The --no-unsign flag was disabling relocatable-python's own
fix_broken_signatures step (locallibs/fix.py), which ad-hoc re-signs
every binary modified by install_name_tool before ensurepip runs.
That's the exact code path needed to satisfy Apple Silicon Gatekeeper.
The flag's stated purpose ('don't touch the python.org signature') was
never achievable — install_name_tool invalidates the signature whether
you tell relocatable-python to handle it or not. Keeping --no-unsign
just left the binary in a broken signed state, which Gatekeeper SIGKILLs.
Bumping RP_SHA to 8ee72fe simultaneously, since the prior pin
(fb4dd9b) had the same code path and was only kept while investigating.
The newer SHA additionally sets CPPFLAGS for pip, useful for packages
with native extensions.
Closes the local equivalent of gregneagle/relocatable-python#32 for our
build pipeline.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The newer relocatable-python commit 8ee72fe (Oct 2024, adds symlink
path handling) causes ensurepip to die with SIGKILL on Apple Silicon
during the framework build: install_name_tool invalidates the
binary's code signature, and ensurepip runs before any re-sign step,
so Gatekeeper kills the process.
A prior bump attempt was already reverted in this repo (commit d8db8a2,
PR #67) — sticking with fb4dd9b until upstream addresses the
ad-hoc-resign-before-ensurepip flow.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
mkdir -m 777 only applies the mode to newly created directories.
If /Library/ManagedFrameworks/Python already exists from a prior
install with stricter perms, the un-sudo'd relocatable-python
tool fails with 'Permission denied' when writing the framework.
Add an explicit chmod after mkdir.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
All 37 packages in requirements_recommended.txt updated to their
latest versions confirmed to ship cp313-compatible macOS wheels
(arm64 direct or universal2) or pure-Python wheels for Python 3.13.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The refactor baked 'macos11' into the URL as a literal, leaving only
two %s slots. relocatable-python's locallibs/get.py expects three:
(version, version, os-version). The mismatch raised
'TypeError: not all arguments converted during string formatting'
during framework download.
Restore the third %s; --os-version 11 is already passed to the
make_relocatable_python_framework.py invocation.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Fixes regression where a signed-but-unnotarized .pkg was built into
the staging dir and then deleted by cleanup() without ever reaching
outputs/. The pre-refactor script moved the .pkg unconditionally
after munkipkg succeeded; the refactor lost that mv when it was
consolidated into notarize_and_staple().
Phases 1 and 2: refactor build script to drop universal2 enforcement
and run natively on Apple Silicon, bump upstream SHAs and Python
versions, add 3.14, final-release 3.9 and 3.10. CI/CD overhaul
deferred to Phase 3.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* 2025 updates try 2
no _logic_ changes, just version bumps and 3.13 support/default - some commented-out _potential_ fixes and explanatory text
* copy pasta
3.13
* undo commented-outs
revorted
* moar copy-pasta
😅
Erik Gomez