Bug report: pyface.image.image.ImageLibrary._add_volume breaks signed Mac apps
- Dominant language
- Python
- Stars
- 115
- Forks
- 54
- PR merge metrics
- No merged PRs in 30d
Description
## Environment
OS: _Mac_
## Description
I am trying to distribute a large application (https://github.com/cytoflow/cytoflow) on recent Mac OSs. To do so, I use PyInstaller build the app and sign the code with a code certificate, then run it through Apple's notarization service and staple the notarization to the app. When the app is run on a recent version of MacOS, Gatekeeper checks that both the notarization and the underlying signature are valid, then checks the app against the signature before opening it.
Unfortunately, the first time the app is run and an image from the standard library is opened, `pyface.image.image.ImageLibrary._add_volume` is called. Then, because the timestamp on the file is later than the timestamp in the volume (because the file was copied over by PyInstaller), it re-saves the volume. The app works just fine the first time! But the second time the user goes to start it, the timestamp no longer matches the code signature and Gatekeeper refuses to allow it to open.
I know this is a bit of an edge case! It is related to #776 and #1254 .
## Steps to Reproduce
Because this involves PyInstaller and all the Mac code signing nonsense, a minimum reproduction is still too darn complicated. I wrote [a gist](https://gist.github.com/bpteague/750906b9a02094e7389427d308ba1002) about code-signing PyInstaller applications on Macs which covers the steps in detail.
## Proposed fix
Remove re-saving the volume when it is opened -- if the library needs to be updated, developers can call `ImageLibrary.update()`.
## Monkey-patch fix
For anyone else who might run into this and just wants their code to work:
```python
def empty_save(self):
pass
from pyface.image.image import ImageVolume
ImageVolume.save = empty_save
```
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.