| #
c42fc0a9
|
| 11-Sep-2026 |
Jim Jagielski <jimjag@gmail.com> |
macOS: wire notarization into packaging and close release gates
A real Developer ID build - the first this signing work has had - surfaced
gaps ad-hoc testing couldn't: notarization was never invoke
macOS: wire notarization into packaging and close release gates
A real Developer ID build - the first this signing work has had - surfaced
gaps ad-hoc testing couldn't: notarization was never invoked despite being
supported, Gatekeeper was checked before notarizing, and neither the DMG
nor its enclosed app was independently verified.
Also fixes a discarded license-resource return value and an EPM configure
requirement for package formats that never invoke EPM.
show more ...
|
| #
53e1e443
|
| 10-Sep-2026 |
Jim Jagielski <jimjag@gmail.com> |
macOS: add --notarize PROFILE to macosx-codesign.sh
|
| #
e88c2718
|
| 10-Sep-2026 |
Jim Jagielski <jimjag@gmail.com> |
Fix macOS language-pack signing, load-path check and sysconfig data
The load-path check matched each dylib's own @_______ ID and so rejected
every signed build; it now looks only for the CPython sta
Fix macOS language-pack signing, load-path check and sysconfig data
The load-path check matched each dylib's own @_______ ID and so rejected
every signed build; it now looks only for the CPython staging prefix.
show more ...
|
| #
d8849243
|
| 10-Sep-2026 |
Jim Jagielski <jimjag@gmail.com> |
macOS: harden application and disk image signing
Make strict signature verification fail packaging, honor configured
keychains for all artifacts, and limit process entitlements to executable
code. R
macOS: harden application and disk image signing
Make strict signature verification fail packaging, honor configured
keychains for all artifacts, and limit process entitlements to executable
code. Reject unresolved build-time Mach-O load paths before signing.
Use safe argument handling for signing and disk image creation, make
language-pack wrappers valid application bundles, and prevent them from
invalidating signed installations.
Relocate bundled Python's install names, preserve its Darwin sysconfig
data, and update the Spotlight importer for the Contents/program layout.
show more ...
|
| #
f3385db0
|
| 10-Sep-2026 |
Jim Jagielski <jimjag@gmail.com> |
macOS: code-signable bundle layout, opt-in signing of the .app and .dmg
Select patches from the mac-vcl-button-contrast branch.
codesign rejects a bundle with anything but Mach-O binaries in Content
macOS: code-signable bundle layout, opt-in signing of the .app and .dmg
Select patches from the mac-vcl-button-contrast branch.
codesign rejects a bundle with anything but Mach-O binaries in Contents/MacOS,
where scp2 installed everything; the installation now lives in Contents/program.
Signing only runs with --with-macosx-codesigning-identity (or the env var) set.
show more ...
|