[Python] macOS, arch: x86_64. _arpack.so security policy issue. Unable to load the library

I have signed the shared library '_arpack.so' with developer ID. However macOS refuse to load this library. I checked the library as follow:

% codesign -dvv ./bin/my-agent.app/Contents/MacOS/scipy/sparse/linalg/_eigen/arpack/_arpack.so

Executable=/Users/admintest/my-agent/bin/my-agent.app/Contents/MacOS/scipy/sparse/linalg/_eigen/arpack/_arpack.so
Identifier=ai.my.my-agent.LaunchAgent
Format=Mach-O thin (x86_64)
CodeDirectory v=20400 size=4326 flags=0x10000(runtime) hashes=129+2 location=embedded
Library validation warning=OS X SDK version before 10.9 does not support Library Validation
Signature size=8972
Authority=<removed for privacy>
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=Jan 11, 2025 at 1:35:00 AM
Info.plist=not bound
TeamIdentifier=<removed for privacy>
Sealed Resources=none
Internal requirements count=1 size=196


This line:

Library validation warning=OS X SDK version before 10.9 does not support Library Validation


It seem that the library '_arpack.so' was built with an old macOS SDK (before macOS 10.9). macOS Library Validation (introduced in 10.9) ensures that only signed and properly validated libraries can be loaded into signed binaries. Since '_arpack.so' is using an older SDK, macOS might refuse to load it due to security policies.

To workaround this issue, I built 'Scipy' locally to bind with the newer SDK. I followed the official website instructions to build from source.

% export MACOSX_DEPLOYMENT_TARGET=14.4
% pip uninstall scipy
% pip install scipy --no-build-isolation --no-cache-dir --no-binary scipy


build complete successfully.

I have two questions:

1. Is there a scipy repo that build this FORTRAN library with newer macOS SDK version (>10.9).
2. Even I built locally from source, it seem this library still bonded to the older macOS SDK.I am still working on this. I will build again and review the logs (will share the outcome here).

Continue reading...