notarization works! (was Re: not that)
Glyph <[email protected]> Sun, 28 Oct 2018 16:56:49 -0700
| Newsgroups | gmane.comp.python.pyobjc.devel,gmane.comp.python.apple |
|---|---|
| Message-ID | <[email protected]> |
--===============4545429850420542823== Content-Type: multipart/alternative; boundary="Apple-Mail=_35F388BA-2CD2-47B0-B049-6EB9B5667A9F" --Apple-Mail=_35F388BA-2CD2-47B0-B049-6EB9B5667A9F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Oct 28, 2018, at 2:57 PM, Glyph <[email protected]> wrote: >=20 >> I wonder what the =E2=80=9Chardened runtime=E2=80=9D option actually = does and enforces. In 3.7 the line in ctypes/__init__.py that causes = the exception is a call that creates a dummy C function, and likely = triggers the first allocation for storing a libffi closure which could = be something the hardened runtime doesn=E2=80=99t like (being writeable = + executable memory).=20 >=20 > Interesting. Perhaps what I want is simply = https://developer.apple.com/documentation/security/com_apple_security_cs_a= llow-unsigned-executable-memory = <https://developer.apple.com/documentation/security/com_apple_security_cs_= allow-unsigned-executable-memory> then? Any chance you know how to jam = that into a `codesign` command line somehow? :-) >=20 Thank you so much for this tip, Ronald! This was much easier than I = anticipated, and things are working now! The relevant entitlements file is literally just: <?xml version=3D"1.0" encoding=3D"UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" = "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version=3D"1.0"> <dict> = <key>com.apple.security.cs.allow-unsigned-executable-memory</key> <true/> </dict> </plist> I dropped that in a file, added `--entitlements=3D$THAT_FILE.plist` to = my codesign invocations, removed all my workarounds for ctypes et. al. = (except for the hard-coded 'import _cffi_backend' still necessary to = convince modulegraph to include enough code for SSL to work), and then = tried launching my app. Success! Then I tried notarizing it: also = success! Time permitting, I'll be updating my blog post at = https://glyph.twistedmatrix.com/2018/01/shipping-pygame-mac-app.html = <https://glyph.twistedmatrix.com/2018/01/shipping-pygame-mac-app.html> = with this information, and possibly publishing the now unfortunately = somewhat complex tooling I use to do signing now. So I don't know if I'm the first to do this, but looking at the archives = for these lists I seem to be the first to report it: you can = successfully codesign and notarize apps created with py2app and python = 3.6! It seems to me that whatever "MAP_JIT" is (an mmap flag, I'm guessing?) = libffi needs to be using it for the memory it places synthetic closures = into, so that this entitlement won't be necessary with some future = version of Python. But it looks like Apple is not pushing particularly = hard to deprecate this one right now, thank goodness :-). -glyph= --Apple-Mail=_35F388BA-2CD2-47B0-B049-6EB9B5667A9F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" class=3D""><br = class=3D""><div><br class=3D""><blockquote type=3D"cite" class=3D""><div = class=3D"">On Oct 28, 2018, at 2:57 PM, Glyph <<a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""><div dir=3D"auto" = class=3D"Singleton"><blockquote type=3D"cite" style=3D"font-family: = Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; orphans: auto; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><div = dir=3D"ltr" class=3D""><div class=3D"">I wonder what the =E2=80=9Chardened= runtime=E2=80=9D option actually does and enforces. In 3.7 the = line in ctypes/__init__.py that causes the exception is a call that = creates a dummy C function, and likely triggers the first allocation for = storing a libffi closure which could be something the hardened runtime = doesn=E2=80=99t like (being writeable + executable = memory). </div></div></blockquote><div style=3D"caret-color: rgb(0, = 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><br class=3D""></div><div = style=3D"caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;" class=3D"">Interesting. Perhaps what I want is simply <a = href=3D"https://developer.apple.com/documentation/security/com_apple_secur= ity_cs_allow-unsigned-executable-memory" = class=3D"">https://developer.apple.com/documentation/security/com_apple_se= curity_cs_allow-unsigned-executable-memory</a> then? Any = chance you know how to jam that into a `codesign` command line somehow? = :-)</div></div><br = class=3D"Apple-interchange-newline"></div></blockquote></div><br = class=3D""><div class=3D"">Thank you so much for this tip, Ronald! = This was much easier than I anticipated, and things are working = now!</div><div class=3D""><br class=3D""></div><div class=3D"">The = relevant entitlements file is literally just:</div><div class=3D""><br = class=3D""></div><blockquote style=3D"margin: 0 0 0 40px; border: none; = padding: 0px;" class=3D""><div class=3D""><div class=3D""><?xml = version=3D"1.0" encoding=3D"UTF-8"?></div><div class=3D""><!DOCTYPE = plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "<a = href=3D"http://www.apple.com/DTDs/PropertyList-1.0.dtd" = class=3D"">http://www.apple.com/DTDs/PropertyList-1.0.dtd</a>"></div><d= iv class=3D""><plist version=3D"1.0"></div><div = class=3D""><dict></div><div class=3D""><span = class=3D"Apple-tab-span" style=3D"white-space:pre"> = </span><key>com.apple.security.cs.allow-unsigned-executable-memory&l= t;/key></div><div class=3D""><span class=3D"Apple-tab-span" = style=3D"white-space:pre"> </span><true/></div><div = class=3D""></dict></div><div = class=3D""></plist></div></div></blockquote><br class=3D""><div = class=3D"">I dropped that in a file, added = `--entitlements=3D$THAT_FILE.plist` to my codesign invocations, removed = all my workarounds for ctypes et. al. (except for the hard-coded 'import = _cffi_backend' still necessary to convince modulegraph to include enough = code for SSL to work), and then tried launching my app. Success! = Then I tried notarizing it: also success! Time permitting, = I'll be updating my blog post at <a = href=3D"https://glyph.twistedmatrix.com/2018/01/shipping-pygame-mac-app.ht= ml" = class=3D"">https://glyph.twistedmatrix.com/2018/01/shipping-pygame-mac-app= .html</a> with this information, and possibly publishing the now = unfortunately somewhat complex tooling I use to do signing = now.</div><div class=3D""><br class=3D""></div><div class=3D"">So I = don't know if I'm the first to <i class=3D"">do</i> this, but = looking at the archives for these lists I seem to be the first to <i = class=3D"">report</i> it: you can successfully codesign and = notarize apps created with py2app and python 3.6!</div><div class=3D""><br= class=3D""></div><div class=3D"">It seems to me that whatever "MAP_JIT" = is (an mmap flag, I'm guessing?) libffi needs to be using it for the = memory it places synthetic closures into, so that this entitlement won't = be necessary with some future version of Python. But it looks like = Apple is not pushing particularly hard to deprecate this one right now, = thank goodness :-).</div><div class=3D""><br class=3D""></div><div = class=3D"">-glyph</div></body></html>= --Apple-Mail=_35F388BA-2CD2-47B0-B049-6EB9B5667A9F-- --===============4545429850420542823== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============4545429850420542823== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Pyobjc-dev mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/pyobjc-dev --===============4545429850420542823==--