oven-sh/bun · warning

Failed to load CoreFoundation framework: %s\n

Error message

Failed to load CoreFoundation framework: %s\n

What it means

On macOS, the root-certificate loader in bun-usockets dynamically opens CoreFoundation via dlopen to support reading system trust settings. If that dlopen fails, it prints this diagnostic (with dlerror() detail) to stderr and load() returns false so the caller can fall back to another certificate source. On a healthy macOS install this essentially never fails.

Source

Thrown at packages/bun-usockets/src/crypto/root_certs_darwin.cpp:146

            if (kSecTrustSettingsPolicy) CFRelease(kSecTrustSettingsPolicy);
            if (kSecTrustSettingsPolicyString) CFRelease(kSecTrustSettingsPolicyString);
            if (kSecTrustSettingsResult) CFRelease(kSecTrustSettingsResult);
        }
        if (handle) {
            dlclose(handle);
        }
        if (cf_handle) {
            dlclose(cf_handle);
        }
    }

    bool load() {
        if (handle && cf_handle) return true; // Already loaded

        // Load CoreFoundation framework
        cf_handle = dlopen("/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation", RTLD_LAZY | RTLD_LOCAL);
        if (!cf_handle) {
            fprintf(stderr, "Failed to load CoreFoundation framework: %s\n", dlerror());
            return false;
        }

        // Load Security framework
        handle = dlopen("/System/Library/Frameworks/Security.framework/Security", RTLD_LAZY | RTLD_LOCAL);
        if (!handle) {
            fprintf(stderr, "Failed to load Security framework: %s\n", dlerror());
            dlclose(cf_handle);
            cf_handle = nullptr;
            return false;
        }

        // Load function pointers first — load_constants() needs
        // CFStringCreateWithCString to materialize the kSecTrustSettings* keys.
        if (!load_functions()) {
            if (handle) {
                dlclose(handle);
                handle = nullptr;

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Treat it as a warning: the library falls back to bundled/alternative roots; verify TLS still works
2. Check the dlerror() text printed after the message for the concrete reason
3. Run on a genuine, intact macOS install (repair disk/permissions via Recovery if frameworks are damaged)
4. Loosen sandbox rules to permit reading /System/Library/Frameworks

const fs = require('node:fs');
if (process.platform === 'darwin' && !fs.existsSync('/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation')) {
  console.warn('system frameworks unavailable — expect bundled root cert fallback');
}

When it happens

Trigger: Running under a sandbox/seccomp/container that blocks dlopen of system frameworks; a corrupted system framework; running the darwin binary on a non-macOS or heavily stripped environment (jailbreak-ish/hackintosh edge cases).

Common situations: Hardened sandboxes (custom seatbelt profiles), CI containers misreporting the platform, or damaged OS installs after failed updates.

Related errors

• Failed to load Security framework: %s\n
• UNABLE_TO_GET_ISSUER_CERT
• UNABLE_TO_GET_CRL
• UNABLE_TO_DECRYPT_CERT_SIGNATURE
• UNABLE_TO_DECRYPT_CRL_SIGNATURE

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/b38694eebe1fcbea. Report an issue: GitHub.