cctools erase the signature of osx-arm64 binaries

[folmos-at-orange]

Checklist

• I added a descriptive title
• I searched open reports and couldn't find a duplicate

What happened?

I am packaging a binary executable with conda build. After compilation, I added some code to build.sh to sign my executables so when they are executed there aren't any annoying popups in macOS about "incoming connections" (my executable uses MPICH).

However, when packaging, the cctools package erases my signature. This is evidenced in the logs with messages of the type [cctools-port]: generating fake signature for ....

I did not find any documentation on how to pass certificate information to conda build to sign a package's binary files (the contents, not the package). Is there any "good" way to accomplish this? Or a workaround?

Thanks in advance.

Conda Info

No response

Conda Config

No response

Conda list

No response

Additional Context

No response

[jaimergp]

I think conda-build's signing should prevent those errors for you, no need to sign on your own.

[dholth]

conda wants to replace prefixes in (some?) binaries on installation, so that the C libraries are relocatable / point to libraries within the environment used. This is a tricky combination with signed executables.

[folmos-at-orange]

Yes it is tricky indeed. In the end I did the relocation myself. First I set my self in meta.yaml

• binary_relocation to either false or the list of other files that need to be relocated (usually entry points).
• detect_binary_files_with_prefix to false

In the build.sh I build, then relocate myself with install_name_tool by deleting and then re-setting the RPATH to @loader_path/../lib. Then I sign myself the executable with codesign.

I think there should be a mechanism to execute operations after the conda relocation process. This would be generic and solve this problem in particular.

[github-actions]

Hi there, thank you for your contribution!

This issue has been automatically marked as stale because it has not had recent activity. It will be closed automatically if no further activity occurs.

If you would like this issue to remain open please:

1. Verify that you can still reproduce the issue at hand
2. Comment that the issue is still reproducible and include:
   - What OS and version you reproduced the issue on
   - What steps you followed to reproduce the issue

NOTE: If this issue was closed prematurely, please leave a comment.

Thanks!