mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-10 23:49:09 +02:00
riccardom
8224e0f7bf
The collector that answers certificate posture challenges allows one collection at a time, and the latch guarding that is released by the goroutine running the collection, not by the caller that gave up waiting for it. The collection is therefore assumed to end. On macOS and Windows it reads the signed-in user's certificates through a helper process, and there the assumption does not hold. Wait blocks on the output pipe rather than on the process, and killing the process we launched does not close the pipe its own children inherited: on macOS we launch launchctl, which launches sudo, which launches the helper, so the deadline reaps launchctl and leaves the other two holding the pipe open. A helper stuck on a keychain prompt is enough. Wait then never returns, the latch stays set, and the peer sends no proof again for the life of the daemon. It fails every certificate check and loses the policies that carry one, logging a single line per sync and nothing else. Set a wait delay so Wait closes the pipes itself once the process is gone. The run fails rather than reporting proofs, which is what we want: the output was cut short, so there is nothing trustworthy to report.