py2app icon indicating copy to clipboard operation
py2app copied to clipboard

Avoid saving sensitive information in Info.plist

Open octimot opened this issue 5 months ago • 0 comments

After freezing the app, I noticed that the Info.plist might contain the path to the python executable used by py2app.:

Here's a sample

<key>PythonInfoDict</key>
	<dict>
		<key>PythonExecutable</key>
		<string>/path/to/my/python</string>     <--- this string 
                ....
	</dict>
....

My way of fixing this is using the following plutil command:

plutil -replace PythonInfoDict.PythonExecutable - string 'venv/bin/python' [PATH_TO_BUNDLE]/Contents/

Note that you potentially have to re-sign the app bundle after doing this!

The path might contain the MacOS user name, or folder structures from the developer's computer, especially when using python executables from different locations on their system.

Is there a better way to avoid this path leak into the Info.plist file? Also, is this path actually necessary or used by anything after distribution?

Cheers!

octimot avatar Jan 27 '24 07:01 octimot