Bleak, PyInstaller, and MacOS code signing

[cjhilder]

Has anyone ever had any success using bleak, PyInstaller, and MacOS code signing? I have successfully run the example file scan_iterator.py, and then built a PyInstaller app with:
% pyinstaller --onefile scan_iterator.py
This command line app works the same as the python script. However, as soon as I add code signing:
% pyinstaller --onefile scan_iterator.py --codesign-identity "Developer ID Application: xxxxxxxx (XXXXXXXX)"
the whole thing grinds to a halt. The app opens without an error, but hangs and requires a force quit. I have tried all manner of combinations of entitlements, to no avail. Is there someone out there who has ever got this to work, and if so, can you share the magic? Maybe there's more to it than entitlements? It's hard to tell because the Apple documentation is as opaque as the error messages (just kidding, there are of course no error messages, just silence).

[dlech]

I haven't tried packaging an app on Mac before, but https://bleak.readthedocs.io/en/latest/troubleshooting.html#bleak-crashes-with-sigabrt-on-macos describes what needs to go in the Info.plist file for Bleak.

[cjhilder]

Thanks for the link. Unfortunately it doesn't prevent the app freezing when it is signed. There does seem to be something else going on here, but I can only say 'seems' because I am not getting any error messages or crash reports. My hope is to find someone who's has actually done it so maybe I can learn the secret from them

[cjhilder]

Turns out the 'magic' is simple: the entitlement required is com.apple.security.cs.allow-unsigned-executable-memory. I think I was including another entitlement (in addition to this one) that 'broke' the signing.
Here's the entitlements.plist file:

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">
<dict>
     <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
     <true/>
</dict>
</plist>

and here's the build command:
% pyinstaller --onefile scan_iterator.py --codesign-identity "Developer ID Application: xxxxxxxx (XXXXXXXX)" --osx-entitlements-file entitlements.plist