Opened 7 years ago

Last modified 2 years ago

#53168 assigned defect

python27: Python Frameworks not codesigned in MacOS Sierra

Reported by: tcwan (TC Wan) Owned by: jmroot (Joshua Root)
Priority: Normal Milestone:
Component: ports Version: 2.3.5
Keywords: Cc:
Port: python27

Description

I am using a python app which opens a listening socket for network connections, which is intercepted by the MacOS Firewall with the permission dialog "XXX accept incoming connections?" each time the app is executed.

The reason for this behavior is due to the Python Frameworks not having a valid signature

$ codesign -vvv /opt/local/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app
/opt/local/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app: code object is not signed at all
In architecture: x86_64

To overcome this, the python framework(s) should be codesigned after installation.

$sudo codesign -f -s - /opt/local/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app

Note the '-' after -s is needed to force codesign to use an ad hoc signature.

After codesigning, the following output is seen:

$ codesign -vvv /opt/local/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app
/opt/local/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app: valid on disk
/opt/local/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app: satisfies its Designated Requirement

Change History (5)

comment:1 Changed 7 years ago by ryandesign (Ryan Carsten Schmidt)

Keywords: codesign incoming connections firewall removed
Owner: set to jyrkiwahlstedt
Port: python27 added; python removed
Status: newassigned
Summary: Python Frameworks not codesigned in MacOS Sierrapython27: Python Frameworks not codesigned in MacOS Sierra

comment:2 Changed 7 years ago by mojca (Mojca Miklavec)

See also #39349.

comment:3 Changed 7 years ago by tcwan (TC Wan)

I think the codesigning requirement is true for all versions of Python, not just Python 2.7

comment:4 Changed 7 years ago by jmroot (Joshua Root)

Owner: changed from jyrkiwahlstedt to jmroot

comment:5 Changed 2 years ago by telotortium (Robert Irelan)

I'm still getting this issue. Could we implement this please?

Note: See TracTickets for help on using tickets.