feat: re-implement delocate for repairing macOS wheels#3114
Draft
feat: re-implement delocate for repairing macOS wheels#3114
Conversation
Add arwen = 0.0.5 (Mach-O patching) and arwen-codesign = 0.0.1-alpha.1 (pure Rust ad-hoc codesigning) as optional dependencies behind a new 'auditwheel' Cargo feature. Add 'auditwheel' to the 'full' feature list. These enable cross-platform wheel repair: - macOS: Mach-O install name rewriting and ad-hoc codesigning - Works from any host OS (pure Rust, no macOS tools needed)
Add src/auditwheel/macos.rs with MacOSRepairer that uses arwen for Mach-O install name/rpath manipulation and arwen-codesign for pure-Rust ad-hoc code signing. No macOS-only tool dependencies. Key behavior: - Filters system libraries (/usr/lib/*, /System/*) and libpython - Rewrites LC_LOAD_DYLIB to @loader_path-relative names - Sets LC_ID_DYLIB to /DLC/<libs_dir>/<name> (matching delocate) - Removes absolute rpaths, keeps @loader_path/@executable_path - Ad-hoc codesigns all modified binaries (cross-platform) - Uses .dylibs directory (matching delocate convention)
Update auditwheel/mod.rs to export MacOSRepairer (feature-gated behind 'auditwheel'). Wire it into make_repairer() in build_context/repair.rs so macOS builds use MacOSRepairer for wheel repair instead of returning None.
The is_libpython check now recognizes Python.framework paths in addition to traditional libpython3.*.dylib files. This fixes pyo3-bin bindings that link against /Library/Frameworks/Python.framework/Versions/X/Python. Also adds should_bundle_library() to properly error on missing non-system dependencies instead of silently skipping them.
arwen's MachoContainer caches parsed load command offsets, which become stale after modifications that change install name lengths. Re-parsing between each operation ensures correct offsets are used. This fixes corruption when changing install names to longer strings, which shifts subsequent load commands in the binary.
The is_libpython() check only recognized Python.framework but free-threaded Python builds (3.13t, 3.14t) use PythonT.framework. This caused the framework to be bundled and the binary patched to reference a non-existent hashed library name.
The pure-Rust arwen-codesign library requires an LC_CODE_SIGNATURE load command which older dylibs (e.g., Homebrew's libintl) don't have. Use Apple's codesign CLI directly on macOS for reliability, keeping the pure-Rust implementation for cross-compilation from other platforms.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.