{"record":{"id":"f6be18e022b9785c","repo":"lima-vm/lima","slug":"failed-to-create-a-temporary-file-for-signing-qemu","errorCode":null,"errorMessage":"failed to create a temporary file for signing QEMU binary: %w","messagePattern":"failed to create a temporary file for signing QEMU binary: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/driver/qemu/entitlementutil/entitlementutil.go","lineNumber":45,"sourceCode":"\t\treturn fmt.Errorf(\"failed to run %v: %w (out=%#q)\", cmd.Args, err, string(out))\n\t}\n\n\tcmd = exec.CommandContext(ctx, \"codesign\", \"--display\", \"--entitlements\", \"-\", \"--xml\", qExe)\n\tout, err = cmd.CombinedOutput()\n\tlogrus.WithError(err).Debugf(\"Executed %v: out=%#q\", cmd.Args, string(out))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to run %v: %w (out=%#q)\", cmd.Args, err, string(out))\n\t}\n\tif !strings.Contains(string(out), \"com.apple.security.hypervisor\") {\n\t\treturn fmt.Errorf(\"binary %#q seems signed but lacking the `com.apple.security.hypervisor` entitlement\", qExe)\n\t}\n\treturn nil\n}\n\nfunc Sign(ctx context.Context, qExe string) error {\n\tent, err := os.CreateTemp(\"\", \"lima-qemu-entitlements-*.xml\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create a temporary file for signing QEMU binary: %w\", err)\n\t}\n\tentName := ent.Name()\n\tdefer os.RemoveAll(entName)\n\tconst entXML = `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n  <dict>\n    <key>com.apple.security.hypervisor</key>\n    <true/>\n  </dict>\n</plist>`\n\tif _, err = ent.WriteString(entXML); err != nil {\n\t\tent.Close()\n\t\treturn fmt.Errorf(\"failed to write to a temporary file %#q for signing QEMU binary: %w\", entName, err)\n\t}\n\tent.Close()\n\tsignCmd := exec.CommandContext(ctx, \"codesign\", \"--sign\", \"-\", \"--entitlements\", entName, \"--force\", qExe)\n\tout, err := signCmd.CombinedOutput()","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/lima-vm/lima/blob/dd909d0973cd84fa35f9e1693181b4585ea616c1/pkg/driver/qemu/entitlementutil/entitlementutil.go#L27-L63","documentation":"Sign re-signs the QEMU binary with the hypervisor entitlement by writing the entitlements plist to a temporary file. If os.CreateTemp fails, Sign returns `failed to create a temporary file for signing QEMU binary` wrapping the OS error, before any codesign invocation happens.","triggerScenarios":"os.CreateTemp(\"\", \"lima-qemu-entitlements-*.xml\") failing — typically TMPDIR pointing to a non-writable, full, or nonexistent directory, or resource exhaustion.","commonSituations":"TMPDIR set to a read-only path in CI or sandboxed shells; full disk; hardened environment restricting temp file creation.","solutions":["Check and fix TMPDIR: `echo $TMPDIR`; ensure it exists and is writable","Free disk space if the volume is full","Re-run the command; the temp file is cleaned up automatically (defer os.RemoveAll)"],"exampleFix":"// before\nexport TMPDIR=/nonexistent\n// after\nunset TMPDIR   # or export TMPDIR=$(mktemp -d)","handlingStrategy":"try-catch","validationCode":"if f, err := os.CreateTemp(\"\", \"probe-*\"); err != nil {\n    return errors.New(\"TMPDIR not writable; fix before signing qemu\")\n} else { f.Close(); os.Remove(f.Name()) }","typeGuard":null,"tryCatchPattern":"err := entitlementutil.Sign(ctx, qemuExe)\nif err != nil && strings.Contains(err.Error(), \"temporary file\") {\n    // check TMPDIR writability/disk space, then retry\n}","preventionTips":["Keep TMPDIR set to a writable directory in CI/sandboxes","Monitor disk space on the temp volume","Do not override TMPDIR with read-only paths"],"tags":["macos","qemu","codesign","tempfile","filesystem"],"backgroundTag":"temp-file-creation-failed","analyzedSha":"dd909d0973cd84fa35f9e1693181b4585ea616c1","analyzedAt":"2026-09-01T14:24:59.842Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}