MacOS graphical install¶ Download the graphical macOS installer for your version of Python. RECOMMENDED: Verify data integrity with SHA-256. For more information on hashes, see What about cryptographic hash verification? Double-click the downloaded file and click continue to start the installation. Cclauss changed the title Python version for MAC catalina Python version for macOS Catalina May 11, 2021. Cclauss added the macOS label May 11, 2021. Nevertheless, presumably because of the compatibility issues, Apple has always pre-installed Python 2 with macOS and still does so in macOS 10.15 Catalina. With the announcement of Catalina, Apple also announced that in a “future version of macOS” there will be no pre-installed Python of any version.
Python has an amazingly rich ecosystem of libraries, tools and frameworks. It is a clean, modern language, it allowsfor rapid prototyping and quick development cycles. UI was not the central, focal point of my app, so it made a lotof sense for me to do it in Python: I thought I’d write the core functionality first, and add the UI afterwards.
- Install Anaconda (Python 3.7) on Mac OSX Catalina. Nonthakon Jitchiranant.
- In Catalina 10.15.4, from Terminal, python2 -version returns Python 2.7.16 python3 -version returns Python 3.7.3 which python or python -version tells what version is used by default. To use python3 instead of python2, I added an alias echo 'alias python='python3' /.zshrc.
MacOS Catalina (released in 2019) still does not have Python 3 installed by default, only Python 2. Therefore, I neededa way to package the whole application into an app bundle and not make it dependent on user’s Python installation.There are several tools that help with that: py2app,briefcase, pyinstaller. I decided to usePyInstaller, it’s mature, flexible, and offers more customization than the other options.
Step 1: PyInstaller spec file
PyInstaller can be driven by command-line options alone, but that works well for the simplest cases only, and packagingany non-trivial app is not one of these. I suggest running it with command-line parameters, which creates the spec filewith the default values, and then modifying the spec file to suit your needs better. For example, to set the bundleversion to the same value as the application version, and to add some custom plist values:
Step 2: Build the App
This is as simple as
My Application.app will be created, which you can (and should) test to make sure it actually works. Some Pythonpackages require tweaks in PyInstaller spec file: including extra data files in the bundle, etc.
Step 3: Sign the App
In order to be able to notarize it, you must use the hardened run-time.The Hardened Runtime doesn’t affect the operation of most apps, but it does disallow certain capabilities. For Pythonapplications specifically, we need to allow unsigned executable memory. If your app relies on any other capabilitythat the Hardened Runtime restricts, add an entitlement to disable that individual protection as well.
Add entitlements.plist to your project’s root:
And now we’re ready to sign:
Note that in order to be able to notarize the app, you need to sign it with your Apple Developer IDcertificate. Adjust the “Developer” above to match your certificate name, if needed.
Apple recommends to not “deep-sign”, but in this case it’s actually required as all the bundled Python libraries doneed to be signed, not just your main binary.
By adding the --timestamp parameter we include a secure timestamp with the code-signing signature. This is arequirement for notarization.
Python 2.7 Macos Catalina
By adding the entitlements file and passing a -o runtime parameter we enable the hardened runtime, which is alsoa requirement for notarization.
Step 3: Notarize the App
In order to be able to notarize the app,you need to satisfy some additional requirements:
All the binaries in the application must be linked against macOS 10.9 or later SDK. If you just re-built everythingwith a recent Xcode, this requirement would be satisfied. If, however, you’re packaging some Python dependency witha pre-built binary extension, it might be built against an older SDK. In this case, you’ll need to build this specificpackage from source.
Do not include entitlements that are specifically prohibited. At the time of this writing it’s just one
com.apple.security.get-task-allowentitlement.
Store Apple credentials in the keychain
In order to notarize the app, altool must be able to access Apple APIs on your behalf. To secure this access,store your Apple account credentials in the keychain:
Notarize it!
Since altool expects a Zip archive and not a bare .app directory, create a Zip file first and then notarize it:.
Now you need to wait for the notarization results. You’ll get an email from Apple once it’s complete, stating eithera success or failure (and linking to the error logs in this case).
Step 4: Staple the App
In the notarization step above, Apple has created a “ticket”, which is basically a database record which matches yourapp’s signature and saying that it’s been notarized. Your binary has not been modified in any way. When MacOS runsthis app, it will contact Apple servers and ask for a ticket. If such a ticket exists, the app is deemed “notarized”This will happen only once, and then MacOS will cache the results.
If we want to speed up this initial application execution, or if we want to be able to run it when offline, we need to“staple this ticket to the app”, which downloads the ticket and attaches it to your binary. This is as simple as:
This step is optional, but it must be run only after you received an email from Apple stating that the notarizationwas successful.
Step 5: Verify
Now is the good time to verify that everything is in order:
This command uses Gatekeeper directly to assess whether the application is correctly signed and notarized. It shouldreport:
Conclusion
While the process outlined above works today, it is certainly cumbersome and has some downsides:
The development and build process is much more complicated than the normal MacOS development process with Xcode.Getting new developers onboard would be tricky.
It is hard to control the libraries that are being pulled in into your app. If some of the dependencies were builtwith Homebrew, the application probably won’t work on MacOS versions older than the build machine.
Python 3 For Macos Catalina
In my opinion, writing MacOS applications in Python is an acceptable route for prototyping, or for building simplein-house tools quickly, and even notarizing the app is perfectly doable.
At some point in the beta program of macOS Catalina Homebrew’s python 3 broke and only ended up showing an “Abort trap: 6” for every command that involved using it. This included pip3 and other tools that were previously downloaded and worked as expected.
After a bit of searching I found hints that there was an issue with some OpenSSL libraries. Using the current openssl package, Homebrew has openssl@1.1, there’s a simple fix (exact command might differ once the package gets updated) for the problem:
ln -s /usr/local/Cellar/openssl@1.1/1.1.1d/lib/libcrypto.dylib /usr/local/lib/libcrypto.dylib
ln -s /usr/local/Cellar/openssl@1.1/1.1.1d/lib/libssl.dylib /usr/local/lib/libssl.dylib
Python For Mac Catalina
This will take care of it until openssl gets updated and the symlinks eventually break. I’m sure I’ll have to get back here to remind myself on how this gets fixed in the future.