{"record":{"id":"fb9c95e8ef08455d","repo":"lima-vm/lima","slug":"failed-to-run-v-w-out-q","errorCode":null,"errorMessage":"failed to run %v: %w (out=%#q)","messagePattern":"failed to run (.+?): %w \\(out=%#q\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/driver/qemu/entitlementutil/entitlementutil.go","lineNumber":27,"sourceCode":"\t\"fmt\"\n\t\"os\"\n\t\"os/exec\"\n\t\"strings\"\n\n\t\"github.com/mattn/go-isatty\"\n\t\"github.com/sirupsen/logrus\"\n\n\t\"github.com/lima-vm/lima/v2/pkg/uiutil\"\n)\n\n// IsSigned returns an error if the binary is not signed, or the sign is invalid,\n// or not associated with the \"com.apple.security.hypervisor\" entitlement.\nfunc IsSigned(ctx context.Context, qExe string) error {\n\tcmd := exec.CommandContext(ctx, \"codesign\", \"--verify\", qExe)\n\tout, err := cmd.CombinedOutput()\n\tlogrus.WithError(err).Debugf(\"Executed %v: out=%#q\", cmd.Args, string(out))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to run %v: %w (out=%#q)\", cmd.Args, err, string(out))\n\t}\n\n\tcmd = exec.CommandContext(ctx, \"codesign\", \"--display\", \"--entitlements\", \"-\", \"--xml\", qExe)\n\tout, err = cmd.CombinedOutput()\n\tlogrus.WithError(err).Debugf(\"Executed %v: out=%#q\", cmd.Args, string(out))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to run %v: %w (out=%#q)\", cmd.Args, err, string(out))\n\t}\n\tif !strings.Contains(string(out), \"com.apple.security.hypervisor\") {\n\t\treturn fmt.Errorf(\"binary %#q seems signed but lacking the `com.apple.security.hypervisor` entitlement\", qExe)\n\t}\n\treturn nil\n}\n\nfunc Sign(ctx context.Context, qExe string) error {\n\tent, err := os.CreateTemp(\"\", \"lima-qemu-entitlements-*.xml\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create a temporary file for signing QEMU binary: %w\", err)","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/lima-vm/lima/blob/dd909d0973cd84fa35f9e1693181b4585ea616c1/pkg/driver/qemu/entitlementutil/entitlementutil.go#L9-L45","documentation":"IsSigned verifies a QEMU binary's code signature by running Apple's `codesign --verify`. If codesign itself fails to execute or reports the binary invalid, the error is wrapped as `failed to run %v: %w (out=%#q)` including the command args and combined output, so the caller (AskToSignIfNotSignedProperly) can prompt re-signing.","triggerScenarios":"Running `codesign --verify <qemu-binary>` on macOS where the binary is unsigned, ad-hoc signed, or its signature was invalidated by modification; codesign missing/failing.","commonSituations":"Self-built QEMU without signing; a qemu binary modified by an antivirus or download tool that stripped signatures; Homebrew upgrades leaving stale binaries; macOS Gatekeeper requirements.","solutions":["Let Lima re-sign the binary: it calls Sign automatically via AskToSignIfNotSignedProperly — accept the prompt and authenticate","Manually sign: `codesign --entitlements - --force --sign - <qemu-binary>` with the hypervisor entitlement","Reinstall QEMU (`brew reinstall qemu`) to get an intact signed binary"],"exampleFix":"// before (manual, broken)\ncodesign --verify /opt/homebrew/bin/qemu-system-aarch64  # fails\n// after\nsudo codesign --entitlements lima-entitlements.xml --force --sign - /opt/homebrew/bin/qemu-system-aarch64","handlingStrategy":"try-catch","validationCode":"out, err := exec.Command(\"codesign\", \"--verify\", qemuExe).CombinedOutput()\nsigned := err == nil","typeGuard":"func isCodesignErr(err error) bool { return strings.Contains(err.Error(), \"failed to run\") }","tryCatchPattern":"err := qemu.AskToSignIfNotSignedProperly(ctx, qemuExe)\nif err != nil {\n    log.Printf(\"codesign failed: %v; re-sign manually with hypervisor entitlement\", err)\n}","preventionTips":["Reinstall QEMU after OS upgrades","Avoid modifying qemu binaries in place","Run `codesign --verify` after installing custom QEMU builds"],"tags":["macos","qemu","codesign","entitlement"],"backgroundTag":"codesign-verification-failed","analyzedSha":"dd909d0973cd84fa35f9e1693181b4585ea616c1","analyzedAt":"2026-09-01T14:24:59.842Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}