Sign the python2 exe on Darwin arm64 (#2233)

Co-authored-by: Bernát Gábor <gaborjbernat@gmail.com>

3 files changed, 36 insertions, 5 deletions

diff --git a/docs/changelog.rst b/docs/changelog.rst
index b5caa3c..f1e1825 100644
--- a/docs/changelog.rst
+++ b/docs/changelog.rst
@@ -657,7 +657,7 @@ Bugfixes - 20.0.8
 - Having `distutils configuration <https://docs.python.org/3/install/index.html#distutils-configuration-files>`_
   files that set ``prefix`` and ``install_scripts`` cause installation of packages in the wrong location -
   by :user:`gaborbernat`. (`#1663 <https://github.com/pypa/virtualenv/issues/1663>`_)
-- Fix ``PYTHONPATH`` being overridden on Python 2 — by :user:`jd`. (`#1673 <https://github.com/pypa/virtualenv/issues/1673>`_)
+- Fix ``PYTHONPATH`` being overridden on Python 2 — by :user:`jd`. (`#1673 <https://github.com/pypa/virtualenv/issues/1673>`_)
 - Fix list configuration value parsing from config file or environment variable - by :user:`gaborbernat`. (`#1674 <https://github.com/pypa/virtualenv/issues/1674>`_)
 - Fix Batch activation script shell prompt to display environment name by default - by :user:`spetafree`. (`#1679 <https://github.com/pypa/virtualenv/issues/1679>`_)
 - Fix startup on Python 2 is slower for virtualenv - this was due to setuptools calculating it's working set distribution
diff --git a/setup.cfg b/setup.cfg
index 1ab1dfc..ccd2f8d 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -72,6 +72,7 @@ virtualenv.create =
     cpython3-win = virtualenv.create.via_global_ref.builtin.cpython.cpython3:CPython3Windows
     cpython2-posix = virtualenv.create.via_global_ref.builtin.cpython.cpython2:CPython2Posix
     cpython2-mac-framework = virtualenv.create.via_global_ref.builtin.cpython.mac_os:CPython2macOsFramework
+    cpython2-mac-arm-framework  = virtualenv.create.via_global_ref.builtin.cpython.mac_os:CPython2macOsArmFramework
     cpython3-mac-framework = virtualenv.create.via_global_ref.builtin.cpython.mac_os:CPython3macOsFramework
     cpython2-win = virtualenv.create.via_global_ref.builtin.cpython.cpython2:CPython2Windows
     pypy2-posix = virtualenv.create.via_global_ref.builtin.pypy.pypy2:PyPy2Posix
diff --git a/src/virtualenv/create/via_global_ref/builtin/cpython/mac_os.py b/src/virtualenv/create/via_global_ref/builtin/cpython/mac_os.py
index c6343e7..4f7f646 100644
--- a/src/virtualenv/create/via_global_ref/builtin/cpython/mac_os.py
+++ b/src/virtualenv/create/via_global_ref/builtin/cpython/mac_os.py
@@ -69,6 +69,10 @@ class CPythonmacOsFramework(CPython):
 
 class CPython2macOsFramework(CPythonmacOsFramework, CPython2PosixBase):
     @classmethod
+    def can_create(cls, interpreter):
+        return not IS_MAC_ARM64 and super(CPython2macOsFramework, cls).can_describe(interpreter)
+
+    @classmethod
     def image_ref(cls, interpreter):
         return Path(interpreter.prefix) / "Python"
 
@@ -103,12 +107,38 @@ class CPython2macOsFramework(CPythonmacOsFramework, CPython2PosixBase):
         )
         return result
 
+
+class CPython2macOsArmFramework(CPython2macOsFramework, CPythonmacOsFramework, CPython2PosixBase):
     @classmethod
     def can_create(cls, interpreter):
-        if IS_MAC_ARM64:
-            return False
-        else:
-            return super(CPythonmacOsFramework, cls).can_create(interpreter)
+        return IS_MAC_ARM64 and super(CPythonmacOsFramework, cls).can_describe(interpreter)
+
+    def create(self):
+        super(CPython2macOsFramework, self).create()
+        self.fix_signature()
+
+    def fix_signature(self):
+        """
+        On Apple M1 machines (arm64 chips),  rewriting the python executable invalidates its signature.
+        In python2 this results in a unusable python exe which just dies.
+        As a temporary workaround we can codesign the python exe during the creation process.
+        """
+        exe = self.exe
+        try:
+            logging.debug("Changing signature of copied python exe %s", exe)
+            bak_dir = exe.parent / "bk"
+            # Reset the signing on Darwin since the exe has been modified.
+            # Note codesign fails on the original exe, it needs to be copied and moved back.
+            bak_dir.mkdir(parents=True, exist_ok=True)
+            subprocess.check_call(["cp", exe, bak_dir])
+            subprocess.check_call(["mv", bak_dir / exe.name, exe])
+            bak_dir.unlink()
+            cmd = ["codesign", "-s", "-", "--preserve-metadata=identifier,entitlements,flags,runtime", "-f", exe]
+            logging.debug("Changing Signature: %s", cmd)
+            subprocess.check_call(cmd)
+        except Exception:
+            logging.fatal("Could not change MacOS code signing on copied python exe at %s", exe)
+            raise
 
 
 class CPython3macOsFramework(CPythonmacOsFramework, CPython3, CPythonPosix):