Re: codesigning py2app/wxPython app failing

On 25/08/2015 12:53 pm, Brendan Simon (eTRIX) wrote:
> On 24/08/2015 1:23 am, [email protected] wrote:
>> Subject:
>> Re: [Pythonmac-SIG] codesigning py2app/wxPython app failing
>> From:
>> Kevin Walzer <[email protected]>
>> Date:
>> 24/08/2015 1:23 am
>>
>> To:
>> [email protected]
>>
>>
>> On 8/23/15 8:09 AM, Brendan Simon (eTRIX) wrote:
>>> Thanks for the help :)  Unfortunately I haven't made any progress :(
>>> I've tried singing some of the binaries and frameworks from a bash
>>> script (and manually) but I still get errors :(
>>
>> I don't quite understand codesign_allocate and why you are using it
>> instead of codesign, but in my experience setting a signature size,
>> i.e. --signature-size 9400, sometimes fixes codesign failures.
>
> I have no idea what codesign_allocate is or why I need it.  I'm not
> using codesing_allocate directly.  if the CODESIGN_ALLOCATE env var is
> not set, then codesign complains about not being able to find or use
> the helper tool.
>
> dist/<myapp>.app/Contents/Frameworks/libncursesw.5.dylib: the
> codesign_allocate helper tool cannot be found or used
>
> Is this not normal?  Maybe there is something screwy with my OS X
> system or Xcode install?
>
> Interestingly, the man page for codesign does not menthod the
> --signature-size option, but codesign doesn't complain about it.

From what I can tell from StackOverflow and other resources on the net,
I should be using the codesign_allocate that is part of the default
Xcode installation.  It should be the one in /Applications/Xcode/... 
not the one in /usr/bin/.
This doesn't solve my problem, but at least I am more comfortable with that.
An easy way to set the env var is:

    export CODESIGN_ALLOCATE=$(xcrun codesign_allocate)


I've discovered that at least _one framework library does get signed
ok_.  libwx_osx_cocoau-3.0.0.2.0.dylib

$ codesign -s "Brendan Simon" -f -vvvv --signature-size=9400
dist/<myapp>.app/Contents/Frameworks/libwx_osx_cocoau-3.0.0.2.0.dylib
dist/<myapp>.app/Contents/Frameworks/libwx_osx_cocoau-3.0.0.2.0.dylib:
replacing existing signature
dist/<myapp>.app/Contents/Frameworks/libwx_osx_cocoau-3.0.0.2.0.dylib:
signed Mach-O universal (i386 x86_64) [libwx_osx_cocoau-3]

$ codesign -v -vvvv
dist/<myapp>.app/Contents/Frameworks/libwx_osx_cocoau-3.0.0.2.0.dylib
dist/<myapp>.app/Contents/Frameworks/libwx_osx_cocoau-3.0.0.2.0.dylib:
valid on disk
dist/<myapp>.app/Contents/Frameworks/libwx_osx_cocoau-3.0.0.2.0.dylib:
satisfies its Designated Requirement

But most others fail.  e.g. libncursesw.5.dylib

$ codesign -s "Brendan Simon" -f -vvvv --signature-size=9400
dist/<myapp>.app/Contents/Frameworks/libncursesw.5.dylib
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/codesign_allocate:
for architecture x86_64 object:
<src>/dist/<myapp>.app/Contents/Frameworks/libncursesw.5.dylib malformed
object (load command 3 cmdsize not a multiple of 8)
dist/<myapp>.app/Contents/Frameworks/libncursesw.5.dylib: the
codesign_allocate helper tool cannot be found or used

Crazy, right ??
So I did a search of libncursesw.5.dylib on my system and found the
shasum of the one in the app was different to others on the system. 
Sure, it's probably stripped, right.
So I copied
/Library/Frameworks/Python.framework/Versions/2.7/lib/libncursesw.5.dylib to
/tmp, and it signed ok !!  I even stripped it and it still signed ok.

$ codesign -s "Brendan Simon" -f -vvvv --signature-size=9400
/tmp/libncursesw.5.dylib
/tmp/libncursesw.5.dylib: signed Mach-O universal (i386 x86_64)
[libncursesw.5]

$ codesign -v -vvvv /tmp/libncursesw.5.dylib
/tmp/libncursesw.5.dylib: valid on disk
/tmp/libncursesw.5.dylib: satisfies its Designated Requirement


$ strip /tmp/libncursesw.5.dylib

$ codesign -s "Brendan Simon" -f -vvvv --signature-size=9400
/tmp/libncursesw.5.dylib
/tmp/libncursesw.5.dylib: replacing existing signature
/tmp/libncursesw.5.dylib: signed Mach-O universal (i386 x86_64)
[libncursesw.5]

$ codesign -v -vvvv /tmp/libncursesw.5.dylib
/tmp/libncursesw.5.dylib: valid on disk
/tmp/libncursesw.5.dylib: satisfies its Designated Requirement


So, what's different (wrong?) with the libraries, frameworks, binaries,
etc in the app bundle that Py2App creates?
And how can I get my Py2App app bundle to be signed ???
I'm assuming others have done this, and there is something I am missing,
yes?

Thanks, Brendan.

_______________________________________________
Pythonmac-SIG maillist  -  [email protected]
https://mail.python.org/mailman/listinfo/pythonmac-sig
unsubscribe: https://mail.python.org/mailman/options/Pythonmac-SIG