macOS 27: install-auto fails every start (kbnm blocked by System Policy browser-data protection, cli symlink, --uninstall-cli crash), misleading error dialog

オープン
  • 何か問題がありますか？
#29,864 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
15/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
go, macos
領域
cli, desktop, operating-systems

調査の方向性

The issue covers four separate macOS install failures. Start in go/kbnm/installer/installer.go, where KnownInstallers() is looped over without browser detection, and in go/install/install_darwin.go installCommandLine, where os.Symlink has no fallback; the KBCommandLine uninstall: crash lives in the Objective-C osx/KBKit code. Done means maintainers have agreed on scope for each part (kbnm, cli symlink, uninstall crash, kbfuse support), since the kbfuse part needs a product decision and is not a first-timer task.

索引モデルが issue の本文から書いたものです。

説明

Environment

  • Keybase 6.6.3 (6.6.3-20260603142618+f60f2ff97e)
  • macOS 27.0.1 (26A434), Apple Silicon, clean install
  • Chrome not installed; Firefox installed; /usr/local/bin does not exist (stock macOS)

1. kbnm install fails on every startup — macOS 27 browser-data protection

keybase install-auto / keybase install --components=kbnm fails with:

mkdir /Users/<user>/Library/Application Support/Google/Chrome: operation not permitted

and the GUI shows a "Keybase Install Error" dialog at every app start. macOS 27 protects Chrome's data directory at the kernel level from any app other than Chrome itself:

kernel (Sandbox) System Policy: mkdir deny(1) file-write-create /Users/<user>/Library/Application Support/Google/Chrome

The dialog's suggested fix (sudo chown -R ...) cannot work — the denial is System Policy, not ownership; even mkdir by the directory owner fails. Reproduction: mkdir "$HOME/Library/Application Support/Google/Chrome" fails for any process; mkdir Chrome2 in the same parent succeeds.

go/kbnm/installer/installer.go unconditionally loops over all KnownInstallers() (chrome, chromium, firefox) with no browser detection — the failure happens even though Chrome is not installed — and there is no config toggle to disable the kbnm component. Workaround we used: set KBNM_INSTALL_OVERLAY to redirect manifest writes. Note master already retired the browser extension (go/install/legacy_kbnm_darwin.go cleanup) — a release shipping that removal would fix this.

2. cli component always fails on clean macOS; privileged installer never creates the symlink

install-auto reports:

symlink .../Keybase.app/Contents/SharedSupport/bin/keybase /usr/local/bin/keybase: no such file or directory

go/install/install_darwin.go installCommandLine calls os.Symlink unprivileged with no fallback, which fails when /usr/local/bin doesn't exist (and the dir is root-owned anyway). Meanwhile the privileged installer frontend (KBCommandLine refreshComponent, osx/KBKit) considers the CLI installed whenever /etc/paths.d/Keybase exists (etcPathsExists short-circuit), so KeybaseInstaller --install-cli is a no-op and never creates the symlink. Result: another recurring install-error dialog.

3. KeybaseInstaller --uninstall-cli crashes

*** Terminating app due to uncaught exception 'NSInvalidArgumentException',
    reason: '*** -[__NSPlaceholderDictionary initWithObjects:forKeys:count:]: attempt to insert nil object from objects[1]'
	... -[KBCommandLine uninstall:]

Reproducible on demand (/Applications/Keybase.app/Contents/Resources/KeybaseInstaller.app/Contents/MacOS/Keybase --uninstall-cli ...), which makes cleaning up the CLI install impossible.

4. kbfuse has no kext for current macOS

kbfuse.bundle only ships Extensions/12/kbfuse.kext (macOS 12). KBFuseComponent looks for Extensions/<major>.<minor>/kbfuse.kext, so on macOS 27 the fuse component can never succeed; it reports only exit status 1 with no actionable message. KBFS mounting is therefore impossible on current macOS.

Related issues (similar symptoms, different root cause): #28376, #28375 (CLI installed into /usr/local/bin on Apple Silicon), #24469 (CLI didn't install, undiagnosed), #25503 (recurring install errors, undiagnosed).

Suggested fixes

  • Skip kbnm for browsers that aren't installed and/or handle EPERM gracefully; ship the browser-extension retirement already on master.
  • Have the privileged helper create /usr/local/bin + symlinks when missing, or make the unprivileged cli check mirror KBCommandLine's etcPathsExists so it doesn't error.
  • Fix the -[KBCommandLine uninstall:] nil-dictionary crash.
  • State clearly whether kbfuse/KBFS mounting is supported on modern macOS, and improve the fuse error message.

Additional numbers
The number 345567

(Supersedes #29863, which was auto-closed by the anti-spam workflow because this template marker was missing.)

主要言語
Go
スター
9.3k
フォーク
1.3k
平均マージ
1日 2時間
マージ済み PR（30日）
99

環境構築

  • Dockerfile または Docker Compose ファイルあり
  • プルリクエストのテンプレートなし
  • コントリビューションガイドなし

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

keybase/client のほかの issue

keybase/client の issue をすべて見る

似ている issue

Go の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。