You were not unclear. I was trying to be clear that it's probably easier to built Pd yourself than to try to figure out changing entitlements files to trick Gatekeeper. It's not hard and I have to admit I am unwilling to try the linked trick for Supercollider (because I can already build Pd).
On Feb 28, 2023, at 1:26 PM, pd-list-request@lists.iem.at wrote:
Message: 2 Date: Tue, 28 Feb 2023 11:54:27 +0000 From: Pierre Alexandre Tremblay <tremblap@gmail.com mailto:tremblap@gmail.com> Cc: Pd-List <pd-list@lists.iem.at mailto:pd-list@lists.iem.at> Subject: Re: [PD] Attaching Xcode debugger Message-ID: <4C0811D9-F180-42A3-8643-D149E7F64F72@gmail.com mailto:4C0811D9-F180-42A3-8643-D149E7F64F72@gmail.com> Content-Type: text/plain; charset="utf-8"
Thanks for these
I was unclear - I?m trying to debug an external (all flags ok) to a downloaded version of Pd and this is where the sandboxing is freaking out lldb. In the article I pointed, they show how to modify the entitlements of the host, which I did successfully for a downloaded version of SuperCollider, but I don?t seem able to do this with the downloaded version of Pd...
Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
Here's my little cheat-sheet for setting the Gatekeeper entitlements (for RTcmix, of course :-) -- but make the appropriate substitutions in the directions):
http://sites.music.columbia.edu/brad/osx-windows-new-RTcmixes/annoying.html
It still works on my Monterey Macs -- I hope Apple doesn't get annoying yet again.
brad
On Tue, Feb 28, 2023 at 1:14 PM Dan Wilcox danomatika@gmail.com wrote:
You were not unclear. I was trying to be clear that it's probably easier to built Pd yourself than to try to figure out changing entitlements files to trick Gatekeeper. It's not hard and I have to admit I am unwilling to try the linked trick for Supercollider (because I can already build Pd).
On Feb 28, 2023, at 1:26 PM, pd-list-request@lists.iem.at wrote:
Message: 2 Date: Tue, 28 Feb 2023 11:54:27 +0000 From: Pierre Alexandre Tremblay tremblap@gmail.com Cc: Pd-List pd-list@lists.iem.at Subject: Re: [PD] Attaching Xcode debugger Message-ID: 4C0811D9-F180-42A3-8643-D149E7F64F72@gmail.com Content-Type: text/plain; charset="utf-8"
Thanks for these
I was unclear - I?m trying to debug an external (all flags ok) to a downloaded version of Pd and this is where the sandboxing is freaking out lldb. In the article I pointed, they show how to modify the entitlements of the host, which I did successfully for a downloaded version of SuperCollider, but I don?t seem able to do this with the downloaded version of Pd...
Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com robotcowboy.com
Pd-list@lists.iem.at mailing list UNSUBSCRIBE and account-management -> https://lists.puredata.info/listinfo/pd-list
Actually I was wrong in my last email referring to Brad's suggestion... disabling the quarantine for an unsigned dynamic lib may be required on a user system and this is one way to remove the quarantine flag, for sure. I was thinking of a full .app bundle.
if you build the dynamic lib, it should generally load without triggering Gatekeeper. Gatekeeper comes into play once you distribute the app or lib. For Pd, we added the dynamic lib entitlement to allow loading unsigned libs on 10.15+.
Anyway, I think I'm adding too much noise now, sorry.
On Feb 28, 2023, at 7:29 PM, Brad Garton garton@columbia.edu wrote:
Here's my little cheat-sheet for setting the Gatekeeper entitlements (for RTcmix, of course :-) -- but make the appropriate substitutions in the directions):
http://sites.music.columbia.edu/brad/osx-windows-new-RTcmixes/annoying.html http://sites.music.columbia.edu/brad/osx-windows-new-RTcmixes/annoying.html
It still works on my Monterey Macs -- I hope Apple doesn't get annoying yet again.
brad
Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
No actually this is all good - the take-home-message is that compiled Pd won’t link (it runs fine and Brad’s trick is still good for other use cases indeed)
So I will try to force it to accept my entitlements - if I manage I’ll let you know my recipe :)
On 28 Feb 2023, at 21:21, Dan Wilcox danomatika@gmail.com wrote:
Actually I was wrong in my last email referring to Brad's suggestion... disabling the quarantine for an unsigned dynamic lib may be required on a user system and this is one way to remove the quarantine flag, for sure. I was thinking of a full .app bundle.
if you build the dynamic lib, it should generally load without triggering Gatekeeper. Gatekeeper comes into play once you distribute the app or lib. For Pd, we added the dynamic lib entitlement to allow loading unsigned libs on 10.15+.
Anyway, I think I'm adding too much noise now, sorry.
On Feb 28, 2023, at 7:29 PM, Brad Garton <garton@columbia.edu mailto:garton@columbia.edu> wrote:
Here's my little cheat-sheet for setting the Gatekeeper entitlements (for RTcmix, of course :-) -- but make the appropriate substitutions in the directions):
http://sites.music.columbia.edu/brad/osx-windows-new-RTcmixes/annoying.html http://sites.music.columbia.edu/brad/osx-windows-new-RTcmixes/annoying.html
It still works on my Monterey Macs -- I hope Apple doesn't get annoying yet again.
brad
Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
Ok I got it to work - there was on colon missing in the article, so here are my steps to make the downloaded Pd linkable to the debugger:
- extract the current pd executable entitlements (don’t forget the colon before the path as this is an option to remove the blob)
codesign -d /Applications/Pd-0.53-0.app/Contents/Resources/bin/pd --entitlements :/tmp/pd-entitlement.xml
- open /tmp/pd-entitlement.xml should start it in Xcode. Add this key to it and save
<key>com.apple.security.get-task-allow</key> <true/>
- replace the entitlement back with this code:
codesign -s - --deep --force --options=runtime --entitlements /tmp/pd-entitlement.xml /Applications/Pd-0.53-0.app/Contents/Resources/bin/pd
Voilà! Link pd (not Pd) to your debugger and you’re as happy as me!
On 28 Feb 2023, at 21:21, Dan Wilcox danomatika@gmail.com wrote:
Actually I was wrong in my last email referring to Brad's suggestion... disabling the quarantine for an unsigned dynamic lib may be required on a user system and this is one way to remove the quarantine flag, for sure. I was thinking of a full .app bundle.
if you build the dynamic lib, it should generally load without triggering Gatekeeper. Gatekeeper comes into play once you distribute the app or lib. For Pd, we added the dynamic lib entitlement to allow loading unsigned libs on 10.15+.
Anyway, I think I'm adding too much noise now, sorry.
On Feb 28, 2023, at 7:29 PM, Brad Garton <garton@columbia.edu mailto:garton@columbia.edu> wrote:
Here's my little cheat-sheet for setting the Gatekeeper entitlements (for RTcmix, of course :-) -- but make the appropriate substitutions in the directions):
http://sites.music.columbia.edu/brad/osx-windows-new-RTcmixes/annoying.html http://sites.music.columbia.edu/brad/osx-windows-new-RTcmixes/annoying.html
It still works on my Monterey Macs -- I hope Apple doesn't get annoying yet again.
brad
Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
I assume you just want to add the com.apple.security.get-task-allow entitlement key:
https://stackoverflow.com/a/68195208/2146055 https://stackoverflow.com/a/68195208/2146055
In this case, you would add it to mac/stuff/pd.entitlements, then build the .app bundle with the mac/osx-app.sh script.
Here is an arm64 build which is debuggable as I added the entitlements flag.
./configure --enable-debug
Pd-0.53-2-arm64-debuggable.zip http://docs.danomatika.com/pdbuilds/0.53/Pd-0.53-2-arm64-debuggable.zip
I tested with lddb:
lldb Pd.0.53-2-arm64-debuggable.app/Contents/Resources/bin/pd process launch
Brad's suggestion is related to the Gatekeeper download quarantine which is applied when an .app is downloaded in a zip or unnotarized DMG. This is a different issue and the easiest remedy is to ask the user to manually copy it somewhere like /Applications, then back which generally removes the quarantine flag. The *better* option from a user standpoint is to distribute the signed app within a notarized DMG. I have a makefile for that, since I had to figure this all out again last fall: https://github.com/zkmkarlsruhe/mac-dist-helper https://github.com/zkmkarlsruhe/mac-dist-helper
There is also "App Translocation" which is related to trying to load Resources outside of the app sandbox... you can read all about this here: https://www.synack.com/blog/untranslocating-apps/ https://www.synack.com/blog/untranslocating-apps/
;)
On Feb 28, 2023, at 7:13 PM, Dan Wilcox danomatika@gmail.com wrote:
You were not unclear. I was trying to be clear that it's probably easier to built Pd yourself than to try to figure out changing entitlements files to trick Gatekeeper. It's not hard and I have to admit I am unwilling to try the linked trick for Supercollider (because I can already build Pd).
On Feb 28, 2023, at 1:26 PM, pd-list-request@lists.iem.at mailto:pd-list-request@lists.iem.at wrote:
Message: 2 Date: Tue, 28 Feb 2023 11:54:27 +0000 From: Pierre Alexandre Tremblay <tremblap@gmail.com mailto:tremblap@gmail.com> Cc: Pd-List <pd-list@lists.iem.at mailto:pd-list@lists.iem.at> Subject: Re: [PD] Attaching Xcode debugger Message-ID: <4C0811D9-F180-42A3-8643-D149E7F64F72@gmail.com mailto:4C0811D9-F180-42A3-8643-D149E7F64F72@gmail.com> Content-Type: text/plain; charset="utf-8"
Thanks for these
I was unclear - I?m trying to debug an external (all flags ok) to a downloaded version of Pd and this is where the sandboxing is freaking out lldb. In the article I pointed, they show how to modify the entitlements of the host, which I did successfully for a downloaded version of SuperCollider, but I don?t seem able to do this with the downloaded version of Pd...
Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
-
Brad Garton -
Dan Wilcox -
Pierre Alexandre Tremblay