Repository navigation
Conversation
The Mac app's interpreter moves from python-build-standalone 20260325 / CPython 3.12.13 (OpenSSL 3.5.5) to 20261021 / CPython 3.12.15 (OpenSSL 3.5.9), for the 3.12.15 security fixes (CVE-2026-19445, CVE-2026-19553). PBS_SHA256 equals the release's SHA256SUMS entry for the aarch64 install_only_stripped asset, GitHub's asset digest, and a local hash of the download. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
python-build-standalone 20261021 links libpython into bin/python3.12 statically (otool -L: CoreFoundation, libSystem, libz, libedit, ncurses, panel, SystemConfiguration); the 20260325 interpreter was a 49 KB stub that loaded @rpath/libpython3.12.dylib. In a built bundle no Mach-O (the interpreter, every .so/.dylib, the Swift launcher) has a load command naming it, and the launcher never dlopens anything, so the 18 MB shared library was shipped and signed for nothing. prune_python now removes it, and require_not_linked fails the build if any remaining Mach-O links it, so a release that goes back to a stub interpreter cannot ship one that does not start. Measured on an unnotarized local build of 0.9.16: zip 78,965,108 -> 71,475,053 bytes, installed 232,893,388 -> 214,740,607 bytes, 74 -> 73 Mach-O. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The Mac app bundles its own CPython from python-build-standalone. Main still pins 20260325 / CPython 3.12.13 (OpenSSL 3.5.5), so the next tag, or any run of the
release-macosjob, would ship that old interpreter. The v0.9.16 draft was rebuilt by hand with a local edit. This PR makes the same change at the source.CPython 3.12.15 (python.org, released 2026-09-30) fixes:
SSLContextwhensni_callbackswitches contextsSSLContext.wrap_bio()skips validatingserver_hostnameHTTPPasswordMgrsent credentials meant for one URL scheme over another)The bundled OpenSSL goes from 3.5.5 to 3.5.9.
What changes
packaging/macos/build_app.py:PBS_RELEASE20260325→20261021,PBS_PYTHON3.12.13→3.12.15,PBS_SHA256→7b8d00b7…a219. The new sha matches three independent sources:SHA256SUMSentry of release 20261021 forcpython-3.12.15+20261021-aarch64-apple-darwin-install_only_stripped.tar.gzshasum -a 256of the downloaded filedocs/design/macos-app-installer.mdnow says 3.12.15. Nothing else in the repo named the old pin.The build drops
libpython3.12.dylib, which nothing loads (its own commit).bin/python3.12was a 49 KB stub that loaded@rpath/libpython3.12.dylib(rpath@executable_path/../lib).bin/python3.12is an 18 MB executable with libpython linked in statically.otool -Llists only CoreFoundation, libSystem, libz, libedit, ncurses, panel and SystemConfiguration.How unused was established, on a built bundle:
otool -Lon all 74 Mach-O files (the interpreter, every.so/.dylib, and the Swift launcherContents/MacOS/Prometheus) finds no reference to libpython. Every@loader_path/@rpathdependency is one of Pillow's own.dylibs.libpythonappears in no binary except the dylib itself.dlopenand execs onlypython/bin/python3.12._sysconfigdata(a build-time config var) and in ctypes' Cygwin-only branch. On macOS,ctypes.pythonapiisPyDLL(None), and it resolves from the static executable.prune_pythonnow removes the dylib. A newrequire_not_linkedcheck runs after pruning: if any remaining Mach-O still links libpython, the build fails. So a future python-build-standalone release that goes back to a stub interpreter cannot ship an app that won't start. Tests cover both the prune and the check (the stub'sotool -Loutput is refused, the static one passes).Measured (local, unnotarized, 0.9.16, default extras)
For comparison, the v0.9.16 app built on 3.12.13 was 71,410,020 B, and the notarized 3.12.15 rebuild was 78,965,277 B. With the prune, the interpreter bump costs about 65 KB of download.
Verified on the pruned bundle
verify_app.pyon the zip (not notarized, so without--notarized): OK. Same result for the dylib-kept build.python3.12 -Ireports 3.12.15 and OpenSSL 3.5.9. These imports succeed:prometheusandprometheus.web.server(0.9.16),fastapi,uvicorn,pypdfium2,PIL(with_imaging),cryptography(including Ed25519 key generation),pydantic/pydantic_core,ssl(create_default_context),sqlite3(3.53.1) andctypes.pythonapi.Contents/MacOS/Prometheus --statusanswers{"ok":true,"state":"not_registered",...}.python3.12 -I -B -m prometheus daemon), a throwaway HOME and a loopback stub model.GET /api/statusreturns 200, a SIGTERM stops it with exit 0, and the log has no traceback.tests/test_macos_app_build.pyand the other macOS packaging tests: 198 passed. Ruff is clean.Not done here: a notarized build of this commit (the release job does that) and a run on a clean Mac.
🤖 Generated with Claude Code