[Bug]: Warning after update to macOS 14 "WARNING: Secure coding is not enabled for restorable state! Enable secure coding by implementing NSApplicationDelegate.applicationSupportsSecureRestorableState: and returning YES."

[timdiller]

Bug summary

After updating to macOS 14, importing matplotlib generated a warning repeatably in multiple ipython or python sessions:

In [1]: import matplotlib

In [2]: 2023-11-28 21:33:05.230 Python[48540:342836] WARNING: Secure coding is not enabled for restorable state! Enable secure coding by implementing NSApplicationDelegate.applicationSupportsSecureRestorableState: and returning YES.

After terminating and restarting the python environment, the warning was no longer generated.

Code for reproduction

import matplotlib

Actual outcome

❯ ipython
Python 3.8.18 |Enthought, Inc. (x86_64)| (default, Oct 16 2023, 18:04:34) 
Type 'copyright', 'credits' or 'license' for more information
IPython 7.31.1 -- An enhanced Interactive Python. Type '?' for help.

In [1]: import matplotlib

In [2]: 2023-11-28 21:33:05.230 Python[48540:342836] WARNING: Secure coding is not enabled for restorable state! Enable secure coding by implementing NSApplicationDelegate.applicationSupportsSecureRestorableState: and returning YES.

Expected outcome

In [1]: import matplotlib

Additional information

I'm using Enthought's edm for my Python environment. This warning happened consistently in multiple ipython sessions in the first python environment I opened after upgrading to macOS 14. After closing the shell and re-opening it, the warning is gone.
This phenomenon was briefly discussed here

Operating system

macOS 14

Matplotlib Version

3.5.1

Matplotlib Backend

No response

Python version

3.8.1

Jupyter version

No response

Installation

None

[tacaswell]

We do not appear to explicitly use any of the serialize/deserialize functionality (and just rely on the default behavior) so I think all we have to do is add

- (BOOL)applicationSupportsSecureRestorableState:(NSApplication *)app {
	return YES;
}

per https://sector7.computest.nl/post/2022-08-process-injection-breaking-all-macos-security-layers-with-a-single-vulnerability/ . I'm a bit confused where we are supposed to put that code? Do we just drop it in macsox.m and it get picked up somehow?

xref python/cpython#110950

I am surprised that this happens on import of matplotlib. I would expect this to either be upstream Python issues (in which case our import should not matter) or if it is GUI backend dependent it should not be hit until after pyplot is imported. Is the backend resolution being hit much earlier than I expect?

[ksunden]

I am as yet unable to reproduce on my mac, so while we can add a the trivial return YES; function to _macosx.m, but I have not figured out how to test that it works.

I will note that I have an M1 mac, and it looks like you are using x86_64 here, though I'm not sure how much I'd expect that to be different in this regard.

It is possible it is related to build-time environment variables (such as MACOSX_DEPLOYMENT_TARGET, which we discovered had some odd behavior with our new meson build system relating to M1 macs).

You are also on a (relatively) old version of python/matplotlib (though I did try on the combination you have, though not manged by edm). Do you see the same problem with e.g. python 3.11/3.12 and matplotlib 3.8?

[timdiller]

Unfortunately (or fortunately) I have not been able to reproduce the warning since restarting my edm venv. Thus it's probably no surprise that I'm also not getting it in Python 3.11.4 and matplotlib 3.8.2...

mpl_test_env ❯ python
Python 3.11.4 (v3.11.4:d2340ef257, Jun  6 2023, 19:15:51) [Clang 13.0.0 (clang-1300.0.29.30)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import matplotlib
>>> matplotlib.__version__
'3.8.2'
>>> import matplotlib.pyplot as plt
>>> 

For what it's worth, when my machine was in the warning-generating state, I could also generate it with import seaborn.

I've asked the poster at the Discourse site to chime in here if he can help with reproducing the warning.

[ksunden]

We got another report of this, which said they installed via pip, so perhaps worth looking into again... it's possible that eg I had some os settings set (though I tried not to change too much from default, since it's a secondary dev device for me)

[SercanBayram]

I get the same warning message regarding this issue when I use the plot function.

import numpy as np
import matplotlib.pyplot as plt

tetha = np.arange(180)
signal = np.sin(tetha*180/2)

plt.plot(tetha, signal)
plt.show()

Warning Alert:

2023-12-17 18:57:45.598 Python[939:19218] WARNING: Secure coding is not enabled for restorable state! Enable secure coding by implementing NSApplicationDelegate.applicationSupportsSecureRestorableState: and returning YES.

I couldn't find anything on how to resolve this warning message.

System: Mac Pro M3 / Sonoma 14.2
Matplotlib version: 3.8.2
Python version: 3.11.7
Development environment: VS Code

Thanks you from now for your help.

[stopdesign]

I've got the same warning.

UPD: No such issue with Python 3.12.1.

Operating system
macOS - Sonoma 14.1.2

Matplotlib Version
3.8.2 - installed via pip

Python version
3.11.6

$ python
Python 3.11.6 (main, Nov  2 2023, 04:39:40) [Clang 14.0.0 (clang-1400.0.29.202)] on darwin
...
>>> from matplotlib import pyplot
>>> a = pyplot.plot(1, 1)
>>> 2024-01-09 09:20:14.417 Python[5276:16225] WARNING: Secure coding is not enabled for restorable state!
Enable secure coding by implementing NSApplicationDelegate.applicationSupportsSecureRestorableState:
and returning YES.

[sudoer-Huatao]

I just updated to 3.12, but it still exists on my end:

import numpy as np
x = np.linspace(-1, 1, 200)
plt.plot(x, np.sin(x))

The warning still gets outputted.

macOS: Sonoma 14.2.1
Python: 3.12.1
Matplotlib: 3.8.2

[tacaswell]

Can someone who is able to generate this warning please try adding the code from #27389 (comment) into _macosx.m?

[greglucas]

I can reproduce this locally, and I don't think there is anything to do on Matplotlib's end, we don't override NSApplicationDelegate ourselves, our "App" is the Python Framework I believe. I think the solution is to update to the latest minor version of your Python release. Unfortunately, it looks like Python 3.12.1 doesn't contain the fix which is interesting because I thought the patch should have gone out with that.

Python 3.10.2 -> warning
Python 3.10.13 -> good
Python 3.11.6 -> warning
Python 3.11.7 -> good
Python 3.12.1 -> warning

[stopdesign]

I have almost the opposite observation:

Python 3.10.13 [Clang 14.0.0 (clang-1400.0.29.202)] -> WARNING
Python 3.11.7  [Clang 15.0.0 (clang-1500.1.0.2.5)]  -> GOOD
Python 3.12.1  [Clang 15.0.0 (clang-1500.0.40.1)]  -> GOOD

Some other variables:

python         3.10.13    3.11.7    3.12.1
pip             22.2.2    23.3.1    23.3.2
setuptools      65.3.0    69.0.2    69.0.3
wheel           0.37.1    0.42.0    0.42.0

Action sequence:

$ virtualenv .venv -p python3.10   ## or python3.11, or python3.12
$ python -m pip install matplotlib

$ python

>>> from matplotlib import pyplot
>>> a = pyplot.plot(1, 1)

[greglucas]

Interesting. I am guessing this has to do with clang versions then and possibly needing >=15... I just recreated a virtual environment with Python3.12 to get the newest clang.

Warning:

Python 3.12.1 (v3.12.1:2305ca5144, Dec  7 2023, 17:23:39) [Clang 13.0.0 (clang-1300.0.29.30)] on darwin

Good:

Python 3.12.1 (main, Dec  7 2023, 20:45:44) [Clang 15.0.0 (clang-1500.0.40.1)] on darwin

My "good" versions all reference clang 15.

[cpisani47]

I've just tried

3.12.0, 3.12.1, 3.11.6, 3.11.7 - all of them have Clang 13.0.0

Python 3.11.6 (v3.11.6:8b6ee5ba3b, Oct 2 2023, 11:18:21) [Clang 13.0.0 (clang-1300.0.29.30)] on darwin

and all of them get the same matplotlib error

2024-01-17 20:45:14.333 Python[15654:3113347] WARNING: Secure coding is not enabled for restorable state! Enable secure coding by implementing NSApplicationDelegate.applicationSupportsSecureRestorableState: and returning YES.
They were all downloaded from python.org.

On my mac I can see

clang --version
Apple clang version 15.0.0 (clang-1500.1.0.2.5)
Target: arm64-apple-darwin23.2.0
Thread model: posix
InstalledDir: /Library/Developer/CommandLineTools/usr/bin

So I presume the official builds are against an older compiler. I'm also guessing that some people might be getting their python from homebrew or ananconda. Could this account for the inconsistency?

[sudoer-Huatao]

I've just tried

3.12.0, 3.12.1, 3.11.6, 3.11.7 - all of them have Clang 13.0.0

Python 3.11.6 (v3.11.6:8b6ee5ba3b, Oct 2 2023, 11:18:21) [Clang 13.0.0 (clang-1300.0.29.30)] on darwin

and all of them get the same matplotlib error

2024-01-17 20:45:14.333 Python[15654:3113347] WARNING: Secure coding is not enabled for restorable state! Enable secure coding by implementing NSApplicationDelegate.applicationSupportsSecureRestorableState: and returning YES. They were all downloaded from python.org.

On my mac I can see

clang --version
Apple clang version 15.0.0 (clang-1500.1.0.2.5)
Target: arm64-apple-darwin23.2.0
Thread model: posix
InstalledDir: /Library/Developer/CommandLineTools/usr/bin

So I presume the official builds are against an older compiler. I'm also guessing that some people might be getting their python from homebrew or ananconda. Could this account for the inconsistency?

I also encountered the same issue. Python uses 13.0 instead of 15.0 (which Apple installs by default). So I guess the only way you could run Python shell with 15.0 clang is venvs.

Can anyone confirm if this has to do with clang versions?

[huigeonkim]

Same warning for

Python 3.11.5 (main, Aug 24 2023, 15:09:45) [Clang 14.0.3 (clang-1403.0.22.14.1)] on darwin
matplotlib 3.8.2 - via pip
setuptools 68.1.2
wheel 0.41.2
macOS Sonoma 14.2.1

No warning for

Python 3.11.4 (main, Jul 5 2023, 08:54:11) [Clang 14.0.6 ] on darwin
matplotlib 3.7.1 - via conda
setuptools 68.0.0
wheel 0.38.4
macOS Sonoma 14.2.1

clang --version
Apple clang version 15.0.0 (clang-1500.1.0.2.5)
Target: arm64-apple-darwin23.2.0
Thread model: posix
InstalledDir: `/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin

[greglucas]

Since other maintainers are unable to reproduce this, could someone in this thread who can reliably reproduce this be willing to test the fix put up in #27670? I think these are the quick commands that would get a development matplotlib install working off that branch, or you can go through the devdocs for more details: https://matplotlib.org/devdocs/devel/development_setup.html

Edit: easier command from the comment below:

pip install git+https://github.com/greglucas/matplotlib.git@macos-app-delegate

gh pr checkout 27670 pip install meson-python pybind11 ninja numpy pip install .

[QuLogic]

pip install meson-python pybind11 ninja numpy

You don't need to install build dependencies if using a non-editable install. It should also be possible to install directly with pip if you aren't interested in a full environment:

$ pip install git+https://github.com/greglucas/matplotlib.git@macos-app-delegate

(but you do need a compiler at the very least)

[JackyCCK2126]

I got this problem too.
And I just use this code to make the console neat and do not mix up the warning with the outputs:

#beginning of the code
import threading
import time
def f___plt():
    plt.figure(figsize=(0.1,0.1))
    plt.ioff() # to block the main thread before the warning is printed
    def _():
        time.sleep(0.1)
        print()
        plt.close()
    threading.Thread(target=_).start()
    plt.show()
    plt.ion()
f___plt()

## Print your stuff here without mixing it with the warning message

[cpisani47]

Since other maintainers are unable to reproduce this, could someone in this thread who can reliably reproduce this be willing to test the fix put up in #27670? I think these are the quick commands that would get a development matplotlib install working off that branch, or you can go through the devdocs for more details: https://matplotlib.org/devdocs/devel/development_setup.html

I've been able to confirm the fix in #27670 works for my setup.

I did the verification as follows

Checkout the fix

cd <SRCDIR>
git clone https://github.com/greglucas/matplotlib.git matplotlib-greglucas
git switch macos-app-delegate

Setup venv to test

> cd <TESTDIR>
> /Library/Frameworks/Python.framework/Versions/3.12/bin/python3 -m venv venv-002 --prompt "Python.org 3.12 - Matplotlib GL-fix"
> source ./venv-002/bin/activate
> pip install --upgrade pip
> pip install meson-python pybind11 ninja numpy
> cd <SRCDIR>/matplotlib-greglucas
> python -m pip install --verbose --no-build-isolation --editable ".[dev]"
> cd <TESTDIR>
> python test.py

My test script is

import matplotlib.pyplot as plt
plt.plot([1, 2, 3])
plt.show()

My python version was downloaded from python.org

prompt> python
Python 3.12.1 (v3.12.1:2305ca5144, Dec  7 2023, 17:23:38) [Clang 13.0.0 (clang-1300.0.29.30)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> 

The editable installation above went through the compilation on my mac and used

Apple clang version 15.0.0 (clang-1500.1.0.2.5)

[Jonasm22]

What is the solution to fix it?

[tacaswell]

This was fixed in #27670 and should be release in mpl 3.8.3.