claude-code - 💡(How to fix) Fix Sandbox breaks TLS for Go binaries using macOS Security.framework (gh, brew, etc.) [1 comments, 2 participants]

$ gh auth status
Get "https://api.github.com/user": tls: failed to verify certificate: x509: OSStatus -26276

OSStatus -26276 is errSecInvalidCertAuthority — the Security.framework cannot verify the certificate chain, likely because the sandbox restricts keychain or Security.framework API access.

TL;DR

The issue can be mitigated by using curl directly against APIs or waiting for a fix in a future Claude Code version that restores proper TLS certificate verification for Go binaries using the macOS Security.framework.

Guidance

• The root cause is likely the sandbox in Claude Code v2.1.107 restricting keychain or Security.framework API access, which breaks TLS certificate verification for Go binaries.
• To verify the issue, run gh auth status or other gh commands within the Claude Code sandbox and observe the TLS failure.
• As a temporary workaround, use curl directly against GitHub APIs for tasks that would otherwise fail with gh.
• Consider downgrading Claude Code to a version prior to v2.1.107 if possible, to restore functionality until a fix is released.

Example

No code snippet is provided as the issue is related to the interaction between Claude Code, Go binaries, and the macOS Security.framework, and does not involve user-modifiable code.

Notes

The provided workaround using curl is limited and may not cover all use cases where gh or similar tools are used. The issue seems specific to the combination of Claude Code v2.1.107 and Go binaries that use the macOS Security.framework for TLS.

Recommendation

Apply the workaround using curl for critical tasks until a fixed version of Claude Code is released that properly handles TLS certificate verification for Go binaries using the Security.framework.