{"record":{"id":"b38694eebe1fcbea","repo":"oven-sh/bun","slug":"failed-to-load-corefoundation-framework-s-n","errorCode":null,"errorMessage":"Failed to load CoreFoundation framework: %s\\n","messagePattern":"Failed to load CoreFoundation framework: (.+?)\\\\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/bun-usockets/src/crypto/root_certs_darwin.cpp","lineNumber":146,"sourceCode":"            if (kSecTrustSettingsPolicy) CFRelease(kSecTrustSettingsPolicy);\n            if (kSecTrustSettingsPolicyString) CFRelease(kSecTrustSettingsPolicyString);\n            if (kSecTrustSettingsResult) CFRelease(kSecTrustSettingsResult);\n        }\n        if (handle) {\n            dlclose(handle);\n        }\n        if (cf_handle) {\n            dlclose(cf_handle);\n        }\n    }\n\n    bool load() {\n        if (handle && cf_handle) return true; // Already loaded\n\n        // Load CoreFoundation framework\n        cf_handle = dlopen(\"/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation\", RTLD_LAZY | RTLD_LOCAL);\n        if (!cf_handle) {\n            fprintf(stderr, \"Failed to load CoreFoundation framework: %s\\n\", dlerror());\n            return false;\n        }\n\n        // Load Security framework\n        handle = dlopen(\"/System/Library/Frameworks/Security.framework/Security\", RTLD_LAZY | RTLD_LOCAL);\n        if (!handle) {\n            fprintf(stderr, \"Failed to load Security framework: %s\\n\", dlerror());\n            dlclose(cf_handle);\n            cf_handle = nullptr;\n            return false;\n        }\n\n        // Load function pointers first — load_constants() needs\n        // CFStringCreateWithCString to materialize the kSecTrustSettings* keys.\n        if (!load_functions()) {\n            if (handle) {\n                dlclose(handle);\n                handle = nullptr;","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/packages/bun-usockets/src/crypto/root_certs_darwin.cpp#L128-L164","documentation":"On macOS, the root-certificate loader in bun-usockets dynamically opens CoreFoundation via dlopen to support reading system trust settings. If that dlopen fails, it prints this diagnostic (with dlerror() detail) to stderr and load() returns false so the caller can fall back to another certificate source. On a healthy macOS install this essentially never fails.","triggerScenarios":"Running under a sandbox/seccomp/container that blocks dlopen of system frameworks; a corrupted system framework; running the darwin binary on a non-macOS or heavily stripped environment (jailbreak-ish/hackintosh edge cases).","commonSituations":"Hardened sandboxes (custom seatbelt profiles), CI containers misreporting the platform, or damaged OS installs after failed updates.","solutions":["Treat it as a warning: the library falls back to bundled/alternative roots; verify TLS still works","Check the dlerror() text printed after the message for the concrete reason","Run on a genuine, intact macOS install (repair disk/permissions via Recovery if frameworks are damaged)","Loosen sandbox rules to permit reading /System/Library/Frameworks"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"const fs = require('node:fs');\nif (process.platform === 'darwin' && !fs.existsSync('/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation')) {\n  console.warn('system frameworks unavailable — expect bundled root cert fallback');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat this fprintf as a warning; verify TLS with a real request afterwards","Permit dlopen of /System/Library/Frameworks in sandbox profiles","Keep the OS intact; repair damaged system frameworks via reinstall"],"tags":["macos","tls","certificates","dlopen"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}