The --no-unsign flag was disabling relocatable-python's own
fix_broken_signatures step (locallibs/fix.py), which ad-hoc re-signs
every binary modified by install_name_tool before ensurepip runs.
That's the exact code path needed to satisfy Apple Silicon Gatekeeper.
The flag's stated purpose ('don't touch the python.org signature') was
never achievable — install_name_tool invalidates the signature whether
you tell relocatable-python to handle it or not. Keeping --no-unsign
just left the binary in a broken signed state, which Gatekeeper SIGKILLs.
Bumping RP_SHA to 8ee72fe simultaneously, since the prior pin
(fb4dd9b) had the same code path and was only kept while investigating.
The newer SHA additionally sets CPPFLAGS for pip, useful for packages
with native extensions.
Closes the local equivalent of gregneagle/relocatable-python#32 for our
build pipeline.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The newer relocatable-python commit 8ee72fe (Oct 2024, adds symlink
path handling) causes ensurepip to die with SIGKILL on Apple Silicon
during the framework build: install_name_tool invalidates the
binary's code signature, and ensurepip runs before any re-sign step,
so Gatekeeper kills the process.
A prior bump attempt was already reverted in this repo (commit d8db8a2,
PR #67) — sticking with fb4dd9b until upstream addresses the
ad-hoc-resign-before-ensurepip flow.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
mkdir -m 777 only applies the mode to newly created directories.
If /Library/ManagedFrameworks/Python already exists from a prior
install with stricter perms, the un-sudo'd relocatable-python
tool fails with 'Permission denied' when writing the framework.
Add an explicit chmod after mkdir.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The refactor baked 'macos11' into the URL as a literal, leaving only
two %s slots. relocatable-python's locallibs/get.py expects three:
(version, version, os-version). The mismatch raised
'TypeError: not all arguments converted during string formatting'
during framework download.
Restore the third %s; --os-version 11 is already passed to the
make_relocatable_python_framework.py invocation.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Fixes regression where a signed-but-unnotarized .pkg was built into
the staging dir and then deleted by cleanup() without ever reaching
outputs/. The pre-refactor script moved the .pkg unconditionally
after munkipkg succeeded; the refactor lost that mv when it was
consolidated into notarize_and_staple().
* 2025 updates try 2
no _logic_ changes, just version bumps and 3.13 support/default - some commented-out _potential_ fixes and explanatory text
* copy pasta
3.13
* undo commented-outs
revorted
* moar copy-pasta
😅
fix the notary issues
* more fixes
* do the bin version not current since current is a symlink
* add a bunch more things now
* preserve_xattr in munki-pkg signed package
* try and debug things with spctl
* change the order of the code signing
* paths are still technically wrong but this works already
* Update to Python 3.9.10 and update libs
* Fix tokenize-rt version as 4.2.0 was yanked
* PyObjC doesn't seem universal anymore, trying to force a build
* Let's upgrade to latest release of PyObjC
* Update release notes to reflect PyObjC change
* Combined dependabot and docklib PRs
* Update requests to 2.25.1
* Add additional debug output when archs do not match
* Update PyYAML to 5.4.1
* Update Python to 3.9.5
* Update github action to do python 3.9.5
* Fix MACOS_VERSION name as they now use 11 upstream instead of 11.0
* Trying minimal to confirm that works
* First stab at updating all recommended libs, will need another pr
* Fix lib versions
* Requests was unhappy with idna 3, reverting to 2.x
* Revert pyobjc to 7.0.1
* force compilation for items that lack a universal binary
* bad copy pasta
* Update release description
* Only create a release and upload signed packages if on main
* try some more fixes
Co-authored-by: erikg <e@eriknicolasgomez.com>
Erik Gomez