analysis: warn about binaries with invalid macOS SDK version

PyInstaller/building/build_main.py

@@ -831,6 +831,22 @@ def assemble(self):
         # Write debug information about the graph
         self._write_graph_debug()
 
+        # On macOS, check the SDK version of the binaries to be collected, and warn when the SDK version is either
+        # invalid or too low. Such binaries will likely refuse to be loaded when hardened runtime is enabledm and
+        # while we cannot do anything about it, we can at least warn the user about it.
+        # See: https://developer.apple.com/forums/thread/132526
+        if is_darwin:
+            binaries_with_invalid_sdk = []
+            for dest_name, src_name, typecode in self.binaries:
+                sdk_version = osxutils.get_macos_sdk_version(src_name)
+                if sdk_version < (10, 9, 0):
+                    binaries_with_invalid_sdk.append((dest_name, src_name, sdk_version))
+            if binaries_with_invalid_sdk:
+                logger.warning("Found one or more binaries with invalid or incompatible macOS SDK version:")
+                for dest_name, src_name, sdk_version in binaries_with_invalid_sdk:
+                    logger.warning(" * %r, collected as %r; version: %r", src_name, dest_name, sdk_version)
+                logger.warning("These binaries will likely cause issues with code-signing and hardened runtime!")
+
     def _write_warnings(self):
         """
         Write warnings about missing modules. Get them from the graph and use the graph to figure out who tried to

news/8043.feature.rst

@@ -0,0 +1,4 @@
+(macOS) At the end of analysis, verify the macOS SDK version reported
+by binaries to be collected, and warn when the version is either invalid
+(0.0.0) or too low (< 10.9.0). Such binaries will likely cause issues
+with code-signing and hardened runtime.

tests/functional/test_regression.py

@@ -12,6 +12,7 @@
 from pathlib import Path
 from importlib.machinery import EXTENSION_SUFFIXES
 
+from PyInstaller import compat
 from PyInstaller.depend import analysis, bindepend
 from PyInstaller.building.build_main import Analysis
 from PyInstaller.building.api import PYZ
@@ -61,6 +62,23 @@ def get_imports(*args, **kwargs):
         except Exception:
             return []
 
+    orig_get_imports = bindepend.get_imports
+    monkeypatch.setattr(bindepend, "get_imports", get_imports)
+
+    # On macOS, we need to similarly override `osxutils.get_macos_sdk_version`.
+    if compat.is_darwin:
+        from PyInstaller.utils import osx as osxutils
+
+        def get_macos_sdk_version(*args, **kwargs):
+            try:
+                return orig_get_macos_sdk_version(*args, **kwargs)
+            except Exception:
+                return (10, 9, 0)  # Minimum version expected by check in Analysis.
+
+        orig_get_macos_sdk_version = osxutils.get_macos_sdk_version
+        monkeypatch.setattr(osxutils, "get_macos_sdk_version", get_macos_sdk_version)
+
+    # Set up fake CONF for Analysis
     monkeypatch.setattr(
         'PyInstaller.config.CONF', {
             'workpath': str(tmpdir),
@@ -73,12 +91,10 @@ def get_imports(*args, **kwargs):
             'code_cache': dict(),
         }
     )
+
     # Speedup: avoid analyzing base_library.zip
     monkeypatch.setattr(analysis, 'PY3_BASE_MODULES', [])
 
-    orig_get_imports = bindepend.get_imports
-    monkeypatch.setattr(bindepend, "get_imports", get_imports)
-
     pkg = (tmpdir / 'mypkg').mkdir()
     init = pkg / ('__init__' + EXTENSION_SUFFIXES[0])
     init.write_binary(b'\0\0\0\0\0\0\0\0\0\0\0\0' * 20)