Repository navigation
Build sandbox denies mach-lookup to com.apple.trustd, so system trust evaluation fails in source builds (OSStatus -26276) #24124
Description
brew doctor output
Warning: Calling the `verified` parameter in the `url` stanza is deprecated! Use the default URL verification behaviour instead.
Please report this issue to the aws/homebrew-aws tap (not Homebrew/* repositories), or even better, submit a PR to fix it:
/opt/homebrew/Library/Taps/aws/homebrew-aws/Casks/amazon-ssm-agent.rb:27
Warning: Calling `preflight` is deprecated! Use `preflight_steps` instead.
Please report this issue to the aws/homebrew-aws tap (not Homebrew/* repositories), or even better, submit a PR to fix it:
/opt/homebrew/Library/Taps/aws/homebrew-aws/Casks/amazon-ssm-agent.rb:64
Warning: Calling `uninstall_preflight` is deprecated! Use `uninstall_preflight_steps` instead.
Please report this issue to the aws/homebrew-aws tap (not Homebrew/* repositories), or even better, submit a PR to fix it:
/opt/homebrew/Library/Taps/aws/homebrew-aws/Casks/amazon-ssm-agent.rb:68
Warning: Calling the `verified` parameter in the `url` stanza is deprecated! Use the default URL verification behaviour instead.
Please report this issue to the aws/homebrew-aws tap (not Homebrew/* repositories), or even better, submit a PR to fix it:
/opt/homebrew/Library/Taps/aws/homebrew-aws/Casks/ec2-instance-connect.rb:21
Warning: Calling `uninstall_preflight` is deprecated! Use `uninstall_preflight_steps` instead.
Please report this issue to the aws/homebrew-aws tap (not Homebrew/* repositories), or even better, submit a PR to fix it:
/opt/homebrew/Library/Taps/aws/homebrew-aws/Casks/ec2-instance-connect.rb:48
Warning: Calling the `verified` parameter in the `url` stanza is deprecated! Use the default URL verification behaviour instead.
Please report this issue to the aws/homebrew-aws tap (not Homebrew/* repositories), or even better, submit a PR to fix it:
/opt/homebrew/Library/Taps/aws/homebrew-aws/Casks/ec2-macos-init.rb:21
Warning: Calling the `verified` parameter in the `url` stanza is deprecated! Use the default URL verification behaviour instead.
Please report this issue to the aws/homebrew-aws tap (not Homebrew/* repositories), or even better, submit a PR to fix it:
/opt/homebrew/Library/Taps/aws/homebrew-aws/Casks/ec2-macos-system-monitor.rb:22
Warning: Calling `uninstall_postflight` is deprecated! Use `uninstall_postflight_steps` instead.
Please report this issue to the aws/homebrew-aws tap (not Homebrew/* repositories), or even better, submit a PR to fix it:
/opt/homebrew/Library/Taps/aws/homebrew-aws/Casks/ec2-macos-system-monitor.rb:30
Warning: Calling the `verified` parameter in the `url` stanza is deprecated! Use the default URL verification behaviour instead.
Please report this issue to the aws/homebrew-aws tap (not Homebrew/* repositories), or even better, submit a PR to fix it:
/opt/homebrew/Library/Taps/aws/homebrew-aws/Casks/ec2-macos-utils.rb:21
Your system is ready to brew.Verification
- I ran
brew updatetwice and am still able to reproduce my issue. - I have supplied my
brew doctoroutput above and it seems unrelated to my issue. - This issue's title and/or description do not reference a single formula e.g.
brew install wget. If they do, open an issue at https://github.com/Homebrew/homebrew-core/issues/new/choose instead. - I did not use AI/LLM to create this issue, or I disclosed the tool and model used; I will answer maintainer questions myself without AI/LLM.
brew config output
HOMEBREW_VERSION: 7.0.7
ORIGIN: https://github.com/Homebrew/brew
HEAD: 8e858db5584704dcd469b8e826228c0d5a5a94f6
Last commit: 2 days ago
Branch: stable
Core tap: N/A
Core cask tap: N/A
HOMEBREW_PREFIX: /opt/homebrew
Homebrew Ruby: 4.0.7 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/4.0.7/bin/ruby
CPU: 14-core 64-bit arm_brava
Clang: 21.0.0 build 2100
Git: 2.54.0 => /Library/Developer/CommandLineTools/usr/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 27.0-arm64
CLT: 27.0.0.0.1788430756
Xcode: N/A
Rosetta 2: falseWhat were you trying to do (and why)?
Build Python formulae from source on macOS with Homebrew 7. Any formula that installs sdist resources (pip's PEP 517 build isolation fetches the build backend, e.g. setuptools or hatchling, from pypi.org mid-build) fails inside the build sandbox with OSStatus -26276. Bottled installs are unaffected. Unbottled or --build-from-source installs are broken for every user on Homebrew 7.
-26276 is errSecInternalComponent: SecTrustEvaluate cannot reach the trust daemon over Mach IPC.
Ask: add com.apple.trustd to the build sandbox's mach-lookup allowlist in Library/Homebrew/extend/os/mac/sandbox.rb, so sandboxed builds can evaluate TLS trust against the system certificate store. Happy to send the one-line PR.
If the omission is intentional (build reproducibility, restricting builds to the user trust store), what is the supported pattern for formulae whose builds need system trust evaluation?
What happened (include all command output)?
All runs below are on the same host: Homebrew 7.0.7, macOS 27.0, arm64 (the brew config above), unless stated otherwise.
1. Plain install of an unbottled third-party formula fails. No flags. aws/aws/amazon-efs-utils has no bottle, so brew install is always a source build:
$ brew tap aws/aws
$ brew install amazon-efs-utils
==> Installing amazon-efs-utils from aws/aws
WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError('OSStatus -26276'))': /simple/setuptools/
Could not fetch URL https://pypi.org/simple/setuptools/: There was a problem confirming the ssl certificate: ('OSStatus -26276',) - skipping
ERROR: Could not find a version that satisfies the requirement setuptools>=40.8.0 (from versions: none)
ERROR: No matching distribution found for setuptools>=40.8.0
Installing build dependencies: finished with status 'error'
ERROR: Failed to build 'file:///private/tmp/s-nuIusD2K/amazon-efs-utils--atomicwrites-20260929-26463-ao1vcc/atomicwrites-1.4.1' when installing build dependencies
Error: aws/aws/amazon-efs-utils: Failure while executing; `/usr/bin/sandbox-exec -p \(version\ 1\)' ...
2. homebrew-core formulae fail the same way when built from source:
$ brew install --build-from-source pipx
==> Installing pipx
WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError('OSStatus -26276'))': /simple/hatchling/
Could not fetch URL https://pypi.org/simple/hatchling/: There was a problem confirming the ssl certificate: ('OSStatus -26276',) - skipping
ERROR: Could not find a version that satisfies the requirement hatchling (from versions: none)
ERROR: Failed to build ... when installing build dependencies
Error: pipx: Failure while executing; `/usr/bin/sandbox-exec -p \(version\ 1\)' ...
Same failure on Homebrew 7.0.2 (macOS 27.0) and 7.0.4 (macOS 15.8), pipx and awscurl:
$ brew install --build-from-source awscurl
==> Installing awscurl
WARNING: Retrying (Retry(total=0, ...)) after connection broken by 'SSLError(SSLCertVerificationError('OSStatus -26276'))': /simple/setuptools/
ERROR: Could not find a version that satisfies the requirement setuptools>=75.3.1 (from versions: none)
ERROR: Failed to build 'file:///private/tmp/s-8KkGL7EL/awscurl--awscrt-20260918-53302-i3122c/awscrt-0.34.1' when installing build dependencies
3. Control: the bottle path on the same host is fine (no build sandbox involved):
$ brew install pipx
==> Downloading bottle manifests
==> Pouring pipx--1.17.7.arm64_golden_gate.bottle.tar.gz
🍺 /opt/homebrew/Cellar/pipx/1.17.7: 215 files, 2.2MB
4. Control: Homebrew 6.0.22 on the same machine, before brew update, the identical amazon-efs-utils source build succeeds:
==> Installing aws/aws/amazon-efs-utils
🍺 /opt/homebrew/Cellar/amazon-efs-utils/2.4.2: 2,701 files, 121.8MB, built in 1 minute 10 seconds
So the trigger is "source build inside the Homebrew 7 sandbox", not --build-from-source and not any one formula.
Analysis
The mach-lookup default-deny was added in 0190b03 "Refine macOS service policy". The allowlist (current master, L51-L54) includes com.apple.SecurityServer, com.apple.ocspd and com.apple.trustd.agent, so certificate checking looks intended to work in the sandbox. But com.apple.trustd.agent is the per-user daemon and covers the user certificate store only. The system daemon com.apple.trustd, which holds the system store and is what these TLS checks reach, is not on the list:
$ launchctl print system | grep trustd
627 - com.apple.trustd
0x12003 M A com.apple.trustd
$ launchctl print gui/$UID | grep trustd
0x48203 M A com.apple.trustd.agent
Minimal repro with no Homebrew involved, denying only com.apple.trustd on an otherwise allow-all profile:
$ sandbox-exec -p '(version 1)(allow default)(deny mach-lookup (global-name "com.apple.trustd"))' \
python3 -m pip download setuptools -d /tmp/pp --no-cache-dir
WARNING: Retrying (Retry(total=4, ...)) after connection broken by 'SSLError(SSLCertVerificationError('OSStatus -26276'))': /simple/setuptools/
WARNING: Retrying (Retry(total=3, ...)) after connection broken by 'SSLError(SSLCertVerificationError('OSStatus -26276'))': /simple/setuptools/
...
Control, same command, no sandbox:
$ python3 -m pip download setuptools -d /tmp/pp --no-cache-dir
Saved /private/tmp/pp/setuptools-84.0.0-py3-none-any.whl
Successfully downloaded setuptools
Fix direction: stock Homebrew 7.0.2 with only (global-name "com.apple.trustd") added to the allowlist, unmodified amazon-efs-utils formula, the source build completes:
==> Installing aws/aws/amazon-efs-utils
🍺 /opt/homebrew/Cellar/amazon-efs-utils/2.4.2: 2,701 files, 121.8MB, built in 1 minute 12 seconds
Reproduced on six macOS hosts across 15.8 / 26.7 / 27.0 (arm64), Homebrew 7.0.2 / 7.0.4 / 7.0.7. End users hit it too (aws/efs-utils#377 is a user report of the same failure on a fresh EC2 Mac instance). Full logs available on request.
What did you expect to happen?
Source builds inside the Homebrew sandbox can evaluate TLS trust against the macOS system certificate store, as they do on Homebrew 6.0.22, and pip's build-isolation fetch of build backends from pypi.org succeeds.
Step-by-step reproduction instructions (running brew commands)
brew update && brew update
# unbottled formula, plain install:
brew tap aws/aws
brew install amazon-efs-utils
# homebrew-core formulae, forced source build:
brew install --build-from-source pipx
brew install --build-from-source awscurl
# control, bottle path on the same host:
brew install pipx
# minimal, no Homebrew:
sandbox-exec -p '(version 1)(allow default)(deny mach-lookup (global-name "com.apple.trustd"))' \
python3 -m pip download setuptools -d /tmp/pp --no-cache-dir
Activity
sandbox: allow system trust evaluation online