fix(darwin): check every architecture slice for a linker signature

replace_linker_signatures asked `codesign -d` about a single slice, the
one codesign reports by default for the build machine. The linker signs
arm64 slices and leaves x86_64 slices unsigned unless linked with
-adhoc_codesign, so python-build's universal stdlib modules carry a
linker-signed arm64 slice next to an unsigned x86_64 one. On an Intel
Mac the helper saw only the unsigned slice and skipped every such file,
and a linker-signed x86_64 slice next to an ad-hoc arm64 one was missed
on any machine.

Each slice listed by `lipo -archs` is checked with
`codesign -d --architecture`, and a file with any linker-signed slice is
re-signed as a whole. `codesign --verify` cannot serve as a shortcut
because it accepts linker signatures. The CI check inspects every slice
the same way and names the offending one.

Author: ndonkoHenri

.github/workflows/ci.yml

@@ -153,12 +153,15 @@ jobs:
           linker_signed=0
           while IFS= read -r bin; do
             total=$((total + 1))
-            case $(codesign -d --verbose=1 "$bin" 2>&1) in
-              *"CodeDirectory "*linker-signed*)
-                echo "::error::Linker-signed: ${bin#"$app"/}"
-                linker_signed=$((linker_signed + 1))
-                ;;
-            esac
+            for arch in $(lipo -archs "$bin" 2>/dev/null); do
+              case $(codesign -d --verbose=1 --architecture "$arch" "$bin" 2>&1) in
+                *"CodeDirectory "*linker-signed*)
+                  echo "::error::Linker-signed ($arch slice): ${bin#"$app"/}"
+                  linker_signed=$((linker_signed + 1))
+                  break
+                  ;;
+              esac
+            done
           done < <(find "$app/Contents/Resources" -type f \( -name '*.so' -o -name '*.so.*' -o -name '*.dylib' \))
           echo "Checked $total bundled native libraries, $linker_signed linker-signed."
           [ "$total" -gt 0 ] && [ "$linker_signed" -eq 0 ]

src/serious_python_darwin/darwin/linker_signatures.sh

@@ -3,7 +3,8 @@
 # replace_linker_signatures <dir>...
 #
 # Re-signs ad-hoc every `.so`, `.so.*` and `.dylib` under the given directories
-# that carries the signature the linker attached when it built the file.
+# that has an architecture slice carrying the signature the linker attached
+# when it built the file.
 #
 # A linker signature names the code after the output file, extension included
 # (`_ssl.cpython-314-darwin.so`), and codesign never carries metadata over from
@@ -16,17 +17,22 @@
 # designated Requirement"). A regular ad-hoc signature's identifier is carried
 # over by re-signing, so the requirement and the signature agree.
 #
-# Files are inspected one at a time, because `codesign -d` given several paths
-# stops at the first one that is not signed. Anything that is not
-# linker-signed -- already re-signed, unsigned, or not Mach-O at all -- is left
-# untouched, so a repeated run only re-checks. Ad-hoc signing is deterministic,
-# so re-signing a fresh copy of the same file reproduces the same bytes. Paths
-# containing newlines are not supported.
+# Every slice of a universal file is inspected, one file at a time: `codesign
+# -d` reports a single slice unless `--architecture` selects one, which slice
+# that is depends on the build machine, and given several paths it stops at the
+# first one that is not signed. The linker signs arm64 slices and usually
+# leaves x86_64 slices unsigned, so the linker signature is often on a slice
+# other than the reported one. `codesign --verify` accepts linker signatures,
+# so it cannot tell them apart. A file with any linker-signed slice is
+# re-signed, all slices at once. Anything else -- already re-signed, unsigned,
+# or not Mach-O at all -- is left untouched, so a repeated run only re-checks.
+# Ad-hoc signing is deterministic, so re-signing a fresh copy of the same file
+# reproduces the same bytes. Paths containing newlines are not supported.
 #
 # Returns non-zero, after printing the error, when a directory cannot be listed
 # or a file cannot be re-signed.
 replace_linker_signatures() {
-    local dir files bin err
+    local dir files bin archs arch err
     for dir in "$@"; do
         [ -d "$dir" ] || continue
         if ! files=$(find "$dir" -type f \( -name '*.so' -o -name '*.so.*' -o -name '*.dylib' \)); then
@@ -35,14 +41,18 @@ replace_linker_signatures() {
         fi
         while IFS= read -r bin; do
             [ -n "$bin" ] || continue
-            case $(codesign -d --verbose=1 "$bin" 2>&1) in
-                *"CodeDirectory "*linker-signed*) ;;
-                *) continue ;;
-            esac
-            if ! err=$(codesign --force --sign - "$bin" 2>&1); then
-                echo "replace_linker_signatures: codesign failed for $bin: $err" >&2
-                return 1
-            fi
+            archs=$(lipo -archs "$bin" 2>/dev/null) || continue
+            for arch in $archs; do
+                case $(codesign -d --verbose=1 --architecture "$arch" "$bin" 2>&1) in
+                    *"CodeDirectory "*linker-signed*) ;;
+                    *) continue ;;
+                esac
+                if ! err=$(codesign --force --sign - "$bin" 2>&1); then
+                    echo "replace_linker_signatures: codesign failed for $bin: $err" >&2
+                    return 1
+                fi
+                break
+            done
         done <<EOF
 $files
 EOF