Update framework path, symlinks and add signing support

- /Library/SystemFrameworks -> /Library/ManagedFrameworks
- Python3.framework/Versions/3.8/bin/python3.8 -> Python3.framework/Versions/Current/bin/python3
- /usr/local/bin/python3.framework -> /usr/local/bin/managed_python3
- Add signing option with Clever DevOps signing cert
- Remove unnecessary Python3.framework/python3 symlink
- Update README with all the changes

.gitignore

@@ -1,4 +1,8 @@
 .DS_Store
+*.pkg
+*.zip
+*.p12
+*.cer
 minimal/*
 no_customization/*
 opinionated/*

README.md

@@ -1,24 +1,22 @@
 # python
-A Python 3 framework that currently installs to `/Library/SystemFrameworks/Python3.framework`.
+A Python 3 framework that currently installs to `/Library/ManagedFrameworks/Python3.framework`.
 
 Please see Apple's documentation on [file system basics](https://developer.apple.com/library/archive/documentation/FileManagement/Conceptual/FileSystemProgrammingGuide/FileSystemOverview/FileSystemOverview.html) for more information on the thought process here.
 
 This is an intended replacement for when Apple removes `/usr/bin/python`
 
 ## Using interactively
-After installing any of the packages, a symbolic link can be used within terminal for interactive Python sessions. At the time of this writing `/usr/local/bin/python3.framework` points to `/Library/SystemFrameworks/Python3.framework/Versions/3.8/bin/python3.8`
+After installing any of the packages, a symbolic link can be used within terminal for interactive Python sessions. At the time of this writing `/usr/local/bin/managed_python3` points to `/Library/ManagedFrameworks/Python3.framework/Versions/Current/bin/python3`
 
 ## Using with scripts
-Careful consideration should be used when determining the best course of action for using with scripts. Due to various complexities, a shim file has been provided and is located at `/Library/SystemFrameworks/Python3.framework/python3`
+It is currently recommended to point directly to symbolic link provided by the Python framework.
 
-It is currently recommended to point directly to this shim as future updates to python3 could change this path.
+At the time of this writing `/Library/ManagedFrameworks/Python3.framework/Versions/Current/bin/python3` points to `/Library/ManagedFrameworks/Python3.framework/Versions/3.8/bin/python3.8`
-
-At the time of this writing `/Library/SystemFrameworks/Python3.framework/python3` points to `/Library/SystemFrameworks/Python3.framework/Versions/3.8/bin/python3.8`
 
 An example script would look like the following:
 
 ```
-#!/Library/SystemFrameworks/Python3.framework/python3
+#!/Library/ManagedFrameworks/Python3.framework/Versions/Current/bin/python3
 
 print('This is an example script.')
 ```
@@ -27,7 +25,7 @@ print('This is an example script.')
 #### zshenv global alias
 If you are calling `python` within `zsh` scripts, adding a global alias to `/etc/zshenv` may be appropriate.
 
-`alias -g python3.framework='/Library/SystemFrameworks/Python3.framework/python3'`
+`alias -g python3.framework='/Library/ManagedFrameworks/Python3.framework/Versions/Current/bin/python3'`
 
 For more information on this method, please see Armin Briegel's "Moving to Zsh" Part [II](https://scriptingosx.com/2019/06/moving-to-zsh-part-2-configuration-files/) and [IV](https://scriptingosx.com/2019/07/moving-to-zsh-part-4-aliases-and-functions/)
 

build_all_python_frameworks.zsh

@@ -6,8 +6,9 @@
 # Run this with your current directory being the path where this script is located
 
 TOOLSDIR=$(dirname $0)
+SIGNING_IDENTITY="Developer ID Installer: Clever DevOps Co. (9GQZ7KUFR6)"
 
-sudo "$TOOLSDIR/build_python_framework_pkgs.zsh" minimal
+sudo "$TOOLSDIR/build_python_framework_pkgs.zsh" minimal ${SIGNING_IDENTITY}
-sudo "$TOOLSDIR/build_python_framework_pkgs.zsh" no_customization
+sudo "$TOOLSDIR/build_python_framework_pkgs.zsh" no_customization ${SIGNING_IDENTITY}
-sudo "$TOOLSDIR/build_python_framework_pkgs.zsh" recommended
+sudo "$TOOLSDIR/build_python_framework_pkgs.zsh" recommended ${SIGNING_IDENTITY}
-sudo "$TOOLSDIR/build_python_framework_pkgs.zsh" opinionated
+sudo "$TOOLSDIR/build_python_framework_pkgs.zsh" opinionated ${SIGNING_IDENTITY}

build_python_framework_pkgs.zsh

@@ -10,8 +10,8 @@ PYTHON_VERSION=3.8.3
 RP_SHA="8bce58e91895978da6f238c1d2e1de3559ea4643"
 MP_SHA="71c57fcfdf43692adcd41fa7305be08f66bae3e5"
 # Hardcoded paths
-FRAMEWORKDIR="/Library/SystemFrameworks"
+FRAMEWORKDIR="/Library/ManagedFrameworks"
-PYTHON_BIN="$FRAMEWORKDIR/Python3.framework/Versions/3.8/bin/python3.8"
+PYTHON_BIN="$FRAMEWORKDIR/Python3.framework/Versions/Current/bin/python3"
 RP_BINDIR="/tmp/relocatable-python"
 MP_BINDIR="/tmp/munki-pkg"
 
@@ -118,9 +118,8 @@ fi
 echo "Moving Python.framework to payload folder"
 /usr/bin/sudo /bin/mv "${FRAMEWORKDIR}/Python.framework" "$TOOLSDIR/$TYPE/payload/${FRAMEWORKDIR}/Python3.framework"
 
-# make a symbolic link to help with interactive use and stable path
+# make a symbolic link to help with interactive use
-/bin/ln -s "$PYTHON_BIN" "$TOOLSDIR/$TYPE/payload/usr/local/bin/python3.framework"
+/bin/ln -s "$PYTHON_BIN" "$TOOLSDIR/$TYPE/payload/usr/local/bin/managed_python3"
-/bin/ln -s "$PYTHON_BIN" "$TOOLSDIR/$TYPE/payload/$FRAMEWORKDIR/Python3.framework/python3"
 
 # take ownership of the payload folder
 echo "Taking ownership of the Payload directory"
@@ -158,17 +157,49 @@ fi
   "install_location": "/"
 }
 JSONFILE
-# Create the pkg
+# Create the unsigned pkg
 "${MP_BINDIR}/munki-pkg-${MP_SHA}/munkipkg" "$TOOLSDIR/$TYPE"
+# Move the unsigned pkg
+/bin/mv "$TOOLSDIR/$TYPE/build/python_$TYPE-$PYTHON_VERSION.$DATE.pkg" "$OUTPUTSDIR"
 
-# Zip the framework
+if [ -n "$2" ]; then
+  # Create the json file for munki-pkg (signed)
+  /bin/cat << SIGNED_JSONFILE > "$TOOLSDIR/$TYPE/build-info.json"
+  {
+    "ownership": "recommended",
+    "suppress_bundle_relocation": true,
+    "identifier": "org.macadmins.python.$TYPE",
+    "postinstall_action": "none",
+    "distribution_style": true,
+    "version": "$PYTHON_VERSION.$DATE",
+    "name": "python_${TYPE}_signed-$PYTHON_VERSION.$DATE.pkg",
+    "install_location": "/",
+    "signing_info": {
+      "identity": "$2",
+      "timestamp": true
+    }
+  }
+SIGNED_JSONFILE
+  # Create the signed pkg
+  "${MP_BINDIR}/munki-pkg-${MP_SHA}/munkipkg" "$TOOLSDIR/$TYPE"
+  PKG_RESULT="$?"
+  if [ "${PKG_RESULT}" != "0" ]; then
+    echo "Could not sign package: ${PKG_RESULT}" 1>&2
+  else
+    # Move the signed pkg
+    /bin/mv "$TOOLSDIR/$TYPE/build/python_${TYPE}_signed-$PYTHON_VERSION.$DATE.pkg" "$OUTPUTSDIR"
+  fi
+else
+  echo "no signing identity passed, skipping signed package creation"
+fi
+
+# Zip and move the framework
 ZIPFILE="Python3.framework_$TYPE-$PYTHON_VERSION.$DATE.zip"
 /usr/bin/ditto -c -k --sequesterRsrc "$TOOLSDIR/$TYPE/payload/${FRAMEWORKDIR}/" ${ZIPFILE}
-
-# Move all of the output files
 /bin/mv ${ZIPFILE} "$OUTPUTSDIR"
-/bin/mv "$TOOLSDIR/$TYPE/build/python_$TYPE-$PYTHON_VERSION.$DATE.pkg" "$OUTPUTSDIR"
+
+# Ensure outputs directory is owned by the current user
 /usr/bin/sudo /usr/sbin/chown -R ${CONSOLEUSER}:wheel "$OUTPUTSDIR"
 
-# Cleanup
+# Cleanup the temporary files
 /usr/bin/sudo /bin/rm -rf "$TOOLSDIR/$TYPE"

example_python_script.py

@@ -1,3 +1,3 @@
-#!/Library/SystemFrameworks/Python3.framework/python3
+#!/Library/ManagedFrameworks/Python3.framework/Versions/Current/bin/python3
 
 print('This is an example script.')