gravitational/teleport · error

either identifier or team identifier is missing in code sign

Error message

either identifier or team identifier is missing in code signing information; is the binary signed?

What it means

errMissingCodeSigningIdentifiers is declared in lib/vnet/daemon/common_darwin.go:47. The daemon validates the code signing information of the connecting client; if neither the identifier nor the team identifier is present in the client binary's signature, it fails the request with VNEErrorDomain/VNEMissingCodeSigningIdentifiersError, which both the daemon (service_darwin.go:61) and client (client_darwin.go:289) map to this sentinel.

Source

Thrown at lib/vnet/daemon/common_darwin.go:47

	"github.com/gravitational/trace"

	"github.com/gravitational/teleport/lib/utils/darwinbundle"
)

var (
	// vnetErrorDomain is a custom error domain used for Objective-C errors that pertain to VNet.
	vnetErrorDomain = C.GoString(C.VNEErrorDomain)

	// errorCodeAlreadyRunning is returned within [vnetErrorDomain] errors to indicate that the daemon
	// received a message to start after it was already running.
	errorCodeAlreadyRunning = int(C.VNEAlreadyRunningError)
	errAlreadyRunning       = errors.New("VNet is already running")

	// errorCodeMissingCodeSigningIdentifiers is returned within [vnetErrorDomain] Obj-C errors and
	// transformed to [errMissingCodeSigningIdentifiers] in Go.
	errorCodeMissingCodeSigningIdentifiers = int(C.VNEMissingCodeSigningIdentifiersError)
	errMissingCodeSigningIdentifiers       = errors.New("either identifier or team identifier is missing in code signing information; is the binary signed?")
)

var (
	// nsCocoaErrorDomain is a generic error domain used in a lot of Apple's Cocoa frameworks.
	nsCocoaErrorDomain = "NSCocoaErrorDomain"

	// https://developer.apple.com/documentation/foundation/nsxpcconnectioninterrupted-swift.var
	errorCodeNSXPCConnectionInterrupted = int(C.NSXPCConnectionInterrupted)
	errXPCConnectionInterrupted         = errors.New("XPC connection interrupted")

	// https://developer.apple.com/documentation/foundation/nsxpcconnectioncodesigningrequirementfailure-swift.var
	errorCodeNSXPCConnectionCodeSigningRequirementFailure = int(C.NSXPCConnectionCodeSigningRequirementFailure)
	errXPCConnectionCodeSigningRequirementFailure         = errors.New("code signing requirement failed")

	// https://developer.apple.com/documentation/foundation/nsxpcconnectioninvalid-swift.var
	errorCodeNSXPCConnectionInvalid = int(C.NSXPCConnectionInvalid)
	errXPCConnectionInvalid         = errors.New("XPC connection invalid")
)

View on GitHub (pinned to 1283425b60)

Solutions

1. Sign the binary and app bundle properly: codesign with an explicit --identifier and a Developer ID team identifier (codesign --sign 'Developer ID Application: ...' --identifier <bundle-id>).
2. Verify the signature: codesign -dv --verbose=4 <binary> and confirm Identifier and TeamIdentifier are present.
3. Use an officially signed tsh release build instead of a locally built unsigned binary.

Example fix

// before: ad-hoc, unsigned build
 codesign -s - tsh
// after: sign with identifier and team identifier
codesign --force --sign "Developer ID Application: Acme (TEAMID1234)" --identifier com.goteleport.tsh tsh

out, err := exec.Command("codesign", "-dv", binaryPath).CombinedOutput()
if err != nil || !strings.Contains(string(out), "TeamIdentifier") {
    return errors.New("binary lacks code signing identifier/team identifier; sign it with codesign")
}

if err := daemon.Start(ctx); err != nil {
    if errors.Is(err, vnetdaemon.ErrMissingCodeSigningIdentifiers) {
        return trace.Wrap(err, "re-sign the binary with an identifier and team identifier")
    }
    return trace.Wrap(err)
}

When it happens

Trigger: Calling Start or RegisterAndCall when the tsh binary (or daemon bundle) is unsigned, or signed with ad-hoc signing that carries no identifier/team identifier, so the daemon cannot verify the peer's code signing identity.

Common situations: Building tsh from source with only ad-hoc signing (go build without codesign --identifier/--team); running an unsigned dev binary; macOS security requirements where the daemon enforces a code signing requirement on XPC peers.

Related errors

• code signing requirement failed
• VNet is already running
• XPC connection interrupted
• XPC connection invalid
• the background item was not enabled within the timeout

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/ebc83bdec41be311. Report an issue: GitHub.