tools-only macOS arm64e Workaround
Methods for building CodeQL databases on macOS Apple Silicon when the arm64e/arm64 architecture mismatch causes SIGKILL (exit code 137) during build tracing.
Use when IS_MACOS_ARM64E=true (detected in build-database workflow Step 2a). These replace Methods 1 and 2 on affected systems.
The strategy is to use Homebrew-installed tools (plain arm64, not arm64e) so libtrace.dylib can be injected successfully. Try sub-methods in order:
Sub-method 2m-a: Homebrew clang/gcc with multi-step tracing
Trace only the compiler invocations individually, avoiding system tools (/usr/bin/ar, /bin/mkdir) that would be killed. This requires a multi-step build: init → trace each compiler call → finalize.
log_step "METHOD 2m-a: macOS arm64 — Homebrew compiler with multi-step tracing"
# 1. Find Homebrew C/C++ compiler (arm64, not arm64e)
BREW_CC=""
# Prefer Homebrew clang
if [ -x "/opt/homebrew/opt/llvm/bin/clang" ]; then
BREW_CC="/opt/homebrew/opt/llvm/bin/clang"
# Try Homebrew GCC (e.g. gcc-14, gcc-13)
elif command -v gcc-14 >/dev/null 2>&1; then
BREW_CC="$(command -v gcc-14)"
elif command -v gcc-13 >/dev/null 2>&1; then
BREW_CC="$(command -v gcc-13)"
fi
if [ -z "$BREW_CC" ]; then
log_result "No Homebrew C/C++ compiler found — skipping 2m-a"
# Fall through to 2m-b
else
# Verify it's arm64 (not arm64e)
BREW_CC_ARCH=$(lipo -archs "$BREW_CC" 2>/dev/null)
if [[ "$BREW_CC_ARCH" == *"arm64e"* ]]; then
log_result "Homebrew compiler is arm64e — skipping 2m-a"
else
log_step "Using Homebrew compiler: $BREW_CC (arch: $BREW_CC_ARCH)"
# 2. Run the build normally (without tracing) to create build dirs and artifacts
# Use Homebrew make (gmake) if available, otherwise system make outside tracer
if command -v gmake >/dev/null 2>&1; then
MAKE_CMD="gmake"
else
MAKE_CMD="make"
fi
$MAKE_CMD clean 2>/dev/null || true
$MAKE_CMD CC="$BREW_CC" 2>&1 | tee -a "$LOG_FILE"
# 3. Extract compiler commands from the Makefile / build system
# Use make's dry-run mode to get the exact compiler invocations
$MAKE_CMD clean 2>/dev/null || true
COMPILE_CMDS=$($MAKE_CMD CC="$BREW_CC" --dry-run 2>/dev/null \
| grep -E "^\s*$BREW_CC\b.*\s-c\s" \
| sed 's/^[[:space:]]*//')
if [ -z "$COMPILE_CMDS" ]; then
log_result "Could not extract compile commands from dry-run — skipping 2m-a"
else
# 4. Init database
codeql database init $DB_NAME --language=cpp --source-root=. --overwrite 2>&1 \
| tee -a "$LOG_FILE"
# 5. Ensure build directories exist (outside tracer — avoids arm64e mkdir)
$MAKE_CMD clean 2>/dev/null || true
# Parse -o flags to find output dirs, or just create common dirs
echo "$COMPILE_CMDS" | sed -n 's/.*-o[[:space:]]\{1,\}\([^[:space:]]\{1,\}\).*/\1/p' | xargs -I{} dirname {} \
| sort -u | xargs mkdir -p 2>/dev/null || true
# 6. Trace each compiler invocation individually
TRACE_OK=true
while IFS= read -r cmd; do
[ -z "$cmd" ] && continue
log_cmd "codeql database trace-command $DB_NAME -- $cmd"
if ! codeql database trace-command $DB_NAME -- $cmd 2>&1 | tee -a "$LOG_FILE"; then
log_result "FAILED on: $cmd"
TRACE_OK=false
break
fi
done <<< "$COMPILE_CMDS"
if $TRACE_OK; then
# 7. Finalize
codeql database finalize $DB_NAME 2>&1 | tee -a "$LOG_FILE"
if codeql resolve database -- "$DB_NAME" >/dev/null 2>&1; then
log_result "SUCCESS (macOS arm64 multi-step)"
# Done — skip to Step 4
else
log_result "FAILED (finalize failed)"
fi
fi
fi
fi
fi
Sub-method 2m-b: Rosetta x86_64 emulation
Force the entire CodeQL pipeline to run under Rosetta, which uses the x86_64 slice of both libtrace.dylib and system tools — no arm64e mismatch.
log_step "METHOD 2m-b: macOS arm64 — Rosetta x86_64 emulation"
# Check if Rosetta is available
if ! arch -x86_64 /usr/bin/true 2>/dev/null; then
log_result "Rosetta not available — skipping 2m-b"
else
BUILD_CMD="<BUILD_CMD>" # e.g. "make clean && make -j4"
CMD="arch -x86_64 codeql database create $DB_NAME --language=$CODEQL_LANG --source-root=. --command='$BUILD_CMD' --overwrite"
log_cmd "$CMD"
arch -x86_64 codeql database create $DB_NAME --language=$CODEQL_LANG --source-root=. \
--command="$BUILD_CMD" --overwrite 2>&1 | tee -a "$LOG_FILE"
if codeql resolve database -- "$DB_NAME" >/dev/null 2>&1; then
log_result "SUCCESS (Rosetta x86_64)"
else
log_result "FAILED (Rosetta)"
fi
fi
Sub-method 2m-c: System compiler (direct attempt)
As a verification step, try the standard autobuild with the system compiler. This will likely fail with exit code 137 on affected systems, but confirms the arm64e issue is the cause.
This sub-method is optional. Skip it if arm64e incompatibility was already confirmed in Step 2a.
log_step "METHOD 2m-c: System compiler (expected to fail on arm64e)"
CMD="codeql database create $DB_NAME --language=$CODEQL_LANG --source-root=. --overwrite"
log_cmd "$CMD"
$CMD 2>&1 | tee -a "$LOG_FILE"
EXIT_CODE=$?
if [ $EXIT_CODE -eq 137 ] || [ $EXIT_CODE -eq 134 ]; then
log_result "FAILED: exit code $EXIT_CODE confirms arm64e/libtrace incompatibility"
elif codeql resolve database -- "$DB_NAME" >/dev/null 2>&1; then
log_result "SUCCESS (unexpected — system compiler worked)"
else
log_result "FAILED (exit code: $EXIT_CODE)"
fi
Sub-method 2m-d: Ask user
If all macOS workarounds fail, present options:
AskUserQuestion:
header: "macOS Build"
question: "Build tracing failed due to macOS arm64e incompatibility. How to proceed?"
multiSelect: false
options:
- label: "Use build-mode=none (Recommended)"
description: "Source-level analysis only. Misses some interprocedural data flow but catches most C/C++ vulnerabilities (format strings, buffer overflows, unsafe functions)."
- label: "Install arm64 tools and retry"
description: "Run: brew install llvm make — then retry with Homebrew toolchain"
- label: "Install Rosetta and retry"
description: "Run: softwareupdate --install-rosetta — then retry under x86_64 emulation"
- label: "Abort"
description: "Stop database creation"
If "Use build-mode=none": Proceed to Method 4.
If "Install arm64 tools and retry":
log_step "Installing Homebrew arm64 toolchain"
brew install llvm make 2>&1 | tee -a "$LOG_FILE"
# Retry Sub-method 2m-a
If "Install Rosetta and retry":
log_step "Installing Rosetta"
softwareupdate --install-rosetta --agree-to-license 2>&1 | tee -a "$LOG_FILE"
# Retry Sub-method 2m-b