Code Signing Python Libraries

I am trying to code sign an application which relies on many python libraries to run. For background knowledge, the .app was created with a —onefile command on Visual Studio.

I code signed my application itself using

codesign --deep --force --verify --timestamp --sign "Developer ID Application: Issey Yohannes (GL5BCCW69X)" /Users/isseyyohannes/Desktop/Automated\ ALGORA.app

However, when I try to run the application the error shows in terminal as follows

[PYI-16345:ERROR] Failed to load Python shared library '/var/folders/g9/2zbc7y_97xxbq7bnc301nnyc0000gn/T/_MEI6keRcA/Python': dlopen: dlopen(/var/folders/g9/2zbc7y_97xxbq7bnc301nnyc0000gn/T/_MEI6keRcA/Python, 10): no suitable image found.  Did find:
/var/folders/g9/2zbc7y_97xxbq7bnc301nnyc0000gn/T/_MEI6keRcA/Python: code signature in (/var/folders/g9/2zbc7y_97xxbq7bnc301nnyc0000gn/T/_MEI6keRcA/Python) not valid for use in process using Library Validation: mapped file has no Team ID and is not a platform binary (signed with custom identity or adhoc?)
/var/folders/g9/2zbc7y_97xxbq7bnc301nnyc0000gn/T/_MEI6keRcA/Python: stat() failed with errno=1

Through some external tools, I was able to narrow the issue as follows

Hardened Runtime Restriction: Your application is attempting to load a shared library (Python) at runtime, but the library is either: Not properly signed with the same Team ID as your app. Not marked as a valid platform binary. macOS requires all loaded libraries to comply with its code-signing and runtime security policies.

Any insight is much appreciated.

Don’t sign code with --deep. See --deep Considered Harmful for an explanation as to why this is a bad idea. And it’s a particularly bad idea for Python code, because it probably doesn’t follow the rules in Placing Content in a Bundle.

Rather, sign each code item separately, from the inside out. See Creating distribution-signed code for macOS for more details.

Regarding the hardened runtime problem you mentioned, that looks like a library validation issue. You can disable library validation but that’s almost never the right option [1]. If you’re building an application, ensure that all the (native) code within your application is signed by you. That’s sufficient to make library validation happy.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] Library validation is a critical security feature. Also, disabling library validation can cause Gatekeeper problems.

It’s better if you reply as a reply, not in the comments; see Quinn’s Top Ten DevForums Tips for this and other titbits.

I do not have code items ( I don’t think )

We need to nail that down before I can give you more concrete advice. So, run my FindMachO.sh script (from here) over your final application (the .app). What does it report?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Code Signing Python Libraries
 
 
Q