I am trying to code sign an application which relies on many python libraries to run. For background knowledge, the .app was created with a —onefile command on Visual Studio.
I code signed my application itself using
codesign --deep --force --verify --timestamp --sign "Developer ID Application: Issey Yohannes (GL5BCCW69X)" /Users/isseyyohannes/Desktop/Automated\ ALGORA.app
However, when I try to run the application the error shows in terminal as follows
[PYI-16345:ERROR] Failed to load Python shared library '/var/folders/g9/2zbc7y_97xxbq7bnc301nnyc0000gn/T/_MEI6keRcA/Python': dlopen: dlopen(/var/folders/g9/2zbc7y_97xxbq7bnc301nnyc0000gn/T/_MEI6keRcA/Python, 10): no suitable image found. Did find:
/var/folders/g9/2zbc7y_97xxbq7bnc301nnyc0000gn/T/_MEI6keRcA/Python: code signature in (/var/folders/g9/2zbc7y_97xxbq7bnc301nnyc0000gn/T/_MEI6keRcA/Python) not valid for use in process using Library Validation: mapped file has no Team ID and is not a platform binary (signed with custom identity or adhoc?)
/var/folders/g9/2zbc7y_97xxbq7bnc301nnyc0000gn/T/_MEI6keRcA/Python: stat() failed with errno=1
Through some external tools, I was able to narrow the issue as follows
Hardened Runtime Restriction: Your application is attempting to load a shared library (Python) at runtime, but the library is either: Not properly signed with the same Team ID as your app. Not marked as a valid platform binary. macOS requires all loaded libraries to comply with its code-signing and runtime security policies.
Any insight is much appreciated.
Don’t sign code with --deep. See --deep Considered Harmful for an explanation as to why this is a bad idea. And it’s a particularly bad idea for Python code, because it probably doesn’t follow the rules in Placing Content in a Bundle.
Rather, sign each code item separately, from the inside out. See Creating distribution-signed code for macOS for more details.
Regarding the hardened runtime problem you mentioned, that looks like a library validation issue. You can disable library validation but that’s almost never the right option [1]. If you’re building an application, ensure that all the (native) code within your application is signed by you. That’s sufficient to make library validation happy.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
[1] Library validation is a critical security feature. Also, disabling library validation can cause Gatekeeper problems.