oven-sh/bun · warning

Failed to load Security framework: %s\n

Error message

Failed to load Security framework: %s\n

What it means

After loading CoreFoundation, the same loader dlopens the Security framework (kSecTrustSettings APIs). On failure it prints this diagnostic with dlerror() detail, closes the already-opened CoreFoundation handle, resets state, and returns false so certificate loading can fall back. Like error 74 it is a non-fatal diagnostic on a path that normally always succeeds on macOS.

Source

Thrown at packages/bun-usockets/src/crypto/root_certs_darwin.cpp:153

        if (cf_handle) {
            dlclose(cf_handle);
        }
    }

    bool load() {
        if (handle && cf_handle) return true; // Already loaded

        // Load CoreFoundation framework
        cf_handle = dlopen("/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation", RTLD_LAZY | RTLD_LOCAL);
        if (!cf_handle) {
            fprintf(stderr, "Failed to load CoreFoundation framework: %s\n", dlerror());
            return false;
        }

        // Load Security framework
        handle = dlopen("/System/Library/Frameworks/Security.framework/Security", RTLD_LAZY | RTLD_LOCAL);
        if (!handle) {
            fprintf(stderr, "Failed to load Security framework: %s\n", dlerror());
            dlclose(cf_handle);
            cf_handle = nullptr;
            return false;
        }

        // Load function pointers first — load_constants() needs
        // CFStringCreateWithCString to materialize the kSecTrustSettings* keys.
        if (!load_functions()) {
            if (handle) {
                dlclose(handle);
                handle = nullptr;
            }
            if (cf_handle) {
                dlclose(cf_handle);
                cf_handle = nullptr;
            }
            return false;
        }

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Verify TLS connections still succeed — the fallback root store is usually sufficient
2. Read the dlerror() suffix for the exact OS error (e.g. symbol not found vs permission)
3. Confirm the binary matches the platform and the OS is intact (softwareupdate --history / reinstall)
4. Adjust sandbox policy to allow /System/Library/Frameworks/Security.framework

const fs = require('node:fs');
if (process.platform === 'darwin' && !fs.existsSync('/System/Library/Frameworks/Security.framework/Security')) {
  console.warn('Security framework unavailable — system trust settings will not be read');
}

When it happens

Trigger: Sandbox/container restrictions blocking dlopen of Security.framework; System Integrity Protection anomalies; truncated or replaced system frameworks; running the darwin build outside a real macOS userspace.

Common situations: Unusual hardened execution environments; broken macOS installs; test harnesses that stub out system frameworks.

Related errors

• Failed to load CoreFoundation framework: %s\n
• UNABLE_TO_GET_ISSUER_CERT
• UNABLE_TO_GET_CRL
• UNABLE_TO_DECRYPT_CERT_SIGNATURE
• UNABLE_TO_DECRYPT_CRL_SIGNATURE

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/9b71747cf64702e7. Report an issue: GitHub.