sql.Register("sqlite3_with_extensions",
&sqlite3.SQLiteDriver{
Extensions: []string{
"regex_match",
},
})
I am working on loading an SQLite3 extension in Go, specifically using the sqlite3.SQLiteDriver to register the extension "regex_match". However, when I run the program, I encounter the error: "dlopen(regex_match.dylib, 0x000A): tried: 'regex_match.dylib' (relative path not allowed in hardened program), '/usr/lib/regex_match.dylib' (no such file)]."
This error typically occurs on systems where security features, such as macOS' App Sandbox or Hardened Runtime, are enabled. These features prevent the use of relative paths when loading external resources like libraries or extensions. So I did sign and notarized my dylib even after that my other binary which contains above code is giving error.
Other solutions also I tried
1.setting environment variable for this dylib.
2.tried signed and unsigned binary FYI my binary is also signed and both dylib and binary are signed with same certificate.
3.Gave full disk access to both my binary and regex_match.dylib.
I'm looking for guidance on how to properly load the SQLite3 extension while adhering to system security requirements.
Update -
Go lang package used- "github.com/mattn/go-sqlite3"
Reference link - https://pkg.go.dev/github.com/mattn/go-sqlite3
Platform - Darwin.
.dylbthat it'sdarwin—i.e. macos). Since we're forced to guess, I guess thesql.Registercode, when told to load "named extensions"—such as thatregex_match—tries to load a dynamically-linked library with that name (plus platform-dependent filename extension). It tries two places: the current working directory and/usr/lib, and both tries fail with different errors, which the driver communicates to you. …go-sqlite3directly callssqlite3_load_extensionwhich is documented in a somewhat moot manner, but you can see how it's implemented in the SQLite's source code (sqlite3LoadExtensioninternal function), and that one first attempt to load the extension "as is"—treating it as a file name. Given that, it should suffice to change"regex_match"in your code to the full pathname of thatregex_match.dyldfile.