mostly dep updates, remove bad option to RP #65

arubdesu · 2025-06-18T06:07:26Z

--no-unsign was the culprit stopping pip from updating (and several of the pip pkg versions in minimal weren't installing cleanly), dropped that flag and bumped sha's of RP/MP among other minor whitespace/comment tweaks.
Haven't tested with signing, more than happy to look at build stuff even though I have ~negative GitHub CI experience 😅

--no-unsign was the culprit stopping pip from updating and several of the old pip versions weren't installing cleanly, bumped those versions and sha's of RP/MP among other minor tweaks.

as flagged after previous commit

natewalck

As far as pip, can you expand on what was happening there? Was pip unable to
update itself after installing the resulting package?

With signing, we may need to add that back.

natewalck · 2025-06-24T13:06:24Z

.github/workflows/build_python_3.11.yml

@@ -84,7 +84,7 @@ jobs:
        files: ${{github.workspace}}/outputs/*.pkg

    - name: Upload packages
-      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+      uses: actions/upload-artifact@v4.6.2


Grab the commit hash of this version and use that instead if you would. The tag can change the underlying commit and we never want this to change out from under us.

natewalck · 2025-06-24T13:07:26Z

build_python_framework_pkgs.zsh

-# kill homebrew packages
-/usr/local/bin/brew remove --force $(/usr/local/bin/brew list)
+# # kill homebrew packages
+# /usr/local/bin/brew remove --force $(/usr/local/bin/brew list)


We had issues where homebrew stuff would creep into the build and cause issues. Not sure what the impact of doing this will be.

gotit, restoring

Yeah it will break building the packages on the GitHub runner images.

instead of tag use commit, in case build node needs homebrew purgin'

arubdesu · 2025-06-24T14:04:57Z

As far as pip, can you expand on what was happening there? Was pip unable to update itself after installing the resulting package?

ensurepip/the python.org interpreter RP was downloading was unable to run (on Apple Silicon vs. how the old runners were intel-only) because we explicitly weren't resigning and AMFId was SIGKILL'ing, then the versions pinned in the reqs.txt weren't cutting the mustard...

erikng · 2025-06-24T14:08:30Z

There's no way this will work on the notarizing side. I used that flag to get it to work.

erikng · 2025-06-24T14:09:16Z

I'm happy to try it and be proven wrong but why all of the other script changes? Those are working well and I'm not sure we need to make those other changes at this time.

arubdesu · 2025-06-24T14:27:59Z

So I should at least plug in certs I have access to locally to confirm? There's essentially one flag omitted when it comes to material changes, I've rolled the others back/forward as requested... if you'd rather not give it a shot until I confirm notarization works I'm happy to do so, but if it ends up still bork3d on GitHubs runners it would take me a bit longer

natewalck · 2025-06-24T14:27:51Z

build_python_framework_pkgs.zsh

@@ -96,7 +97,7 @@ if [ -d "${PIPCACHEDIR}" ]; then
    /usr/bin/sudo /bin/rm -rf "${PIPCACHEDIR}"
 fi

-# kill homebrew packages
+# # kill homebrew packages


Nit, but get rid of the extra # so it doesn't show as a change.

natewalck · 2025-06-24T14:29:15Z

build_python_framework_pkgs.zsh

@@ -235,7 +224,7 @@ else
  /usr/bin/find "$TOOLSDIR/$TYPE/payload${FRAMEWORKDIR}/Python3.framework/Versions/${PYTHON_BIN_VERSION}/lib" -type f -name "*dylib" -exec /usr/bin/codesign -s - --preserve-metadata=identifier,entitlements,flags,runtime -f {} \;
  /usr/bin/codesign -s - --deep --force --preserve-metadata=identifier,entitlements,flags,runtime "$TOOLSDIR/$TYPE/payload${FRAMEWORKDIR}/Python3.framework/Versions/${PYTHON_BIN_VERSION}/Resources/Python.app"
  /usr/bin/codesign -s - --force --preserve-metadata=identifier,entitlements,flags,runtime "$TOOLSDIR/$TYPE/payload${FRAMEWORKDIR}/Python3.framework/Versions/${PYTHON_BIN_VERSION}/Python"
-  /usr/bin/codesign -s - --force --preserve-metadata=identifier,entitlements,flags,runtime "$TOOLSDIR/$TYPE/payload${FRAMEWORKDIR}Python3.framework/Versions/Current/Python"
+  /usr/bin/codesign -s - --force --preserve-metadata=identifier,entitlements,flags,runtime "$TOOLSDIR/$TYPE/payload${FRAMEWORKDIR}/Python3.framework/Versions/Current/Python"


What is this doing? I think the / are in the FRAMEWORKDIR var, which, admittedly, isn't my favorite.

This seems like an out of scope change, so let's keep this as tidy as we can, let the CI/CD cut a build and then adjust as needed.

it will almost certainly fail as-is, as per the lines directly preceding where there isn't the trailing forwardslash in the var... your call

(I should be honest and say I don't know if it will have any effect on the signing of that exact path in the payload/as installed)

This worked the last time we ran it, so I have to assume its something silly in the github action :D

Speaking of which, you'll want to copy this: https://github.com/macadmins/python/blob/main/.github/workflows/build_python_3.12.yml

And update it for 3.13 as well.

it's just typing

natewalck · 2025-06-24T15:12:07Z

build_python_framework_pkgs.zsh

-if [[ "${PYTHON_MAJOR_VERSION}" == "3.9" ]]; then
-  /bin/ln -s "$PYTHON_BIN_NEW" "$TOOLSDIR/$TYPE/payload/usr/local/bin/managed_python3"
-fi
-if [[ "${PYTHON_MAJOR_VERSION}" == "3.10" ]]; then
-  /bin/ln -s "$PYTHON_BIN_NEW" "$TOOLSDIR/$TYPE/payload/usr/local/bin/managed_python3"
-fi
-if [[ "${PYTHON_MAJOR_VERSION}" == "3.11" ]]; then
-  /bin/ln -s "$PYTHON_BIN_NEW" "$TOOLSDIR/$TYPE/payload/usr/local/bin/managed_python3"
-fi
-if [[ "${PYTHON_MAJOR_VERSION}" == "3.12" ]]; then
-  /bin/ln -s "$PYTHON_BIN_NEW" "$TOOLSDIR/$TYPE/payload/usr/local/bin/managed_python3"
-fi


Also, I knew there had to be a reason for this: https://github.com/macadmins/python/blob/main/.github/workflows/build_python_3.12.yml

Looks liker there is a workflow for each major Python 3 version, so removing this will break the other build files. I'd add 'em back for now.

If you have the energy to refactor later, I'd entertain that.

arubdesu · 2025-06-25T00:49:08Z

I hadn't properly anticipated the build environment and made probably inapplicable changes, closing in deference to starting over in a new one

arubdesu added 2 commits June 18, 2025 15:05

mostly dep updates, remove bad option to RP

cb6587a

--no-unsign was the culprit stopping pip from updating and several of the old pip versions weren't installing cleanly, bumped those versions and sha's of RP/MP among other minor tweaks.

potentially fix test issue

7664d6c

as flagged after previous commit

natewalck requested changes Jun 24, 2025

View reviewed changes

as per recommended restorations

4c19213

instead of tag use commit, in case build node needs homebrew purgin'

arubdesu requested a review from natewalck June 24, 2025 14:00

natewalck requested changes Jun 24, 2025

View reviewed changes

restore whitespace

e95b45e

it's just typing

natewalck reviewed Jun 24, 2025

View reviewed changes

arubdesu closed this Jun 25, 2025

arubdesu deleted the 2025_updates branch June 25, 2025 00:49

mostly dep updates, remove bad option to RP #65

mostly dep updates, remove bad option to RP #65

Uh oh!

Conversation

arubdesu commented Jun 18, 2025

Uh oh!

natewalck left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arubdesu commented Jun 24, 2025

Uh oh!

erikng commented Jun 24, 2025

Uh oh!

erikng commented Jun 24, 2025

Uh oh!

arubdesu commented Jun 24, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arubdesu commented Jun 25, 2025

Uh oh!

Uh oh!