What causes "code signing requirement failed" in gravitational/teleport?

Re-sign the daemon/app bundle so it matches the required code signing identity (Developer ID with correct team/identifier requirements).

gravitational/teleport · error

code signing requirement failed

Error message

code signing requirement failed

What it means

errXPCConnectionCodeSigningRequirementFailure (lib/vnet/daemon/common_darwin.go:60) maps NSXPCConnectionCodeSigningRequirementFailure from NSCocoaErrorDomain. macOS failed to verify the daemon against the code signing requirement the client specified when connecting over XPC.

Source

Thrown at lib/vnet/daemon/common_darwin.go:60

	errAlreadyRunning       = errors.New("VNet is already running")

	// errorCodeMissingCodeSigningIdentifiers is returned within [vnetErrorDomain] Obj-C errors and
	// transformed to [errMissingCodeSigningIdentifiers] in Go.
	errorCodeMissingCodeSigningIdentifiers = int(C.VNEMissingCodeSigningIdentifiersError)
	errMissingCodeSigningIdentifiers       = errors.New("either identifier or team identifier is missing in code signing information; is the binary signed?")
)

var (
	// nsCocoaErrorDomain is a generic error domain used in a lot of Apple's Cocoa frameworks.
	nsCocoaErrorDomain = "NSCocoaErrorDomain"

	// https://developer.apple.com/documentation/foundation/nsxpcconnectioninterrupted-swift.var
	errorCodeNSXPCConnectionInterrupted = int(C.NSXPCConnectionInterrupted)
	errXPCConnectionInterrupted         = errors.New("XPC connection interrupted")

	// https://developer.apple.com/documentation/foundation/nsxpcconnectioncodesigningrequirementfailure-swift.var
	errorCodeNSXPCConnectionCodeSigningRequirementFailure = int(C.NSXPCConnectionCodeSigningRequirementFailure)
	errXPCConnectionCodeSigningRequirementFailure         = errors.New("code signing requirement failed")

	// https://developer.apple.com/documentation/foundation/nsxpcconnectioninvalid-swift.var
	errorCodeNSXPCConnectionInvalid = int(C.NSXPCConnectionInvalid)
	errXPCConnectionInvalid         = errors.New("XPC connection invalid")
)

func DaemonLabel() (string, error) {
	path, err := darwinbundle.Path()
	if err != nil {
		return "", trace.Wrap(err)
	}

	cPath := C.CString(path)
	defer C.free(unsafe.Pointer(cPath))

	cLabel := C.DaemonLabel(cPath)
	defer C.free(unsafe.Pointer(cLabel))

View on GitHub (pinned to 1283425b60)

Solutions

Re-sign the daemon/app bundle so it matches the required code signing identity (Developer ID with correct team/identifier requirements).
Verify the daemon stays alive after launch: check its logs and fix any immediate startup failure (e.g. permissions on TELEPORT_HOME) so macOS can finish signature verification.
Inspect Console.app logs for code signing verification errors and correct the requirement or the binary's signature accordingly.

Example fix

// before: TELEPORT_HOME unreadable by the daemon -> daemon exits before verification
export TELEPORT_HOME=/root/.tsh
// after: use a home dir the current user (and daemon) can access
export TELEPORT_HOME=$HOME/.tsh

Defensive patterns

Strategy: validation

Validate before calling

// ensure TELEPORT_HOME is accessible and binary signature matches requirement before start
if fi, err := os.Stat(os.Getenv("TELEPORT_HOME")); err != nil || !fi.IsDir() {
    return errors.New("TELEPORT_HOME is missing or inaccessible to the daemon")
}
out, _ := exec.Command("codesign", "-v", bundlePath).CombinedOutput()
if len(out) != 0 {
    return fmt.Errorf("bundle signature invalid: %s", out)
}

Try / catch

if err := client.RegisterAndCall(ctx, bundlePath, cfg); err != nil {
    if errors.Is(err, vnetdaemon.ErrXPCConnectionCodeSigningRequirementFailure) {
        // either re-sign the daemon, or fix whatever made it exit before verification
    }
    return trace.Wrap(err)
}

Prevention

Sign the daemon bundle with the exact identity the client's code signing requirement expects.
Never point TELEPORT_HOME at a directory the daemon cannot access — the daemon may exit before macOS verifies its signature.
Check Console.app for signing verification errors after any re-sign or bundle change.

When it happens

Trigger: startByCalling receives NSCocoaErrorDomain/NSXPCConnectionCodeSigningRequirementFailure. Two documented causes: (1) the daemon binary is not signed to match the requirement, or (2) the daemon shut down immediately after starting (e.g. TELEPORT_HOME points to a path the daemon cannot access), so macOS never had time to verify its signature.

Common situations: Unsigned or re-signed dev daemon builds; a modified/replaced binary invalidating the signature; daemon crashing on startup so signature verification never completes; using a TELEPORT_HOME owned by another user.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/e36dcbb2ec9a811a. Report an issue: GitHub.