[New-bugs-announce] [issue46548] macOS installers cannot be signed on Monterey

[Robert Xiao]

New submission from Robert Xiao <nneonneo at gmail.com>:

I am building unofficial macOS packages for personal use. My main build machine is running macOS Monterey 12.1 and Xcode 13.2.1. I recently attempted to build Python 3.8.12 as a package using build-installer.py. This worked fine after a bit of dependency wrangling (mostly, downloading the right Tcl/Tk source files manually) and produced an installer package and DMG as expected.

However, it is apparently impossible to actually sign the package. I receive the following error:

% productsign --sign 'Apple Development: ...' /private/tmp/_py/installer/Python.mpkg /private/tmp/_py/installer/Python-signed.mpkg
productsign: preparing "Python.mpkg" for signing ...
productsign: error: component package "PythonFramework-3.8.pkg" uses legacy installer features that make it impossible to sign.

Unfortunately, searching for "legacy installer features" yields zero useful hits, which is a bit of a surprise. I assume that this error message was added to a recent macOS/Xcode build, but I am unable to downgrade easily.

I believe this is probably being triggered because the way the packages are put together differs from the way pkgbuild/productbuild would do it. The longer term solution would probably be to switch to those tools instead of assembling the packages by hand.

Issue reproduces with Python 3.11a4 sources as well, so I'm tagging it as applying for 3.8~3.11.

----------
components: Build
messages: 411857
nosy: nneonneo
priority: normal
severity: normal
status: open
title: macOS installers cannot be signed on Monterey
versions: Python 3.10, Python 3.11, Python 3.8, Python 3.9

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue46548>
_______________________________________