Merge pull request #5 from gu0keno0/unsign_py

gregneagle · web-flow · commit f4c4110f36ac · 2020-11-07T09:37:10.000-08:00
Add --unsign / --no-unsign cmdline options to allow unsigning relocat…
diff --git a/locallibs/fix.py b/locallibs/fix.py
@@ -19,8 +19,13 @@
 
 import os
 import shutil
+import subprocess
 import sys
 
+
+UNSIGN_TOOL = "/usr/bin/codesign"
+
+
 def ensure_current_version_link(framework_path, short_version):
     '''Make sure the framework has Versions/Current'''
     versions_current_path = os.path.join(framework_path, "Versions/Current")
@@ -119,3 +124,17 @@ def fix_other_things(framework_path, short_version):
     future'''
     return (ensure_current_version_link(framework_path, short_version) and
             fix_script_shebangs(framework_path, short_version))
+
+
+def fix_broken_signatures(files_relocatablized):
+    """
+    Unsign the binaries and libraries that were relocatablized to avoid
+    them having corrupted signatures.
+    """
+    for file in files_relocatablized:
+        print("Unsigning %s to avoid broken signature." % file)
+        subprocess.check_call([
+            UNSIGN_TOOL,
+            "--remove-signature",
+            file,
+        ])
diff --git a/locallibs/relocatablizer.py b/locallibs/relocatablizer.py
@@ -247,9 +247,11 @@ def relocatablize(framework_path):
     )
     fix_modes(full_framework_path)
     framework_data = analyze(full_framework_path)
+    files_changed = set()
     for dylib in framework_data["dylibs"]:
         old_install_name = dylib["install_name"]
         new_install_name = relativize_install_name(dylib["path"])
+        files_changed.add(dylib["path"])
         # update other files with new install_name
         if old_install_name != new_install_name:
             files = (
@@ -260,7 +262,11 @@ def relocatablize(framework_path):
             for item in files:
                 if old_install_name in item["dependencies"]:
                     fix_dep(item["path"], old_install_name, new_install_name)
+                    files_changed.add(item["path"])
         print()
     # add rpaths to executables
     for item in framework_data["executables"]:
         add_rpath(item["path"])
+        files_changed.add(item["path"])
+
+    return files_changed
diff --git a/make_relocatable_python_framework.py b/make_relocatable_python_framework.py
@@ -21,7 +21,7 @@
 import optparse
 
 from locallibs import get
-from locallibs.fix import fix_other_things
+from locallibs.fix import fix_broken_signatures, fix_other_things
 from locallibs.install import install_extras
 from locallibs.relocatablizer import relocatablize
 
@@ -61,6 +61,13 @@ def main():
         "Python modules to be installed. If not provided, certain useful "
         "modules for macOS will be installed.",
     )
+    parser.add_option(
+        "--no-unsign",
+        dest="unsign",
+        action="store_false",
+        help="Do not unsign binaries and libraries after they are relocatablized."
+    )
+    parser.set_defaults(unsign=True)
     options, _arguments = parser.parse_args()
 
     framework_path = get.FrameworkGetter(
@@ -70,7 +77,9 @@ def main():
     ).download_and_extract(destination=options.destination)
 
     if framework_path:
-        relocatablize(framework_path)
+        files_relocatablized = relocatablize(framework_path)
+        if options.unsign:
+            fix_broken_signatures(files_relocatablized)
         short_version = ".".join(options.python_version.split(".")[0:2])
         install_extras(
             framework_path,
