crypto/x509: crash on macOS Tahoe 26

[IngmarStein]

Go version

1.25.1

Output of go env in your module/workspace:

AR='ar'
CC='cc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='c++'
GCCGO='gccgo'
GO111MODULE=''
GOARCH='arm64'
GOARM64='v8.0'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/Users/ingmar/Library/Caches/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/Users/ingmar/Library/Application Support/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -arch arm64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -ffile-prefix-map=/var/folders/zg/y0p1ngj577q93l548v3tvzv00000gn/T/go-build1685181133=/tmp/go-build -gno-record-gcc-switches -fno-common'
GOHOSTARCH='arm64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMOD='/dev/null'
GOMODCACHE='/Users/ingmar/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='darwin'
GOPATH='/Users/ingmar/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/opt/homebrew/Cellar/go/1.25.1/libexec'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/Users/ingmar/Library/Application Support/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/opt/homebrew/Cellar/go/1.25.1/libexec/pkg/tool/darwin_arm64'
GOVCS=''
GOVERSION='go1.25.1'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

I made an HTTP request to a server using TLSv1.3.

What did you see happen?

The process crashes with the following trace:

goroutine 19 gp=0x14000296540 m=4 mp=0x14000100008 [syscall]:
crypto/x509/internal/macos.syscall(0x0?, 0x0?, 0x1400014f0c8?, 0x10a59de14?, 0x10b2c4e00?, 0x0?, 0xeb1e1bf80?)
	runtime/sys_darwin.go:142 +0x44 fp=0x1400014f050 sp=0x1400014efb0 pc=0x10a3beb64
crypto/x509/internal/macos.SecTrustEvaluateWithError(0x1400003d0a0?)
	crypto/x509/internal/macos/security.go:112 +0x48 fp=0x1400014f0d0 sp=0x1400014f050 pc=0x10a592748
crypto/x509.(*Certificate).systemVerify(0x14000176008, 0x1400014f588)
	crypto/x509/root_darwin.go:62 +0x210 fp=0x1400014f380 sp=0x1400014f0d0 pc=0x10a59de20
crypto/x509.(*Certificate).Verify(0x14000176008, {{0x1400003d0a0, 0x19}, 0x1400011eb10, 0x0, {0xc22f523d6b80fa68, 0x1ef2c7d, 0x10b2c4e00}, {0x0, 0x0, ...}, ...})
	crypto/x509/verify.go:802 +0x3d0 fp=0x1400014f580 sp=0x1400014f380 pc=0x10a5a1410
crypto/tls.(*Conn).verifyServerCertificate(0x14000124008, {0x14000119bc0, 0x3, 0x4})
	crypto/tls/handshake_client.go:1171 +0x744 fp=0x1400014f810 sp=0x1400014f580 pc=0x10a5c1594
crypto/tls.(*clientHandshakeStateTLS13).readServerCertificate(0x1400014fc20)
	crypto/tls/handshake_client_tls13.go:659 +0x220 fp=0x1400014fa30 sp=0x1400014f810 pc=0x10a5c5330
crypto/tls.(*clientHandshakeStateTLS13).handshake(0x1400014fc20)
	crypto/tls/handshake_client_tls13.go:137 +0x694 fp=0x1400014faf0 sp=0x1400014fa30 pc=0x10a5c2834
crypto/tls.(*Conn).clientHandshake(0x14000124008, {0x10adc70a0, 0x1400012c000})
	crypto/tls/handshake_client.go:367 +0x5e0 fp=0x1400014fd10 sp=0x1400014faf0 pc=0x10a5bd650
crypto/tls.(*Conn).clientHandshake-fm({0x10adc70a0?, 0x1400012c000?})
	<autogenerated>:1 +0x3c fp=0x1400014fd40 sp=0x1400014fd10 pc=0x10a5e1d3c
crypto/tls.(*Conn).handshakeContext(0x14000124008, {0x10adc70a0, 0x140002e0aa0})
	crypto/tls/conn.go:1575 +0x2d4 fp=0x1400014ff60 sp=0x1400014fd40 pc=0x10a5b8b04
crypto/tls.(*Conn).HandshakeContext(...)
	crypto/tls/conn.go:1515
net/http.(*persistConn).addTLS.func2()
	net/http/transport.go:1703 +0x60 fp=0x1400014ffd0 sp=0x1400014ff60 pc=0x10a627170
runtime.goexit({})
	runtime/asm_arm64.s:1268 +0x4 fp=0x1400014ffd0 sp=0x1400014ffd0 pc=0x10a3c2d84
created by net/http.(*persistConn).addTLS in goroutine 9
	net/http/transport.go:1699 +0x260

What did you expect to see?

I would expect no crashes.

Interestingly, /System/Library/Frameworks/Security.framework/Versions/A/Security doesn't exist in this OS version:

❯ l /System/Library/Frameworks/Security.framework/Versions/A
total 0
drwxr-xr-x   7 root  wheel   224B Sep 20 06:46 ./
drwxr-xr-x   4 root  wheel   128B Sep 20 06:46 ../
drwxr-xr-x   4 root  wheel   128B Sep 20 06:46 MachServices/
drwxr-xr-x   3 root  wheel    96B Sep 20 06:46 PlugIns/
drwxr-xr-x  79 root  wheel   2.5K Sep 20 06:46 Resources/
drwxr-xr-x   8 root  wheel   256B Sep 20 06:46 XPCServices/
drwxr-xr-x   3 root  wheel    96B Sep 20 06:46 _CodeSignature/

❯ sw_vers
ProductName:		macOS
ProductVersion:		26.0.1
BuildVersion:		25A362

[gabyhelp]

Related Issues

• crypto/x509: possible crash on macOS 10.13 (in `SecTrustEvaluateWithError`) #52112 (closed)
• crypto/x509: macos 10.14 SIGSEGV in crypto/x509._Cfunc_FetchPEMRoots #28092 (closed)
• crypto/x509: Certificate.Verify crash on macOS with Go 1.18 #51759 (closed)
• crypto/x509: SIGILL illegal instruction on result of `go install` #53841
• crypto/x509: crash and spurious errors in `(*Certificate).Verify` on macOS when argv[0] contains `//../` #61000 (closed)
• crypto/x509: SecPolicyCreateSSL returns null when binary is called with strange path #54590 (closed)
• crypto/x509: FetchPEMRoots in CGO crashed with signal SIGSEGV when using http.Client.Do() on https URL #30889 (closed)
• crypto/x509: frequent panics when doing HTTPS requests on Darwin #30763 (closed)
• crypto/x509: panic during tls handshake from http client #70374 (closed)
• crypto/x509: FetchPEMRoots in CGO crashed with signal SIGSEGV on go get gopkg.in/sourcemap.v1 on macOS Sierra (10.12.6) #24190 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[cagedmantis]

@FiloSottile @rolandshoemaker @cpu @golang/security

[IngmarStein]

I am unable to write a minimal repro, so I'm closing this issue.
It might rather be a crash inside SecTrustEvaluateWithError() triggered by a previous fork() as Tahoe made many more APIs fork-unsafe and this has plagued several projects in the Python ecosystem already (crashed on child side of fork pre-exec).

The absence of /System/Library/Frameworks/Security.framework/Versions/A/Security looks like a red herring as this was already the case with Sequoia (I still wonder why the current //go:cgo_import_dynamic x509_SecTrustEvaluateWithError SecTrustEvaluateWithError "/System/Library/Frameworks/Security.framework/Versions/A/Security" works).