<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Oct 28, 2018, at 2:27 AM, Ronald Oussoren <<a href="mailto:ronaldoussoren@mac.com" class="">ronaldoussoren@mac.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><blockquote type="cite" style="font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">On 28 Oct 2018, at 06:27, Glyph <<a href="mailto:glyph@twistedmatrix.com" class="">glyph@twistedmatrix.com</a>> wrote:<br class=""><br class="">I adjusted my code-signing to use the new, stricter requirements imposed by app notarization. I managed to get it successfully notarized, but the app is now non-functional as a result: at startup, I get:<br class=""><br class="">Traceback (most recent call last):<br class=""> File "my.app/Contents/Resources/__boot__.py", line 93, in <module><br class=""> _setup_ctypes()<br class=""> File "my.app/Contents/Resources/__boot__.py", line 86, in _setup_ctypes<br class=""> from ctypes.macholib import dyld<br class=""> File "<frozen importlib._bootstrap>", line 971, in _find_and_load<br class=""> File "<frozen importlib._bootstrap>", line 955, in _find_and_load_unlocked<br class=""> File "<frozen importlib._bootstrap>", line 656, in _load_unlocked<br class=""> File "<frozen importlib._bootstrap>", line 626, in _load_backward_compatible<br class=""> File "ctypes/__init__.pyc", line 538, in <module><br class=""> File "ctypes/__init__.pyc", line 273, in _reset_cache<br class=""><br class="">(If anyone wants to follow along in the traceback, this is using <a href="http://python.org" class="">python.org</a> 3.6.6.)<br class=""></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">On what version of macOS? I expect 10.14 because that’s the only release that actually knows about notarization, but enabling this feature might also affect how the app is signed.</span></div></blockquote><div><br class=""></div><div><div>ProductName:<span class="Apple-tab-span" style="white-space:pre"> </span>Mac OS X</div><div>ProductVersion:<span class="Apple-tab-span" style="white-space:pre"> </span>10.14</div><div>BuildVersion:<span class="Apple-tab-span" style="white-space:pre"> </span>18A391</div></div><br class=""><blockquote type="cite" class=""><div class=""><blockquote type="cite" style="font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">This happens before any of my code even runs, so I can't just try to avoid ctypes.<br class=""></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">You could patch the __boot__.py file before signing to see if that helps. Although this should cause problems further on, the call to _setup_ctypes should only be created when some code in your app bundle has a dependency on ctypes.<span class="Apple-converted-space"> </span></span><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""></div></blockquote><div><br class=""></div><div>I'll give that a shot.</div><br class=""><blockquote type="cite" class=""><div class=""><blockquote type="cite" style="font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br class="">Curiously, this is the same traceback that comes from<span class="Apple-converted-space"> </span><a href="https://forum.kodi.tv/showthread.php?tid=329171" class="">https://forum.kodi.tv/showthread.php?tid=329171</a>, which suggests it's something fundamental to strict shared-library sandboxing that ctypes trips over when trying to initialize itself.<br class=""><br class="">Does anyone have experience with this, or ideas about what to do?<br class=""></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">I’m afraid not. I currently get away with not signing apps at all, although properly supporting signing is on my way too long wish list for py2app. </span><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""></div></blockquote><div><br class=""></div><div>The ability to distribute unsigned apps is not-so-slowly going away; even the ability to distribute non-notarized apps has a very limited shelf-life at this point. So this ought to be an alarming development for everyone - having Python apps effectively banned from macOS distribution is a big potential problem :-\.</div><div><br class=""></div><div>The good news here is that aside from having to write a little for loop in shell (shown below) getting the app codesigned previously was easy, and my app *did* pass notarization, so nothing that py2app is doing is breaking things on apple's end. It's just a matter of a ctypes bug.</div><div><br class=""></div><div>As I see it, there's 2 problems here:</div><div><br class=""></div><div><ol class="MailOutline"><li class="">py2app's __boot__.py should fail more gracefully if initializing ctypes doesn't work, since not everybody needs ctypes. Shall I file this on the tracker?</li><li class="">ctypes itself should address whatever eldritch hideousness is causing this; in addition to the windows security layer stuff I found, grsecurity TPE causes the same traceback: <a href="https://bugs.python.org/issue28429" class="">https://bugs.python.org/issue28429</a></li></ol></div><br class=""><blockquote type="cite" class=""><div class=""><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">With some luck there’s some entitlement or code signing option that causes this problem. What is the output of "codesign --display --verbose=4” for the application? Both with and without notarisation?<span class="Apple-converted-space"> </span></span><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""></div></blockquote></div><br class=""><div class="">Sorry, my original message was not clear. App notarization itself is not the problem, it's the "stricter requirements" that I ambiguously referenced. The requirement in question is the '--options runtime' flag passed to 'codesign'. So you can just codesign an app (even with an ad-hoc identity, you technically could do this without even having a valid cert, although the way one generates one of those escapes me) with the 'runtime' option, you can reproduce this.</div><div class=""><br class=""></div><div class="">So if I sign my app like this:</div><div class=""><br class=""></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class="">#!/bin/bash</div><div class="">find "${NAME}.app" -iname '*.so' -or -iname '*.dylib' |</div><div class=""> while read libfile; do</div><div class=""> codesign --sign "${IDENTITY}" \</div><div class=""> --deep "${libfile}" \</div><div class=""> --force \</div><div class=""> --options runtime;</div><div class=""> done;</div><div class=""><br class=""></div><div class="">codesign --sign "${IDENTITY}" \</div><div class=""> --deep "${NAME}.app" \</div><div class=""> --force \</div><div class=""> --options runtime;</div></blockquote><div class=""><br class=""></div><div class="">and then run it as "./${NAME}.app/Contents/MacOS/${NAME}". I immediately get the traceback given above.</div><div class=""><br class=""></div><div class="">-glyph</div></body></html>