{"record":{"id":"e36dcbb2ec9a811a","repo":"gravitational/teleport","slug":"code-signing-requirement-failed","errorCode":null,"errorMessage":"code signing requirement failed","messagePattern":"code signing requirement failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/vnet/daemon/common_darwin.go","lineNumber":60,"sourceCode":"\terrAlreadyRunning       = errors.New(\"VNet is already running\")\n\n\t// errorCodeMissingCodeSigningIdentifiers is returned within [vnetErrorDomain] Obj-C errors and\n\t// transformed to [errMissingCodeSigningIdentifiers] in Go.\n\terrorCodeMissingCodeSigningIdentifiers = int(C.VNEMissingCodeSigningIdentifiersError)\n\terrMissingCodeSigningIdentifiers       = errors.New(\"either identifier or team identifier is missing in code signing information; is the binary signed?\")\n)\n\nvar (\n\t// nsCocoaErrorDomain is a generic error domain used in a lot of Apple's Cocoa frameworks.\n\tnsCocoaErrorDomain = \"NSCocoaErrorDomain\"\n\n\t// https://developer.apple.com/documentation/foundation/nsxpcconnectioninterrupted-swift.var\n\terrorCodeNSXPCConnectionInterrupted = int(C.NSXPCConnectionInterrupted)\n\terrXPCConnectionInterrupted         = errors.New(\"XPC connection interrupted\")\n\n\t// https://developer.apple.com/documentation/foundation/nsxpcconnectioncodesigningrequirementfailure-swift.var\n\terrorCodeNSXPCConnectionCodeSigningRequirementFailure = int(C.NSXPCConnectionCodeSigningRequirementFailure)\n\terrXPCConnectionCodeSigningRequirementFailure         = errors.New(\"code signing requirement failed\")\n\n\t// https://developer.apple.com/documentation/foundation/nsxpcconnectioninvalid-swift.var\n\terrorCodeNSXPCConnectionInvalid = int(C.NSXPCConnectionInvalid)\n\terrXPCConnectionInvalid         = errors.New(\"XPC connection invalid\")\n)\n\nfunc DaemonLabel() (string, error) {\n\tpath, err := darwinbundle.Path()\n\tif err != nil {\n\t\treturn \"\", trace.Wrap(err)\n\t}\n\n\tcPath := C.CString(path)\n\tdefer C.free(unsafe.Pointer(cPath))\n\n\tcLabel := C.DaemonLabel(cPath)\n\tdefer C.free(unsafe.Pointer(cLabel))\n","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/vnet/daemon/common_darwin.go#L42-L78","documentation":"errXPCConnectionCodeSigningRequirementFailure (lib/vnet/daemon/common_darwin.go:60) maps NSXPCConnectionCodeSigningRequirementFailure from NSCocoaErrorDomain. macOS failed to verify the daemon against the code signing requirement the client specified when connecting over XPC.","triggerScenarios":"startByCalling receives NSCocoaErrorDomain/NSXPCConnectionCodeSigningRequirementFailure. Two documented causes: (1) the daemon binary is not signed to match the requirement, or (2) the daemon shut down immediately after starting (e.g. TELEPORT_HOME points to a path the daemon cannot access), so macOS never had time to verify its signature.","commonSituations":"Unsigned or re-signed dev daemon builds; a modified/replaced binary invalidating the signature; daemon crashing on startup so signature verification never completes; using a TELEPORT_HOME owned by another user.","solutions":["Re-sign the daemon/app bundle so it matches the required code signing identity (Developer ID with correct team/identifier requirements).","Verify the daemon stays alive after launch: check its logs and fix any immediate startup failure (e.g. permissions on TELEPORT_HOME) so macOS can finish signature verification.","Inspect Console.app logs for code signing verification errors and correct the requirement or the binary's signature accordingly."],"exampleFix":"// before: TELEPORT_HOME unreadable by the daemon -> daemon exits before verification\nexport TELEPORT_HOME=/root/.tsh\n// after: use a home dir the current user (and daemon) can access\nexport TELEPORT_HOME=$HOME/.tsh","handlingStrategy":"validation","validationCode":"// ensure TELEPORT_HOME is accessible and binary signature matches requirement before start\nif fi, err := os.Stat(os.Getenv(\"TELEPORT_HOME\")); err != nil || !fi.IsDir() {\n    return errors.New(\"TELEPORT_HOME is missing or inaccessible to the daemon\")\n}\nout, _ := exec.Command(\"codesign\", \"-v\", bundlePath).CombinedOutput()\nif len(out) != 0 {\n    return fmt.Errorf(\"bundle signature invalid: %s\", out)\n}","typeGuard":null,"tryCatchPattern":"if err := client.RegisterAndCall(ctx, bundlePath, cfg); err != nil {\n    if errors.Is(err, vnetdaemon.ErrXPCConnectionCodeSigningRequirementFailure) {\n        // either re-sign the daemon, or fix whatever made it exit before verification\n    }\n    return trace.Wrap(err)\n}","preventionTips":["Sign the daemon bundle with the exact identity the client's code signing requirement expects.","Never point TELEPORT_HOME at a directory the daemon cannot access — the daemon may exit before macOS verifies its signature.","Check Console.app for signing verification errors after any re-sign or bundle change."],"tags":["macos","xpc","code-signing","vnet"],"backgroundTag":"code-signing-requirement-failure","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}