Mac wheel includes ad-hoc signed libxcb

[colatkinson]

What did you do?

I have a Python binary that is built using PyInstaller, and is packaged/signed for macOS. Binaries began failing to execute when Pillow was updated to 7.1.1.

libxcb.1.dylib seems to be getting pulled into the package by PyInstaller. This binary includes an ad-hoc signature, and when codesign is run on the app bundle, this signature is not overwritten.

This can be verified as follows:

$ python3 -m venv venv
$ . venv/bin/activate
$ pip install pillow==7.1.1
$ codesign -dvvvv venv/lib/python3.6/site-packages/PIL/.dylibs/libxcb.1.dylib

What did you expect to happen?

All of the other dylibs shipped with the Pillow binary packages are unsigned, and this tends to be the case for most wheels I've encountered. Also, according to the 7.1.0 release notes, XCB support isn't included in macOS wheels by default, so I'm not sure whether libxcb being included is intentional or not.

What actually happened?

An ad-hoc signed libxcb was included in the packaged wheels.

What are your OS, Python and Pillow versions?

• OS: macOS 10.14 Mojave
• Python: 3.6
• Pillow: 7.1.1

[nulano]

I wrote that part of the release notes (and added the library), but it was not communicated well with others (@hugovk handled the release). I don't have much experience with Linux or macOS (I use Windows), so I assumed someone who does would check this when merging the PR - I probably should have been more direct.

Looking at pillow-wheels, the wheel building script should have been updated to add libxcb. Since it wasn't, it probably used the system version of the library on macOS (I'm surprised it is preinstalled, as macOS doesn't use X11 anymore), but, ironically, it did not find it on Linux.

Edit: PS: Why does the script check installed codecs and modules, but not features?

Since this library was added only to handle X11 screenshots, you may be able to remove it for now, until this issue is fixed.

Also, according to the 7.1.0 release notes, XCB support isn't included in macOS wheels by default, so I'm not sure whether libxcb being included is intentional or not.

Yes, this was an oversight. I don't know if macOS wheels should support libxcb, as it shouldn't make much difference anyway. IIRC XQuartz (the optional macOS X11 server) doesn't allow screenshots (I'm guessing for privacy reasons), and I remember having a bit of trouble getting X11 properly forwarded through SSH when testing. However, when I did get the tunnel to work, I could successfully get screenshots of a Linux machine from the Macbook, which is likely the only time this would be at all useful. So perhaps the best reason to include it is to prevent the build from including the system version! 😃

[radarhere]

I've created python-pillow/pillow-wheels#149 to fix the code signing issue.

[radarhere]

That PR has been merged, so the problem from @colatkinson should be fixed in the next Pillow release, due out on July 1.

[radarhere]

Why does pillow-wheels check codecs and modules, but not features? I would guess that it just wasn't thought of when #2520 added get_supported_features().

I've created python-pillow/pillow-wheels#150 to add feature checking.

[radarhere]

I've created python-pillow/pillow-wheels#151 to compile libxcb on Linux, resolving the last problem raised in this issue.