NEPacketTunnelProvider stopped connecting on arm macOS 14 during tests

I have tests where I connect to NEPacketTunnelProvider. I run tests with circleci and fastlane, on self hosted intel and arm macs. I updated macs from macOS 13 to macOS 14 and the tests on arm stopped connecting, while the same tests on intel kept working as usual. Moreover, I noticed the tests don't work when run from circleci and fastlane. If I cancel the job and click "connect" myself on the app that stayed hanging from the cancelled tests, the connection will succeed. But if the tests are running, the connection will fails. Running the tests from xcode succeeds too.

These are the logs from the tunnel. Could you suggest me where to dig? Or maybe you can see the issue from the logs?

default	04:43:01.817189-0800	Tunnel Provider macos	Extension `/Users/appnametest/Library/Developer/Xcode/DerivedData/Appname-eckyfmuqhcosnvfzelyaaanuauvp/Build/Products/Debug Dev/Appname Dev.app/Contents/PlugIns/Tunnel Provider macos.appex/Contents/MacOS/Tunnel Provider macos` of type: `(null)` launched.
default	04:43:01.818162-0800	Tunnel Provider macos	Hello, I'm launching as euid = 502, uid = 502, personaid = 1002, type = DEFAULT, name = 
default	04:43:01.819300-0800	Tunnel Provider macos	[0x12de094d0] activating connection: mach=true listener=false peer=false name=com.apple.***.mapdb
default	04:43:01.823781-0800	Tunnel Provider macos	[0x12f10b900] activating connection: mach=true listener=false peer=false name=com.apple.cfprefsd.daemon
default	04:43:01.823940-0800	Tunnel Provider macos	[0x12f00a3d0] activating connection: mach=true listener=false peer=false name=com.apple.cfprefsd.agent
default	04:43:01.827033-0800	Tunnel Provider macos	Initializing connection
default	04:43:01.827133-0800	Tunnel Provider macos	Removing all cached process handles
default	04:43:01.827188-0800	Tunnel Provider macos	Sending handshake request attempt #1 to server
default	04:43:01.827227-0800	Tunnel Provider macos	Creating connection to com.apple.runningboard
default	04:43:01.827258-0800	Tunnel Provider macos	[0x12f00a670] activating connection: mach=true listener=false peer=false name=com.apple.runningboard
default	04:43:01.828461-0800	Tunnel Provider macos	Handshake succeeded
default	04:43:01.828505-0800	Tunnel Provider macos	Identity resolved as xpcservice:75118:75118])(502)>{vt hash: 0}
default	04:43:01.828669-0800	Tunnel Provider macos	Class EXGetExtensionContextVendorClass(void) returning EXConcreteExtensionContextVendor
default	04:43:01.828747-0800	Tunnel Provider macos	[0x12df08e50] activating connection: mach=true listener=true peer=false name=com.appname.macos.dev.tunnelprovider.apple-extension-service
default	04:43:01.828859-0800	Tunnel Provider macos	Scheduling launchd after initial event
error	04:43:01.829471-0800	Tunnel Provider macos	Bootstrapping; external subsystem UIKit_PKSubsystem refused setup
default	04:43:01.829533-0800	Tunnel Provider macos	Bootstrapping; Bootstrap complete. Ready for handshake from host.
default	04:43:01.829977-0800	Tunnel Provider macos	[0x12f10a390] activating connection: mach=false listener=true peer=false name=com.appname.macos.dev.tunnelprovider
default	04:43:01.833136-0800	Tunnel Provider macos	[0x11de041f0] activating connection: mach=false listener=false peer=true name=com.appname.macos.dev.tunnelprovider.peer[75118].0x11de041f0
default	04:43:01.833362-0800	Tunnel Provider macos	[u C1C896AD-F2E6-41C1-B92F-C4F46275DAAF] [(null)((null))] Prepare received as euid = 502, uid = 502, personaid = 1002, type = DEFAULT, name = 
default	04:43:01.834849-0800	Tunnel Provider macos	[u BA642764-CE6B-4A1E-B5C8-9E991862E47B] [()] Set sole personality.
default	04:43:01.835426-0800	Tunnel Provider macos	[u BA642764-CE6B-4A1E-B5C8-9E991862E47B] [()] Begin using received as euid = 502, uid = 502, personaid = 1002, type = DEFAULT, name = 
default	04:43:01.839637-0800	Tunnel Provider macos	[0x11de05390] activating connection: mach=false listener=false peer=true name=com.appname.macos.dev.tunnelprovider.apple-extension-service.peer[75118].0x11de05390
default	04:43:01.840107-0800	Tunnel Provider macos	Class EXGetExtensionContextInternalClass(void) returning EXExtensionContextImplementation
default	04:43:01.840275-0800	Tunnel Provider macos	[0x11de086c0] activating connection: mach=false listener=false peer=false name=(anonymous)
error	04:43:01.842688-0800	Tunnel Provider macos	cannot open file at line 49295 of [1b37c146ee]
error	04:43:01.842705-0800	Tunnel Provider macos	os_unix.c:49295: (2) open(/private/var/db/DetachedSignatures) - No such file or directory
default	04:43:01.844389-0800	Tunnel Provider macos	[0x11f00a500] activating connection: mach=true listener=false peer=false name=com.apple.analyticsd
default	04:43:01.845031-0800	Tunnel Provider macos	Enabling System Keychain Always due to platform
default	04:43:01.845159-0800	Tunnel Provider macos	[0x11f00a9b0] activating connection: mach=true listener=false peer=false name=com.apple.trustd.agent
default	04:43:01.850975-0800	Tunnel Provider macos	Signature check failed: code failed to satisfy specified code requirement(s)
default	04:43:01.852055-0800	Tunnel Provider macos	networkd_settings_read_from_file initialized networkd settings by reading plist directly
default	04:43:01.852257-0800	Tunnel Provider macos	networkd_settings_read_from_file initialized networkd settings by reading plist directly
default	04:43:01.852722-0800	Tunnel Provider macos	nw_path_evaluator_start [8B250AD6-2A65-47C4-B714-2B1C825F20BD  generic, attribution: developer]
	path: satisfied (Path is satisfied), interface: en0, ipv4, dns
default	04:43:01.853090-0800	Tunnel Provider macos	in _willPerformHostCallback: block ( UUID: F0B70307-DB1A-49B5-8E62-6D982DDB10EC error: (null) )
default	04:43:01.871692-0800	Tunnel Provider macos	Using interface name utun4
default	04:43:01.871752-0800	Tunnel Provider macos	Created a new NEVirtualInterface "utun4" from socket
default	04:43:01.895925-0800	Tunnel Provider macos	Tearing down utun4
default	04:43:01.896254-0800	Tunnel Provider macos	Tearing down utun4
error	04:43:01.896281-0800	Tunnel Provider macos	SIOCGIFMTU failed: Device not configured
error	04:43:01.896298-0800	Tunnel Provider macos	NEVirtualInterfaceAdjustReadBufferSize: interface_get_mtu failed (6), defaulting to max mtu
default	04:43:01.896347-0800	Tunnel Provider macos	preparing to call _completeRequestReturningItems:forExtensionContextWithUUID: UUID: F0B70307-DB1A-49B5-8E62-6D982DDB10EC
default	04:43:01.896981-0800	Tunnel Provider macos	call _completeRequestReturningItems:forExtensionContextWithUUID:
default	04:43:01.908981-0800	Tunnel Provider macos	calling out to _completeRequestReturningItemsSecondHalf
default	04:43:01.909075-0800	Tunnel Provider macos	in _NSExtensionCompleteRequestReturningItemsContinuation
default	04:43:01.910443-0800	Tunnel Provider macos	[0x11de086c0] Re-initialization successful; calling out to event handler with XPC_ERROR_CONNECTION_INTERRUPTED
default	04:43:01.918309-0800	Tunnel Provider macos	[0x11de086c0] invalidated because the current process cancelled the connection by calling xpc_connection_cancel()
default	04:43:01.918365-0800	Tunnel Provider macos	[0x11de05390] invalidated after getting a no-senders notification - client is gone
default	04:43:01.919981-0800	Tunnel Provider macos	[Extension com.appname.macos.dev.tunnelprovider]: Deallocating
default	04:43:02.232431-0800	Tunnel Provider macos	Received configuration update from daemon (initial)
default	04:43:07.258668-0800	Tunnel Provider macos	[u BA642764-CE6B-4A1E-B5C8-9E991862E47B] [()] Removed sole personality.
default	04:43:07.259027-0800	Tunnel Provider macos	[0x11de041f0] invalidated after getting a no-senders notification - client is gone
default	04:43:07.259098-0800	Tunnel Provider macos	[u BA642764-CE6B-4A1E-B5C8-9E991862E47B] [()] host connection from pid 75118 invalidated

I suspect that this is relevant:

Signature check failed: code failed to satisfy specified code requirement(s)

NE is trying to verify a designated requirement (DR) and that’s failing. This usually means that the code is built incorrectly, so that version N+1 doesn’t satisfy the DR recorded for version N. I talk about requirements, and how macOS uses DRs, in some detail in TN3127 Inside Code Signing: Requirements.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

NEPacketTunnelProvider stopped connecting on arm macOS 14 during tests
 
 
Q