notarization works! (was Re: not that)

Glyph <[email protected]> Sun, 28 Oct 2018 16:56:49 -0700
Newsgroups gmane.comp.python.pyobjc.devel,gmane.comp.python.apple
Message-ID <[email protected]>
--===============4545429850420542823==
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_35F388BA-2CD2-47B0-B049-6EB9B5667A9F"


--Apple-Mail=_35F388BA-2CD2-47B0-B049-6EB9B5667A9F
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8



> On Oct 28, 2018, at 2:57 PM, Glyph <[email protected]> wrote:
>=20
>> I wonder what the =E2=80=9Chardened runtime=E2=80=9D option actually =
does and enforces.   In 3.7 the line in ctypes/__init__.py that causes =
the exception is a call that creates a dummy C function, and likely =
triggers the first allocation for storing a libffi closure which could =
be something the hardened runtime doesn=E2=80=99t like (being writeable =
+ executable memory).=20
>=20
> Interesting. Perhaps what I want is simply =
https://developer.apple.com/documentation/security/com_apple_security_cs_a=
llow-unsigned-executable-memory =
<https://developer.apple.com/documentation/security/com_apple_security_cs_=
allow-unsigned-executable-memory> then?  Any chance you know how to jam =
that into a `codesign` command line somehow? :-)
>=20

Thank you so much for this tip, Ronald!  This was much easier than I =
anticipated, and things are working now!

The relevant entitlements file is literally just:

<?xml version=3D"1.0" encoding=3D"UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" =
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version=3D"1.0">
<dict>
	=
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
	<true/>
</dict>
</plist>

I dropped that in a file, added `--entitlements=3D$THAT_FILE.plist` to =
my codesign invocations, removed all my workarounds for ctypes et. al. =
(except for the hard-coded 'import _cffi_backend' still necessary to =
convince modulegraph to include enough code for SSL to work), and then =
tried launching my app.  Success!  Then I tried notarizing it: also =
success!  Time permitting, I'll be updating my blog post at =
https://glyph.twistedmatrix.com/2018/01/shipping-pygame-mac-app.html =
<https://glyph.twistedmatrix.com/2018/01/shipping-pygame-mac-app.html> =
with this information, and possibly publishing the now unfortunately =
somewhat complex tooling I use to do signing now.

So I don't know if I'm the first to do this, but looking at the archives =
for these lists I seem to be the first to report it: you can =
successfully codesign and notarize apps created with py2app and python =
3.6!

It seems to me that whatever "MAP_JIT" is (an mmap flag, I'm guessing?) =
libffi needs to be using it for the memory it places synthetic closures =
into, so that this entitlement won't be necessary with some future =
version of Python.  But it looks like Apple is not pushing particularly =
hard to deprecate this one right now, thank goodness :-).

-glyph=

--Apple-Mail=_35F388BA-2CD2-47B0-B049-6EB9B5667A9F
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=utf-8

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;" class=3D""><br =
class=3D""><div><br class=3D""><blockquote type=3D"cite" class=3D""><div =
class=3D"">On Oct 28, 2018, at 2:57 PM, Glyph &lt;<a =
href=3D"mailto:[email protected]" =
class=3D"">[email protected]</a>&gt; wrote:</div><br =
class=3D"Apple-interchange-newline"><div class=3D""><div dir=3D"auto" =
class=3D"Singleton"><blockquote type=3D"cite" style=3D"font-family: =
Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: =
normal; font-weight: normal; letter-spacing: normal; orphans: auto; =
text-align: start; text-indent: 0px; text-transform: none; white-space: =
normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; =
-webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><div =
dir=3D"ltr" class=3D""><div class=3D"">I wonder what the =E2=80=9Chardened=
 runtime=E2=80=9D option actually does and enforces. &nbsp; In 3.7 the =
line in ctypes/__init__.py that causes the exception is a call that =
creates a dummy C function, and likely triggers the first allocation for =
storing a libffi closure which could be something the hardened runtime =
doesn=E2=80=99t like (being writeable + executable =
memory).&nbsp;</div></div></blockquote><div style=3D"caret-color: rgb(0, =
0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; =
font-variant-caps: normal; font-weight: normal; letter-spacing: normal; =
text-align: start; text-indent: 0px; text-transform: none; white-space: =
normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; =
text-decoration: none;" class=3D""><br class=3D""></div><div =
style=3D"caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; =
font-size: 12px; font-style: normal; font-variant-caps: normal; =
font-weight: normal; letter-spacing: normal; text-align: start; =
text-indent: 0px; text-transform: none; white-space: normal; =
word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: =
none;" class=3D"">Interesting. Perhaps what I want is simply&nbsp;<a =
href=3D"https://developer.apple.com/documentation/security/com_apple_secur=
ity_cs_allow-unsigned-executable-memory" =
class=3D"">https://developer.apple.com/documentation/security/com_apple_se=
curity_cs_allow-unsigned-executable-memory</a>&nbsp;then? &nbsp;Any =
chance you know how to jam that into a `codesign` command line somehow? =
:-)</div></div><br =
class=3D"Apple-interchange-newline"></div></blockquote></div><br =
class=3D""><div class=3D"">Thank you so much for this tip, Ronald! =
&nbsp;This was much easier than I anticipated, and things are working =
now!</div><div class=3D""><br class=3D""></div><div class=3D"">The =
relevant entitlements file is literally just:</div><div class=3D""><br =
class=3D""></div><blockquote style=3D"margin: 0 0 0 40px; border: none; =
padding: 0px;" class=3D""><div class=3D""><div class=3D"">&lt;?xml =
version=3D"1.0" encoding=3D"UTF-8"?&gt;</div><div class=3D"">&lt;!DOCTYPE =
plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "<a =
href=3D"http://www.apple.com/DTDs/PropertyList-1.0.dtd" =
class=3D"">http://www.apple.com/DTDs/PropertyList-1.0.dtd</a>"&gt;</div><d=
iv class=3D"">&lt;plist version=3D"1.0"&gt;</div><div =
class=3D"">&lt;dict&gt;</div><div class=3D""><span =
class=3D"Apple-tab-span" style=3D"white-space:pre">	=
</span>&lt;key&gt;com.apple.security.cs.allow-unsigned-executable-memory&l=
t;/key&gt;</div><div class=3D""><span class=3D"Apple-tab-span" =
style=3D"white-space:pre">	</span>&lt;true/&gt;</div><div =
class=3D"">&lt;/dict&gt;</div><div =
class=3D"">&lt;/plist&gt;</div></div></blockquote><br class=3D""><div =
class=3D"">I dropped that in a file, added =
`--entitlements=3D$THAT_FILE.plist` to my codesign invocations, removed =
all my workarounds for ctypes et. al. (except for the hard-coded 'import =
_cffi_backend' still necessary to convince modulegraph to include enough =
code for SSL to work), and then tried launching my app. &nbsp;Success! =
&nbsp;Then I tried notarizing it: also success! &nbsp;Time permitting, =
I'll be updating my blog post at&nbsp;<a =
href=3D"https://glyph.twistedmatrix.com/2018/01/shipping-pygame-mac-app.ht=
ml" =
class=3D"">https://glyph.twistedmatrix.com/2018/01/shipping-pygame-mac-app=
.html</a>&nbsp;with this information, and possibly publishing the now =
unfortunately somewhat complex tooling I use to do signing =
now.</div><div class=3D""><br class=3D""></div><div class=3D"">So I =
don't know if I'm the first to <i class=3D"">do</i>&nbsp;this, but =
looking at the archives for these lists I seem to be the first to <i =
class=3D"">report</i>&nbsp;it: you can successfully codesign and =
notarize apps created with py2app and python 3.6!</div><div class=3D""><br=
 class=3D""></div><div class=3D"">It seems to me that whatever "MAP_JIT" =
is (an mmap flag, I'm guessing?) libffi needs to be using it for the =
memory it places synthetic closures into, so that this entitlement won't =
be necessary with some future version of Python. &nbsp;But it looks like =
Apple is not pushing particularly hard to deprecate this one right now, =
thank goodness :-).</div><div class=3D""><br class=3D""></div><div =
class=3D"">-glyph</div></body></html>=

--Apple-Mail=_35F388BA-2CD2-47B0-B049-6EB9B5667A9F--


--===============4545429850420542823==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============4545429850420542823==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Pyobjc-dev mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/pyobjc-dev

--===============4545429850420542823==--