe)\n\tout, err = cmd.CombinedOutput()\n\tlogrus.WithError(err).Debugf(\"Executed %v: out=%#q\", cmd.Args, string(out))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to run %v: %w (out=%#q)\", cmd.Args, err, string(out))\n\t}\n\tif !strings.Contains(string(out), \"com.apple.security.hypervisor\") {\n\t\treturn fmt.Errorf(\"binary %#q seems signed but lacking the `com.apple.security.hypervisor` entitlement\", qExe)\n\t}\n\treturn nil\n}\n\nfunc Sign(ctx context.Context, qExe string) error {\n\tent, err := os.CreateTemp(\"\", \"lima-qemu-entitlements-*.xml\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create a temporary file for signing QEMU binary: %w\", err)\n\t}\n\tentName := ent.Name()\n\tdefer os.RemoveAll(entName)\n\tconst entXML = `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n  <dict>\n    <key>com.apple.security.hypervisor</key>\n    <true/>\n  </dict>","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/lima-vm/lima/blob/dd909d0973cd84fa35f9e1693181b4585ea616c1/pkg/driver/qemu/entitlementutil/entitlementutil.go#L19-L55","documentation":"When codesign output shows the QEMU binary is signed but the entitlements do not include `com.apple.security.hypervisor`, IsSigned returns this explicit error. It distinguishes a signature-valid-but-unentitled binary from outright codesign failures (errors 346/347).","triggerScenarios":"IsSigned succeeds at --verify but `strings.Contains(codesign --display output, \"com.apple.security.hypervisor\")` is false for the given qemu executable path.","commonSituations":"qemu binaries from third-party package managers signed with minimal entitlements; manually re-signed binaries where the entitlements plist omitted the hypervisor key.","solutions":["Re-sign the binary via Lima's prompt (Sign applies the hypervisor entitlement automatically)","Manually sign with an entitlements plist containing com.apple.security.hypervisor=true","Replace the binary with one built/signed for Apple Virtualization use"],"exampleFix":"// before\ncodesign --force --sign - qemu-system-aarch64   # no entitlements\n// after\ncodesign --entitlements hyp.xml --force --sign - qemu-system-aarch64  # hyp.xml grants com.apple.security.hypervisor","handlingStrategy":"validation","validationCode":"ent, _ := exec.Command(\"codesign\", \"--display\", \"--entitlements\", \"-\", \"--xml\", qemuExe).CombinedOutput()\nif !strings.Contains(string(ent), \"com.apple.security.hypervisor\") {\n    return errors.New(\"qemu lacks hypervisor entitlement; re-sign required\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Include com.apple.security.hypervisor in any manual codesign of qemu","Check entitlements as part of macOS VM setup scripts","Re-sign after every qemu reinstall if the distributor does not embed entitlements"],"tags":["macos","qemu","codesign","entitlement"],"backgroundTag":"codesign-verification-failed","analyzedSha":"dd909d0973cd84fa35f9e1693181b4585ea616c1","analyzedAt":"2026-09-01T14:24:59.842Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}