py2app and Python packaging pipeline for the Mac App Store nested signing entitlements and slimming
Parent: Mac App Store Readiness: Residual Gaps for Sandboxed Monitors · Published reference · snapshot 2026-10-02
↓ Facts as markdownall context files
Source-anchored research for py2app and Python packaging pipeline for the Mac App Store nested signing entitlements and slimming. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Definitions
- The only documented Python MAS recipe is the 2014 Python 2.7 sample. It signs inner frameworks and helper tools recursively, the outer app last, with codesign and an entitlements file setting com.apple.security.app-sandbox, and uploads a .pkg. It warns old py2app builds create invalid Python.framework bundles; py2app 0.8.1+ is needed. (high confidence) [source]
How it works
- Slimming levers for a py2app bundle: py2app --strip (default) removes debug and local symbols and has excludes for modules and dylibs; lipo can thin a universal2 build to one architecture. Any lipo or strip step must run before codesign, because modifying a Mach-O file invalidates its signature. (low confidence) [source]
Problems, failure modes and limitations
- A py2app app signed with a Mac Developer cert plus sandbox entitlements and profile was killed at launch ('Killed: 9', 'Restricted entitlements not validated, bailing out', error -67050). The thread (March 2022, py2app 0.27, macOS 10.13) never reached a resolution, so py2app signing for MAS is an open risk, not a solved recipe. (low confidence) [source]
Facts and statements
- py2app 0.28.10, released 13 Feb 2026, is the latest release; it requires Python 3.10+, fixes setuptools 82 compatibility (pkg_resources removal), and does not support free-threaded Python. (medium confidence) (verified as of 2026-10-02) [source]
- py2app only adds ad-hoc signatures to arm64 binaries on macOS 11+ (needed for them to run). Producing an App Store signed bundle with a sandbox entitlements file and a provisioning profile is left to the developer's own codesign script. (medium confidence) [source]
- py2app has made the embedded Python.framework MAS-compliant since 0.7 by creating the 'Versions/Current' symlink Apple's validator requires. (medium confidence) [source]
- py2app 0.28.2 with Python 3.9.9 failed internal library signing ('invalid or unsupported format for signature' on liblzma.5.dylib). Each bundled dylib/.so must therefore be individually validly signed; py2app's own whole-bundle codesign retry is only a workaround. (low confidence) [source]
- Briefcase adds two default entitlements to every macOS app: com.apple.security.cs.allow-unsigned-executable-memory and com.apple.security.cs.disable-library-validation, both removable. Its macOS reference page does not mention the Mac App Store, sandboxing, or nested-binary signing, so MAS support is unconfirmed from the vendor page. (low confidence) (verified as of 2025-07-10) [source]
- An Aug 2026 project spike (picture_helper) concluded Briefcase (Xcode format, submit via Organizer, entitlements in pyproject.toml, app-sandbox added manually) is the only maintained MAS path in the Python ecosystem. It found no publicly documented published PyQt/PySide app in the MAS built with py2app, and ruled out PyInstaller onefile. This is one project's opinion, not Apple or vendor guidance. (low confidence) (verified as of 2026-08-28) [source]
Children
- No children recorded.