From 7773030dd39a1720880a6b819485f3407050feda Mon Sep 17 00:00:00 2001 From: Erik Gomez Date: Tue, 12 May 2026 10:09:18 -0500 Subject: [PATCH] Drop --no-unsign and bump RP_SHA to 8ee72fe MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The --no-unsign flag was disabling relocatable-python's own fix_broken_signatures step (locallibs/fix.py), which ad-hoc re-signs every binary modified by install_name_tool before ensurepip runs. That's the exact code path needed to satisfy Apple Silicon Gatekeeper. The flag's stated purpose ('don't touch the python.org signature') was never achievable — install_name_tool invalidates the signature whether you tell relocatable-python to handle it or not. Keeping --no-unsign just left the binary in a broken signed state, which Gatekeeper SIGKILLs. Bumping RP_SHA to 8ee72fe simultaneously, since the prior pin (fb4dd9b) had the same code path and was only kept while investigating. The newer SHA additionally sets CPPFLAGS for pip, useful for packages with native extensions. Closes the local equivalent of gregneagle/relocatable-python#32 for our build pipeline. Co-Authored-By: Claude Opus 4.7 (1M context) --- build_python_framework_pkgs.zsh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/build_python_framework_pkgs.zsh b/build_python_framework_pkgs.zsh index f519a7d..94ed762 100755 --- a/build_python_framework_pkgs.zsh +++ b/build_python_framework_pkgs.zsh @@ -9,7 +9,7 @@ set -eu # --- Pinned upstream commits --- -RP_SHA="fb4dd9b024b249c71713f14d887f4bcea78aa8b0" # gregneagle/relocatable-python +RP_SHA="8ee72fe3a5dbef733365370ebf44f25022b895ef" # gregneagle/relocatable-python MP_SHA="bbd07730d1b93ed3828246575ef5676bba74b5d1" # munki/munki-pkg # --- Paths and constants --- @@ -132,7 +132,6 @@ build_framework() { --python-version "${PYTHON_VERSION}" \ --os-version 11 \ --upgrade-pip \ - --no-unsign \ --pip-requirements "${TOOLSDIR}/requirements_${TYPE}.txt" \ --destination "${FRAMEWORKDIR}"