The newer relocatable-python commit 8ee72fe (Oct 2024, adds symlink
path handling) causes ensurepip to die with SIGKILL on Apple Silicon
during the framework build: install_name_tool invalidates the
binary's code signature, and ensurepip runs before any re-sign step,
so Gatekeeper kills the process.
A prior bump attempt was already reverted in this repo (commit d8db8a2,
PR #67) — sticking with fb4dd9b until upstream addresses the
ad-hoc-resign-before-ensurepip flow.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
mkdir -m 777 only applies the mode to newly created directories.
If /Library/ManagedFrameworks/Python already exists from a prior
install with stricter perms, the un-sudo'd relocatable-python
tool fails with 'Permission denied' when writing the framework.
Add an explicit chmod after mkdir.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The refactor baked 'macos11' into the URL as a literal, leaving only
two %s slots. relocatable-python's locallibs/get.py expects three:
(version, version, os-version). The mismatch raised
'TypeError: not all arguments converted during string formatting'
during framework download.
Restore the third %s; --os-version 11 is already passed to the
make_relocatable_python_framework.py invocation.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Fixes regression where a signed-but-unnotarized .pkg was built into
the staging dir and then deleted by cleanup() without ever reaching
outputs/. The pre-refactor script moved the .pkg unconditionally
after munkipkg succeeded; the refactor lost that mv when it was
consolidated into notarize_and_staple().
* 2025 updates try 2
no _logic_ changes, just version bumps and 3.13 support/default - some commented-out _potential_ fixes and explanatory text
* copy pasta
3.13
* undo commented-outs
revorted
* moar copy-pasta
😅
fix the notary issues
* more fixes
* do the bin version not current since current is a symlink
* add a bunch more things now
* preserve_xattr in munki-pkg signed package
* try and debug things with spctl
* change the order of the code signing
* paths are still technically wrong but this works already
* Update to Python 3.9.10 and update libs
* Fix tokenize-rt version as 4.2.0 was yanked
* PyObjC doesn't seem universal anymore, trying to force a build
* Let's upgrade to latest release of PyObjC
* Update release notes to reflect PyObjC change
* Combined dependabot and docklib PRs
* Update requests to 2.25.1
* Add additional debug output when archs do not match
* Update PyYAML to 5.4.1
* Update Python to 3.9.5
* Update github action to do python 3.9.5
* Fix MACOS_VERSION name as they now use 11 upstream instead of 11.0
* Trying minimal to confirm that works
* First stab at updating all recommended libs, will need another pr
* Fix lib versions
* Requests was unhappy with idna 3, reverting to 2.x
* Revert pyobjc to 7.0.1
* force compilation for items that lack a universal binary
* bad copy pasta
* Update release description
* Only create a release and upload signed packages if on main
* try some more fixes
Co-authored-by: erikg <e@eriknicolasgomez.com>
