Library libtdbc used in restore_ports script is unsigned

[Eric Gallager]

On Thu, Mar 21, 2024 at 12:53 AM Joshua Root <jmr at macports.org> wrote:
>
> > I recently upgraded from macOS 13.x to macOS 14.3.1 Sonoma and started running the MacPorts Migration process. I got interrupted and did the minor macOS update to macOS 14.4 and tried to run the “restore_ports.tcl” script, which worked for a while but then threw an error about the libtdbc library being unsigned. I don’t know if this is something that changed recently. What is the recommended procedure for fixing this? Uninstall all the ports and reinstall them?
> >
> > This is the full error:
> > dlopen(/opt/local/lib/tdbc1.1.7/libtdbc1.1.7.dylib, 0x0006): tried: '/opt/local/lib/tdbc1.1.7/libtdbc1.1.7.dylib' (code signature in <3CE89C0F-A387-3934-8B3D-5834290B7BD3> '/opt/local/lib/tdbc1.1.7/libtdbc1.1.7.dylib' not valid for use in process: mapped file has no cdhash, completely unsigned? Code has to be at least ad-hoc signed.), '/System/Volumes/Preboot/Cryptexes/OS/opt/local/lib/tdbc1.1.7/libtdbc1.1.7.dylib' (no such file), '/opt/local/lib/tdbc1.1.7/libtdbc1.1.7.dylib' (code signature in <3CE89C0F-A387-3934-8B3D-5834290B7BD3> '/opt/local/lib/tdbc1.1.7/libtdbc1.1.7.dylib' not valid for use in process: mapped file has no cdhash, completely unsigned? Code has to be at least ad-hoc signed.)
> >      while executing
> > "load /opt/local/lib/tdbc1.1.7/libtdbc1.1.7.dylib Tdbc"
> >      ("package ifneeded tdbc 1.1.7" script)
> >      invoked from within
> > "package require tdbc"
> >      (file "/opt/local/lib/tcl8/8.6/tdbc/sqlite3-1.1.7.tm" line 13)
> >      invoked from within
>
> This is likely an unfortunate interaction with a feature of tclsh and a
> feature of macOS. Tcl will look for packages in the same prefix as the
> interpreter that is running the script, and in this case, the tclsh
> shipped with MacPorts base finds a tdbc library installed by a port. The
> former is signed and the latter is not, and macOS doesn't allow signed
> executables to load unsigned libraries.
>
> The most straightforward workaround is to use a different path for the
> interpreter. /opt/local/bin/port-tclsh is a symlink to the actual
> tclsh8.6 in a subdirectory, so running the script like this should work:
>
> sudo `readlink /opt/local/bin/port-tclsh` ./restore_ports.tcl
>

Could this info go on the wiki somewhere or something? Like the
"Migration" page, or whichever it is that documents restore_ports.tcl
again...

> Hopefully we can ship automatic migration in MacPorts base soon and
> retire restore_ports.tcl.
>

Yeah, please notify me once this happens; I've been reluctant to
update from Big Sur just due to how much of a pain the
restore_ports.tcl process can be...

> - Josh
>