codesign replaces symbolic link with the actual file when signing

[bkpoon]

This issue came up with the conda-forge package of wxpython on Apple Silicon (conda-forge/wxpython-feedstock#74). The copies of the libraries after signing would cause runtime issues.

One way to reproduce the issue is to copy a library, make a symbolic link, and then try signing the symbolic link.

mkdir test
cd test
cp /usr/lib/ssh-keychain.dylib .
ln -s ssh-keychain.dylib another_lib.dylib

The files should now look like

  0 lrwxr-xr-x  1 bkpoon  staff    18B Apr 19 12:20 another_lib.dylib -> ssh-keychain.dylib
560 -rwxr-xr-x  1 bkpoon  staff   278K Mar 26 00:21 ssh-keychain.dylib

Now try signing with

codesign -s - -f another_lib.dylib

and the files become

496 -rwxr-xr-x  1 bkpoon  staff   245K Apr 19 12:21 another_lib.dylib
560 -rwxr-xr-x  1 bkpoon  staff   278K Mar 26 00:21 ssh-keychain.dylib

For this particular example, the -f is needed because a signature already exists, but the behavior is the same for a file that does not already have a signature and the -f flag is omitted.

Can a check for symbolic links be added so that they are not replaced when signing? Thanks!

[bkpoon]

Also, the codesign command I tested is from conda-forge (sigtool-0.1.3-h7747421_0).