Notarizing apps that are made with py2app

[marcvanolmen]

Trying to notarize our app that uses py2app (is used as a plugin bundle) I noticed that generated plugin is creating an executable with:

Load command 6 cmd LC_VERSION_MIN_MACOSX cmdsize 16 version 10.5 sdk 10.8

For getting your app notarized you need at least 10.9 instead of 10.8.

I was trying to build py2app from source, (that works easy) but I need to be able to rebuild the py2app/bundeltemplate from scratch because the included prebuilt need to be updated. Any instructions on how to build this.

[ronaldoussoren]

if you run the "setup.py" script in py2app/bundletemplate the executable gets rebuild. If you do so using a 10.9 SDK you should end up with a binary that works for you.

Note that the script tries to rebuild all variants, including ones that won't build.

[marcvanolmen]

I was able to get it build, but because my machine is setup in the modern way, most of this won't work out of the box. I'm on MacOS 10.14 and Xcode 10: This Xcode only build 64bit intel and no PPC support and i386 support. So I was able to do this by modifying:

So I changed setup.py in py2app/bundletemplate

gPreBuildVariants = [
    # {
    #     "name": "main-universal",
    #     "target": "10.5",
    #     "cflags": "-isysroot @@XCODE_ROOT@@/SDKs/MacOSX10.5.sdk "
    #     "-arch i386 -arch ppc -arch ppc64 -arch x86_64",
    #     "cc": "gcc-4.2",
    # },
    # {
    #     "name": "main-ppc64",
    #     "target": "10.5",
    #     "cflags": "-isysroot @@XCODE_ROOT@@/SDKs/MacOSX10.5.sdk -arch ppc64",
    #     "cc": "gcc-4.2",
    # },
    {
        "name": "main-x86_64",
        "target": "10.9",
        "cflags": "-isysroot @@XCODE_ROOT@@/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.14.sdk -arch x86_64",
        "cc": "clang",
    },

1. This then rebuilds main-x86_64 and install it in the Prebuilt folder.

Load command 7
      cmd LC_VERSION_MIN_MACOSX
  cmdsize 16
  version 10.9
      sdk 10.14
Load command 8

2. Then reinstalled py2app.

And then I was able to Notarize the app at Apple.

[hamishmb]

Anyone else had issues with this? I'm soon to get a developer certificate and begin notarizing.

[hasii2011]

It can be rather opaque. I documented how I sign my py2app applications here: Code Signing

[hamishmb]

Thank you so much, that looks like it will be extremely useful.

[hamishmb]

Could you not use codesign --deep by the way? That's what I use for my adhoc signing at the moment.

[hasii2011]

I tried that and Apple implies that in some instances that does not work; BTW, the scripts are all on my repository and they are well documented; codesign

[hamishmb]

Super useful, thanks for creating that repo.

[iamthaoly]

@hasii2011 I came across your answer while scratching my head signing a Py2app app. The document is very detailed. Thank you so much!

[hasii2011]

You are welcome