Signed-Notarized python complied exe thrown error, while the unsigned works

Question

Created Sep ’23

Replies 1

Boosts 0

Participants 2

MyPythonExe is a compiled file coming from a python script compiled with using pyinstaller. After compiled, it was signed using codesign:

codesign -s "Developer ID TTT", -o runtime -f --timestamp MyPythonExe

Once signed, the exe was placed in a Zip container (exeZip), and then successfully notarized using the following:

xcrun notarytool submit exeZip --keychain-profile "MyNotarProf" --wait

It was accepted.

Now, when try to run it, the following error was thrown (oddly, the compiled unsigned Exe runs in the same computer without any issues):

/Users/admin/Downloads/MyPythonExe ; exit;
admin@admins-MacBook-Air ~ % /Users/admin/Downloads/MyPythonExe ; exit; [1767] Error loading Python lib '/var/folders/80/35xy0t2n3t96b5nl5ldl24_r0000gn/T/_MEIEhOx1q/Python': dlopen: dlopen(/var/folders/80/35xy0t2n3t96b5nl5ldl24_r0000gn/T/_MEIEhOx1q/Python, 0x000A): tried: '/var/folders/80/35xy0t2n3t96b5nl5ldl24_r0000gn/T/_MEIEhOx1q/Python' (code signature in <88BFFD37-99D8-36AB-9B95-9F54B30BD667> '/private/var/folders/80/35xy0t2n3t96b5nl5ldl24_r0000gn/T/_MEIEhOx1q/Python' not valid for use in process: mapped file has no Team ID and is not a platform binary (signed with custom identity or adhoc?)), '/System/Volumes/Preboot/Cryptexes/OS/var/folders/80/35xy0t2n3t96b5nl5ldl24_r0000gn/T/_MEIEhOx1q/Python' (no such file), .... (+ a couple of similar errors)

No, the said exe file (MyPythonExe) was signed and successfully notarized. Oddly, the very same file, but unsigned runs perfectly well (after being authorized so it can surpass Gatekeeper, of course). What could be going on here? Any hint on how to overcome this issue?

Boost

Answer 1

DTS Engineer OP

Apple

Sep ’23

This is something you need to discuss with the PyInstaller folks. Looking at that log it seems that PyInstaller is unpacking the Python runtime into the temporary directory and trying to load that. The problem is that the code isn’t signed properly, so your process can’t load it.

Ideally PyInstaller would have a mode where you could tell it to sign the program with specific characteristics, and it’d use those to sign both the main executable and these runtime libraries. Looking at the PyInstaller docs I suspect it does have such an option, but I can’t make definitive statements about third-party tools.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0