lima-vm/lima · error

failed to run %v: %w (out=%#q)

Error message

failed to run %v: %w (out=%#q)

What it means

IsSigned verifies a QEMU binary's code signature by running Apple's `codesign --verify`. If codesign itself fails to execute or reports the binary invalid, the error is wrapped as `failed to run %v: %w (out=%#q)` including the command args and combined output, so the caller (AskToSignIfNotSignedProperly) can prompt re-signing.

Source

Thrown at pkg/driver/qemu/entitlementutil/entitlementutil.go:27

	"fmt"
	"os"
	"os/exec"
	"strings"

	"github.com/mattn/go-isatty"
	"github.com/sirupsen/logrus"

	"github.com/lima-vm/lima/v2/pkg/uiutil"
)

// IsSigned returns an error if the binary is not signed, or the sign is invalid,
// or not associated with the "com.apple.security.hypervisor" entitlement.
func IsSigned(ctx context.Context, qExe string) error {
	cmd := exec.CommandContext(ctx, "codesign", "--verify", qExe)
	out, err := cmd.CombinedOutput()
	logrus.WithError(err).Debugf("Executed %v: out=%#q", cmd.Args, string(out))
	if err != nil {
		return fmt.Errorf("failed to run %v: %w (out=%#q)", cmd.Args, err, string(out))
	}

	cmd = exec.CommandContext(ctx, "codesign", "--display", "--entitlements", "-", "--xml", qExe)
	out, err = cmd.CombinedOutput()
	logrus.WithError(err).Debugf("Executed %v: out=%#q", cmd.Args, string(out))
	if err != nil {
		return fmt.Errorf("failed to run %v: %w (out=%#q)", cmd.Args, err, string(out))
	}
	if !strings.Contains(string(out), "com.apple.security.hypervisor") {
		return fmt.Errorf("binary %#q seems signed but lacking the `com.apple.security.hypervisor` entitlement", qExe)
	}
	return nil
}

func Sign(ctx context.Context, qExe string) error {
	ent, err := os.CreateTemp("", "lima-qemu-entitlements-*.xml")
	if err != nil {
		return fmt.Errorf("failed to create a temporary file for signing QEMU binary: %w", err)

View on GitHub (pinned to dd909d0973)

Solutions

1. Let Lima re-sign the binary: it calls Sign automatically via AskToSignIfNotSignedProperly — accept the prompt and authenticate
2. Manually sign: `codesign --entitlements - --force --sign - <qemu-binary>` with the hypervisor entitlement
3. Reinstall QEMU (`brew reinstall qemu`) to get an intact signed binary

Example fix

// before (manual, broken)
codesign --verify /opt/homebrew/bin/qemu-system-aarch64  # fails
// after
sudo codesign --entitlements lima-entitlements.xml --force --sign - /opt/homebrew/bin/qemu-system-aarch64

out, err := exec.Command("codesign", "--verify", qemuExe).CombinedOutput()
signed := err == nil

func isCodesignErr(err error) bool { return strings.Contains(err.Error(), "failed to run") }

err := qemu.AskToSignIfNotSignedProperly(ctx, qemuExe)
if err != nil {
    log.Printf("codesign failed: %v; re-sign manually with hypervisor entitlement", err)
}

When it happens

Trigger: Running `codesign --verify <qemu-binary>` on macOS where the binary is unsigned, ad-hoc signed, or its signature was invalidated by modification; codesign missing/failing.

Common situations: Self-built QEMU without signing; a qemu binary modified by an antivirus or download tool that stripped signatures; Homebrew upgrades leaving stale binaries; macOS Gatekeeper requirements.

Related errors

• binary %#q seems signed but lacking the `com.apple.security.
• failed to create a temporary file for signing QEMU binary: %
• field `mountType` must be %#q or %#q for QEMU driver on macO
• failed to create temp file: %w
• failed to write temp plist: %w

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/fb9c95e8ef08455d. Report an issue: GitHub.