macOS 27: install-auto fails every start (kbnm blocked by System Policy browser-data protection, cli symlink, --uninstall-cli crash), misleading error dialog

Aperta
  • Qualcosa non va?
#29,864 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
15/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
go, macos
Ambito
cli, desktop, operating-systems

Direzione di ricerca

The issue covers four separate macOS install failures. Start in go/kbnm/installer/installer.go, where KnownInstallers() is looped over without browser detection, and in go/install/install_darwin.go installCommandLine, where os.Symlink has no fallback; the KBCommandLine uninstall: crash lives in the Objective-C osx/KBKit code. Done means maintainers have agreed on scope for each part (kbnm, cli symlink, uninstall crash, kbfuse support), since the kbfuse part needs a product decision and is not a first-timer task.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Environment

  • Keybase 6.6.3 (6.6.3-20260603142618+f60f2ff97e)
  • macOS 27.0.1 (26A434), Apple Silicon, clean install
  • Chrome not installed; Firefox installed; /usr/local/bin does not exist (stock macOS)

1. kbnm install fails on every startup — macOS 27 browser-data protection

keybase install-auto / keybase install --components=kbnm fails with:

mkdir /Users/<user>/Library/Application Support/Google/Chrome: operation not permitted

and the GUI shows a "Keybase Install Error" dialog at every app start. macOS 27 protects Chrome's data directory at the kernel level from any app other than Chrome itself:

kernel (Sandbox) System Policy: mkdir deny(1) file-write-create /Users/<user>/Library/Application Support/Google/Chrome

The dialog's suggested fix (sudo chown -R ...) cannot work — the denial is System Policy, not ownership; even mkdir by the directory owner fails. Reproduction: mkdir "$HOME/Library/Application Support/Google/Chrome" fails for any process; mkdir Chrome2 in the same parent succeeds.

go/kbnm/installer/installer.go unconditionally loops over all KnownInstallers() (chrome, chromium, firefox) with no browser detection — the failure happens even though Chrome is not installed — and there is no config toggle to disable the kbnm component. Workaround we used: set KBNM_INSTALL_OVERLAY to redirect manifest writes. Note master already retired the browser extension (go/install/legacy_kbnm_darwin.go cleanup) — a release shipping that removal would fix this.

2. cli component always fails on clean macOS; privileged installer never creates the symlink

install-auto reports:

symlink .../Keybase.app/Contents/SharedSupport/bin/keybase /usr/local/bin/keybase: no such file or directory

go/install/install_darwin.go installCommandLine calls os.Symlink unprivileged with no fallback, which fails when /usr/local/bin doesn't exist (and the dir is root-owned anyway). Meanwhile the privileged installer frontend (KBCommandLine refreshComponent, osx/KBKit) considers the CLI installed whenever /etc/paths.d/Keybase exists (etcPathsExists short-circuit), so KeybaseInstaller --install-cli is a no-op and never creates the symlink. Result: another recurring install-error dialog.

3. KeybaseInstaller --uninstall-cli crashes

*** Terminating app due to uncaught exception 'NSInvalidArgumentException',
    reason: '*** -[__NSPlaceholderDictionary initWithObjects:forKeys:count:]: attempt to insert nil object from objects[1]'
	... -[KBCommandLine uninstall:]

Reproducible on demand (/Applications/Keybase.app/Contents/Resources/KeybaseInstaller.app/Contents/MacOS/Keybase --uninstall-cli ...), which makes cleaning up the CLI install impossible.

4. kbfuse has no kext for current macOS

kbfuse.bundle only ships Extensions/12/kbfuse.kext (macOS 12). KBFuseComponent looks for Extensions/<major>.<minor>/kbfuse.kext, so on macOS 27 the fuse component can never succeed; it reports only exit status 1 with no actionable message. KBFS mounting is therefore impossible on current macOS.

Related issues (similar symptoms, different root cause): #28376, #28375 (CLI installed into /usr/local/bin on Apple Silicon), #24469 (CLI didn't install, undiagnosed), #25503 (recurring install errors, undiagnosed).

Suggested fixes

  • Skip kbnm for browsers that aren't installed and/or handle EPERM gracefully; ship the browser-extension retirement already on master.
  • Have the privileged helper create /usr/local/bin + symlinks when missing, or make the unprivileged cli check mirror KBCommandLine's etcPathsExists so it doesn't error.
  • Fix the -[KBCommandLine uninstall:] nil-dictionary crash.
  • State clearly whether kbfuse/KBFS mounting is supported on modern macOS, and improve the fuse error message.

Additional numbers
The number 345567

(Supersedes #29863, which was auto-closed by the anti-spam workflow because this template marker was missing.)

Lingua principale
Go
Stelle
9.3k
Fork
1.3k
Merge medio
1g 2h
PR unite (30g)
99

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di keybase/client

Tutte le issue di keybase/client

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.