Sigil (https://github.com/Sigil-Ebookl/Sigil) is a Qt cross-platform epub2 and epub3 editor on Mac OS X / Windows / Linux. It embeds a relocatable Python3 framework inside Sigil.app on OSX.
The OS X Code signing works for Sigil.app and for the dmg used to distribute it but upon first launch the internal embedded Python3 interpreter creates *.pyc compiled python code files inside various __pycache__ directories inside the Python.framework stored inside the Sigil.app.
This causes further code-sign testing to fail with "files added messages" error messages as follows:
codesign --verify --deep --strict --verbose=2 Sigil.app
--prepared:/Applications/Sigil.app/Contents/Frameworks/Python.framework/Versions/Current/.
Sigil.app: a sealed resource is missing or invalid
In subcomponent: /Applications/Sigil.app/Contents/Frameworks/Python.framework
file added: /Applications/Sigil.app/Contents/Frameworks/Python.framework/Versions/Current/lib/python3.5/__pycache__/__future__.cpython-35.pyc
file added: /Applications/Sigil.app/Contents/Frameworks/Python.framework/Versions/Current/lib/python3.5/__pycache__/_bootlocale.cpython-35.pyc
file added: /Applications/Sigil.app/Contents/Frameworks/Python.framework/Versions/Current/lib/python3.5/__pycache__/_collections_abc.cpython-35.pyc
file added: /Applications/Sigil.app/Contents/Frameworks/Python.framework/Versions/Current/lib/python3.5/__pycache__/_compression.cpython-35.pyc
...
When the exact same codesign test is run on the distribution dmg and just installed app before it is first run, it passes completely as these cache compiled bytecode files are not generated until then.
Later launches do still work and there is no "abort". Is this a signing error? Or is signing mainly used only when the application is first launched.
Is there any way around it except for precompiling all .py files used internally in Python3's interpreter to create .pyc files and removing all .py files?
Is there a way to make code signing ignore things like __pycache__ directories stored in embedd frameworks changing?
I could prevent the .pyc creation with the Py_DontWriteBytecodeFlag = 1; when creating the mebedded interpreter but I assume this would hurt python3 performance greatly as the interpreter's internal constantly reused files would have to be recompiled for every single use.
Ideas?
I gave up and spent about 3 hours googling around and found a project that had successfully codesigned an embedded Python.framework and I was able to adapt it to actually work.
In case others run into this issue here is the script:
cd bin
# Use Depth First
# Python Frameworks
find ./Sigil.app/Contents/Frameworks/Python.framework/Versions/3.11/lib/ -type f -perm -u=x -exec codesign --force --verbose --options=runtime --entitlements=/Users/kbhend/entitlements.plist --timestamp -s "${CODE_SIGN_ID}" {} \;
find ./Sigil.app/Contents/Frameworks/Python.framework/Versions/3.11/bin/ -type f -perm -u=x -exec codesign --force --verbose --options=runtime --entitlements=/Users/kbhend/entitlements.plist --timestamp -s "${CODE_SIGN_ID}" {} \;
find ./Sigil.app/Contents/Frameworks/Python.framework/Versions/3.11/lib/ -type f -name "*dylib" -exec codesign --force --verbose --options=runtime --entitlements=/Users/kbhend/entitlements.plist --timestamp -s "${CODE_SIGN_ID}" {} \;
find ./Sigil.app/Contents/Frameworks/Python.framework/Versions/3.11/lib/ -type f -name "*so" -exec codesign --force --verbose --options=runtime --entitlements=/Users/kbhend/entitlements.plist --timestamp -s "${CODE_SIGN_ID}" {} \;
find ./Sigil.app/Contents/Frameworks/Python.framework/Versions/3.11/lib/ -type f -name "*.a" -exec codesign --force --verbose --options=runtime --entitlements=/Users/kbhend/entitlements.plist --timestamp -s "${CODE_SIGN_ID}" {} \;
find ./Sigil.app/Contents/Frameworks/Python.framework/Versions/3.11/lib/ -type f -name "*libitclstub*" -exec codesign --force --verbose --options=runtime --entitlements=/Users/kbhend/entitlements.plist --timestamp -s "${CODE_SIGN_ID}" {} \;
codesign --force --options=runtime --entitlements=/users/kbhend/entitlements.plist --deep --verbose --timestamp -s "${CODE_SIGN_ID}" ./Sigil.app/Contents/Frameworks/Python.framework/Versions/3.11/Resources/Python.app
codesign --force --deep --verbose -s "${CODE_SIGN_ID}" --options=runtime --entitlements=/Users/kbhend/entitlements.plist --timestamp ./Sigil.app/Contents/Frameworks/Python.framework