After running into this problem too, I discovered that setting append_pkg to False in the EXE section of my app's .spec file left me with an app that codesign happily signed.
The problem appears to be that when append_pkg is True (the default, at least on pyinstaller 1.6), the archive is directly appended to the executable. Since codesign expects the LINKEDIT segment to be at the end of a MachO executable, codesign wasn't happy. From looking at the pyinstaller source, it appeared that append_pkg should default to False for non-ELF executables, but that doesn't appear to be happening on OS X for some reason. After building my app with the aforementioned change, I was able to successfully sign it using: codesign -f -s "Developer ID" myappname.app Hope that helps somebody! Jeff On Wednesday, July 11, 2012 11:56:45 AM UTC-6, Giovanni Bajo wrote: > > Il giorno 11/lug/2012, alle ore 16:15, Nicholas Nassar ha scritto: > > > Mac OS X 10.8 "Mountain Lion" is going to require that all applications > are signed by default. Users will need to disable gatekeeper functionality > in System Preferences in order to run unsigned apps. > > > > Has anyone had success signing pyinstaller app bundles? In theory, it > should be easy, however, I get the following error when I try it with an > app created with pyinstaller 1.5.1. > > > > $ codesign -s "Developer ID Application" TestApp.app > > codesign_allocate: the __LINKEDIT segment does not cover the end of the > file (can't be processed) in: TestApp.app/: object file format > unrecognized, invalid, or unsuitable > > > A PyInstaller binary is a standard Mac binary (the bootloader), with > appended some data files at the end. If codesign makes the wrong > assumption, it will not parse it correctly. Under Windows, it works > flawlessly. > > If you can find me a technical description on how codesigning works on Mac > (how it parses the binary, where the signature is put, etc.), I can see if > there's a way to workaround it. > -- > Giovanni Bajo :: [email protected] <javascript:> > Develer S.r.l. :: http://www.develer.com > > My Blog: http://giovanni.bajo.it > > > > > > > -- You received this message because you are subscribed to the Google Groups "PyInstaller" group. To view this discussion on the web visit https://groups.google.com/d/msg/pyinstaller/-/9MOtezFsGvUJ. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/pyinstaller?hl=en.
