{"record":{"id":"9b71747cf64702e7","repo":"oven-sh/bun","slug":"failed-to-load-security-framework-s-n","errorCode":null,"errorMessage":"Failed to load Security framework: %s\\n","messagePattern":"Failed to load Security framework: (.+?)\\\\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/bun-usockets/src/crypto/root_certs_darwin.cpp","lineNumber":153,"sourceCode":"        if (cf_handle) {\n            dlclose(cf_handle);\n        }\n    }\n\n    bool load() {\n        if (handle && cf_handle) return true; // Already loaded\n\n        // Load CoreFoundation framework\n        cf_handle = dlopen(\"/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation\", RTLD_LAZY | RTLD_LOCAL);\n        if (!cf_handle) {\n            fprintf(stderr, \"Failed to load CoreFoundation framework: %s\\n\", dlerror());\n            return false;\n        }\n\n        // Load Security framework\n        handle = dlopen(\"/System/Library/Frameworks/Security.framework/Security\", RTLD_LAZY | RTLD_LOCAL);\n        if (!handle) {\n            fprintf(stderr, \"Failed to load Security framework: %s\\n\", dlerror());\n            dlclose(cf_handle);\n            cf_handle = nullptr;\n            return false;\n        }\n\n        // Load function pointers first — load_constants() needs\n        // CFStringCreateWithCString to materialize the kSecTrustSettings* keys.\n        if (!load_functions()) {\n            if (handle) {\n                dlclose(handle);\n                handle = nullptr;\n            }\n            if (cf_handle) {\n                dlclose(cf_handle);\n                cf_handle = nullptr;\n            }\n            return false;\n        }","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/packages/bun-usockets/src/crypto/root_certs_darwin.cpp#L135-L171","documentation":"After loading CoreFoundation, the same loader dlopens the Security framework (kSecTrustSettings APIs). On failure it prints this diagnostic with dlerror() detail, closes the already-opened CoreFoundation handle, resets state, and returns false so certificate loading can fall back. Like error 74 it is a non-fatal diagnostic on a path that normally always succeeds on macOS.","triggerScenarios":"Sandbox/container restrictions blocking dlopen of Security.framework; System Integrity Protection anomalies; truncated or replaced system frameworks; running the darwin build outside a real macOS userspace.","commonSituations":"Unusual hardened execution environments; broken macOS installs; test harnesses that stub out system frameworks.","solutions":["Verify TLS connections still succeed — the fallback root store is usually sufficient","Read the dlerror() suffix for the exact OS error (e.g. symbol not found vs permission)","Confirm the binary matches the platform and the OS is intact (softwareupdate --history / reinstall)","Adjust sandbox policy to allow /System/Library/Frameworks/Security.framework"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"const fs = require('node:fs');\nif (process.platform === 'darwin' && !fs.existsSync('/System/Library/Frameworks/Security.framework/Security')) {\n  console.warn('Security framework unavailable — system trust settings will not be read');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Rely on the bundled certificate fallback when system trust APIs are unavailable","Read the dlerror() text in the message to identify sandbox vs corruption","Avoid running the darwin build inside containers that strip system frameworks"],"tags":["macos","tls","certificates","dlopen"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}