Opened 18 months ago

Last modified 10 months ago

#53168 assigned defect

python27: Python Frameworks not codesigned in MacOS Sierra

Reported by: tcwan (TC Wan) Owned by: jmroot (Joshua Root)
Priority: Normal Milestone:
Component: ports Version: 2.3.5
Keywords: Cc:
Port: python27


I am using a python app which opens a listening socket for network connections, which is intercepted by the MacOS Firewall with the permission dialog "XXX accept incoming connections?" each time the app is executed.

The reason for this behavior is due to the Python Frameworks not having a valid signature

$ codesign -vvv /opt/local/Library/Frameworks/Python.framework/Versions/2.7/Resources/
/opt/local/Library/Frameworks/Python.framework/Versions/2.7/Resources/ code object is not signed at all
In architecture: x86_64

To overcome this, the python framework(s) should be codesigned after installation.

$sudo codesign -f -s - /opt/local/Library/Frameworks/Python.framework/Versions/2.7/Resources/

Note the '-' after -s is needed to force codesign to use an ad hoc signature.

After codesigning, the following output is seen:

$ codesign -vvv /opt/local/Library/Frameworks/Python.framework/Versions/2.7/Resources/
/opt/local/Library/Frameworks/Python.framework/Versions/2.7/Resources/ valid on disk
/opt/local/Library/Frameworks/Python.framework/Versions/2.7/Resources/ satisfies its Designated Requirement

Change History (4)

comment:1 Changed 18 months ago by ryandesign (Ryan Schmidt)

Keywords: codesign incoming connections firewall removed
Owner: set to jyrkiwahlstedt
Port: python27 added; python removed
Status: newassigned
Summary: Python Frameworks not codesigned in MacOS Sierrapython27: Python Frameworks not codesigned in MacOS Sierra

comment:2 Changed 18 months ago by mojca (Mojca Miklavec)

See also #39349.

comment:3 Changed 18 months ago by tcwan (TC Wan)

I think the codesigning requirement is true for all versions of Python, not just Python 2.7

comment:4 Changed 10 months ago by jmroot (Joshua Root)

Owner: changed from jyrkiwahlstedt to jmroot
Note: See TracTickets for help on using tickets.