Back to the original discussion from pd-dev, looking at this:
https://cutecoder.org/programming/shared-framework-hardened-runtime/ https://cutecoder.org/programming/shared-framework-hardened-runtime/
If the externals (aka dynamic libs) are built with a macOS deployment target >= 10.9, then they should work without throwing an error. If they are not or are simply older with an older deployment target, they will run into the loading issue. I had added adhoc code-signing and the disable-library-validation exception entitlement to the app build process, so that should make this work, or at least I thought it would.
On May 30, 2020, at 11:39 PM, pd-list-request@lists.iem.at wrote:
Date: Sat, 30 May 2020 14:36:21 -0700 From: Kevin Haywood <khaywood@ucsd.edu mailto:khaywood@ucsd.edu> To: Christof Ressi <info@christofressi.com mailto:info@christofressi.com> Cc: Pd-List <pd-list@lists.iem.at mailto:pd-list@lists.iem.at> Subject: Re: [PD] [PD-announce] pd 0.51-0test2 for Macontosh - another try at code signing Message-ID: <59E927A8-BC97-450A-8287-19BACEE2EA99@ucsd.edu mailto:59E927A8-BC97-450A-8287-19BACEE2EA99@ucsd.edu> Content-Type: text/plain; charset="utf-8"
On May 30, 2020, at 1:46 PM, Christof Ressi <info@christofressi.com mailto:info@christofressi.com> wrote:
For some still-inexplicable reason, my externals started working again in both of these versions of Pd after building and loading a newly-created external. macOS Catalina 10.15.4.
Newly built externals are not blacklisted.
I trust you on that, but loading a newly-created external seems to have resulted in my previously-blacklisted externals also loading with no problem.
In the case of my externals, I would guess that perhaps this might be because the new and old all used the same signing certificate? But that wouldn't explain my friend’s externals which he compiled.
So perhaps there’s something else going on which I’ve missed, because no one else has confirmed this yet : \
Dan Wilcox @danomatika http://twitter.com/danomatika danomatika.com http://danomatika.com/ robotcowboy.com http://robotcowboy.com/
So I _think_ things are working now, although I'm starting to wonder how they're working, give that I think Catalina is insisting that all apps run in "hardened" mode (perhaps I'm wrong on this), and that there's simply no way for a hardened app to load a library that has a "target" < 10.9. The fact that libraries are loading at all makes me think that 0.51-0 test 2 is OK as far as signing goes.
But then I wonder how pre-10.9 externs (libraries) can ever work at all under Catalina. I'm not even feeling sure that the ones in pd/extra should work: I think their target is 10.7 (I compiled them on a 10.7 machine) - but perhaps they work anyway as having fallen under the app when the app itself was signed.
I'm willing to get hold of a newer machine somehow if that proves necessary (and someday I'm sure it will) but want to put that off as long as I can, since each year seems to bring more ways Apple can shaft us.
M
On Sat, May 30, 2020 at 11:54:44PM +0200, Dan Wilcox wrote:
Back to the original discussion from pd-dev, looking at this:
https://urldefense.com/v3/__https://cutecoder.org/programming/shared-framewo... <https://urldefense.com/v3/__https://cutecoder.org/programming/shared-framewo... >
If the externals (aka dynamic libs) are built with a macOS deployment target >= 10.9, then they should work without throwing an error. If they are not or are simply older with an older deployment target, they will run into the loading issue. I had added adhoc code-signing and the disable-library-validation exception entitlement to the app build process, so that should make this work, or at least I thought it would.
On May 30, 2020, at 11:39 PM, pd-list-request@lists.iem.at wrote:
Date: Sat, 30 May 2020 14:36:21 -0700 From: Kevin Haywood <khaywood@ucsd.edu mailto:khaywood@ucsd.edu> To: Christof Ressi <info@christofressi.com mailto:info@christofressi.com> Cc: Pd-List <pd-list@lists.iem.at mailto:pd-list@lists.iem.at> Subject: Re: [PD] [PD-announce] pd 0.51-0test2 for Macontosh - another try at code signing Message-ID: <59E927A8-BC97-450A-8287-19BACEE2EA99@ucsd.edu mailto:59E927A8-BC97-450A-8287-19BACEE2EA99@ucsd.edu> Content-Type: text/plain; charset="utf-8"
On May 30, 2020, at 1:46 PM, Christof Ressi <info@christofressi.com mailto:info@christofressi.com> wrote:
For some still-inexplicable reason, my externals started working again in both of these versions of Pd after building and loading a newly-created external. macOS Catalina 10.15.4.
Newly built externals are not blacklisted.
I trust you on that, but loading a newly-created external seems to have resulted in my previously-blacklisted externals also loading with no problem.
In the case of my externals, I would guess that perhaps this might be because the new and old all used the same signing certificate? But that wouldn't explain my friend???s externals which he compiled.
So perhaps there???s something else going on which I???ve missed, because no one else has confirmed this yet : \
Dan Wilcox @danomatika <https://urldefense.com/v3/__http://twitter.com/danomatika__;!!Mih3wA!UkW9Byo... > danomatika.com <https://urldefense.com/v3/__http://danomatika.com/__;!!Mih3wA!UkW9ByonJFt_VQ... > robotcowboy.com <https://urldefense.com/v3/__http://robotcowboy.com/__;!!Mih3wA!UkW9ByonJFt_V... >
Pd-list@lists.iem.at mailing list UNSUBSCRIBE and account-management -> https://urldefense.com/v3/__https://lists.puredata.info/listinfo/pd-list__;!...
Library loading works because I added the entitlements signing in December. The entitlement that is used explicitly disables the < 10.9 library check.
enohp ym morf tnes
Dan Wilcox danomatika.com robotcowboy.com
On May 31, 2020, at 11:21 PM, Miller Puckette msp@ucsd.edu wrote:
So I _think_ things are working now, although I'm starting to wonder how they're working, give that I think Catalina is insisting that all apps run in "hardened" mode (perhaps I'm wrong on this), and that there's simply no way for a hardened app to load a library that has a "target" < 10.9. The fact that libraries are loading at all makes me think that 0.51-0 test 2 is OK as far as signing goes.
But then I wonder how pre-10.9 externs (libraries) can ever work at all under Catalina. I'm not even feeling sure that the ones in pd/extra should work: I think their target is 10.7 (I compiled them on a 10.7 machine) - but perhaps they work anyway as having fallen under the app when the app itself was signed.
I'm willing to get hold of a newer machine somehow if that proves necessary (and someday I'm sure it will) but want to put that off as long as I can, since each year seems to bring more ways Apple can shaft us.
M
On Sat, May 30, 2020 at 11:54:44PM +0200, Dan Wilcox wrote: Back to the original discussion from pd-dev, looking at this:
https://urldefense.com/v3/__https://cutecoder.org/programming/shared-framewo... <https://urldefense.com/v3/__https://cutecoder.org/programming/shared-framewo... >
If the externals (aka dynamic libs) are built with a macOS deployment target >= 10.9, then they should work without throwing an error. If they are not or are simply older with an older deployment target, they will run into the loading issue. I had added adhoc code-signing and the disable-library-validation exception entitlement to the app build process, so that should make this work, or at least I thought it would.
On May 30, 2020, at 11:39 PM, pd-list-request@lists.iem.at wrote:
Date: Sat, 30 May 2020 14:36:21 -0700 From: Kevin Haywood <khaywood@ucsd.edu mailto:khaywood@ucsd.edu> To: Christof Ressi <info@christofressi.com mailto:info@christofressi.com> Cc: Pd-List <pd-list@lists.iem.at mailto:pd-list@lists.iem.at> Subject: Re: [PD] [PD-announce] pd 0.51-0test2 for Macontosh - another try at code signing Message-ID: <59E927A8-BC97-450A-8287-19BACEE2EA99@ucsd.edu mailto:59E927A8-BC97-450A-8287-19BACEE2EA99@ucsd.edu> Content-Type: text/plain; charset="utf-8"
On May 30, 2020, at 1:46 PM, Christof Ressi <info@christofressi.com mailto:info@christofressi.com> wrote:
For some still-inexplicable reason, my externals started working again in both of these versions of Pd after building and loading a newly-created external. macOS Catalina 10.15.4.
Newly built externals are not blacklisted.
I trust you on that, but loading a newly-created external seems to have resulted in my previously-blacklisted externals also loading with no problem.
In the case of my externals, I would guess that perhaps this might be because the new and old all used the same signing certificate? But that wouldn't explain my friend???s externals which he compiled.
So perhaps there???s something else going on which I???ve missed, because no one else has confirmed this yet : \
Dan Wilcox @danomatika <https://urldefense.com/v3/__http://twitter.com/danomatika__;!!Mih3wA!UkW9Byo... > danomatika.com <https://urldefense.com/v3/__http://danomatika.com/__;!!Mih3wA!UkW9ByonJFt_VQ... > robotcowboy.com <https://urldefense.com/v3/__http://robotcowboy.com/__;!!Mih3wA!UkW9ByonJFt_V... >
Pd-list@lists.iem.at mailing list UNSUBSCRIBE and account-management -> https://urldefense.com/v3/__https://lists.puredata.info/listinfo/pd-list__;!...
-
Dan Wilcox -
Miller Puckette