macOS 27: install-auto fails every start (kbnm blocked by System Policy browser-data protection, cli symlink, --uninstall-cli crash), misleading error dialog

Abierto
  • ¿Algo no está bien?
#29,864 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
15/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
go, macos
Área
cli, desktop, operating-systems

Línea de trabajo

The issue covers four separate macOS install failures. Start in go/kbnm/installer/installer.go, where KnownInstallers() is looped over without browser detection, and in go/install/install_darwin.go installCommandLine, where os.Symlink has no fallback; the KBCommandLine uninstall: crash lives in the Objective-C osx/KBKit code. Done means maintainers have agreed on scope for each part (kbnm, cli symlink, uninstall crash, kbfuse support), since the kbfuse part needs a product decision and is not a first-timer task.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Environment

  • Keybase 6.6.3 (6.6.3-20260603142618+f60f2ff97e)
  • macOS 27.0.1 (26A434), Apple Silicon, clean install
  • Chrome not installed; Firefox installed; /usr/local/bin does not exist (stock macOS)

1. kbnm install fails on every startup — macOS 27 browser-data protection

keybase install-auto / keybase install --components=kbnm fails with:

mkdir /Users/<user>/Library/Application Support/Google/Chrome: operation not permitted

and the GUI shows a "Keybase Install Error" dialog at every app start. macOS 27 protects Chrome's data directory at the kernel level from any app other than Chrome itself:

kernel (Sandbox) System Policy: mkdir deny(1) file-write-create /Users/<user>/Library/Application Support/Google/Chrome

The dialog's suggested fix (sudo chown -R ...) cannot work — the denial is System Policy, not ownership; even mkdir by the directory owner fails. Reproduction: mkdir "$HOME/Library/Application Support/Google/Chrome" fails for any process; mkdir Chrome2 in the same parent succeeds.

go/kbnm/installer/installer.go unconditionally loops over all KnownInstallers() (chrome, chromium, firefox) with no browser detection — the failure happens even though Chrome is not installed — and there is no config toggle to disable the kbnm component. Workaround we used: set KBNM_INSTALL_OVERLAY to redirect manifest writes. Note master already retired the browser extension (go/install/legacy_kbnm_darwin.go cleanup) — a release shipping that removal would fix this.

2. cli component always fails on clean macOS; privileged installer never creates the symlink

install-auto reports:

symlink .../Keybase.app/Contents/SharedSupport/bin/keybase /usr/local/bin/keybase: no such file or directory

go/install/install_darwin.go installCommandLine calls os.Symlink unprivileged with no fallback, which fails when /usr/local/bin doesn't exist (and the dir is root-owned anyway). Meanwhile the privileged installer frontend (KBCommandLine refreshComponent, osx/KBKit) considers the CLI installed whenever /etc/paths.d/Keybase exists (etcPathsExists short-circuit), so KeybaseInstaller --install-cli is a no-op and never creates the symlink. Result: another recurring install-error dialog.

3. KeybaseInstaller --uninstall-cli crashes

*** Terminating app due to uncaught exception 'NSInvalidArgumentException',
    reason: '*** -[__NSPlaceholderDictionary initWithObjects:forKeys:count:]: attempt to insert nil object from objects[1]'
	... -[KBCommandLine uninstall:]

Reproducible on demand (/Applications/Keybase.app/Contents/Resources/KeybaseInstaller.app/Contents/MacOS/Keybase --uninstall-cli ...), which makes cleaning up the CLI install impossible.

4. kbfuse has no kext for current macOS

kbfuse.bundle only ships Extensions/12/kbfuse.kext (macOS 12). KBFuseComponent looks for Extensions/<major>.<minor>/kbfuse.kext, so on macOS 27 the fuse component can never succeed; it reports only exit status 1 with no actionable message. KBFS mounting is therefore impossible on current macOS.

Related issues (similar symptoms, different root cause): #28376, #28375 (CLI installed into /usr/local/bin on Apple Silicon), #24469 (CLI didn't install, undiagnosed), #25503 (recurring install errors, undiagnosed).

Suggested fixes

  • Skip kbnm for browsers that aren't installed and/or handle EPERM gracefully; ship the browser-extension retirement already on master.
  • Have the privileged helper create /usr/local/bin + symlinks when missing, or make the unprivileged cli check mirror KBCommandLine's etcPathsExists so it doesn't error.
  • Fix the -[KBCommandLine uninstall:] nil-dictionary crash.
  • State clearly whether kbfuse/KBFS mounting is supported on modern macOS, and improve the fuse error message.

Additional numbers
The number 345567

(Supersedes #29863, which was auto-closed by the anti-spam workflow because this template marker was missing.)

Lenguaje dominante
Go
Estrellas
9.3k
Forks
1.3k
Merge medio
1 d 2 h
PR fusionados (30 d)
99

Preparar el entorno

  • Incluye un Dockerfile o un archivo de Docker Compose
  • Sin plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de keybase/client

Todos los issues de keybase/client

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.