Deploying Linguist with macdeployqt, killed 9 when running

ThierryLelegard

Hi,

I try to extract a copy of Qt Linguist outside Qt. The goal is to provide something small to a non-technical translator without installing gigabytes of Qt environment.

The procedure using macdeployqt used to work with Qt 5, a long time ago. Trying to reproduce with Qt 6.10 now fails. I try to understand what's going on.

Environment:
macOS 26.3 (Apple Silicon)
Qt 6.10.2, installed using the online installer for OpenSource

The setup:

OUTDIR=$HOME/tmp
QTDIR=$HOME/Qt/6.10.2/macos

rm -rf $OUTDIR/Linguist.app
cp -rp $QTDIR/bin/Linguist.app $OUTDIR

codesign --remove-signature $OUTDIR/Linguist.app/Contents/MacOS/Linguist
$QTDIR/bin/macdeployqt $OUTDIR/Linguist.app -verbose=1 -always-overwrite
install_name_tool $OUTDIR/Linguist.app/Contents/MacOS/Linguist -rpath @loader_path/../../../../lib @executable_path/../Frameworks

The signature of the executable is removed first to avoid warning messages with macdeployqt.

When running Linguist, I get this:

$OUTDIR/Linguist.app/Contents/MacOS/Linguist
62968 Killed: 9                  $OUTDIR/Linguist.app/Contents/MacOS/Linguist

Replacing @executable_path with @loader_path in the install_name_tool command does not change the issue.

If I copy the entire tree Qt/6.10.2/macos, the copied Linguist works. So, there must be something missing.

Any idea?

SGaist

Hi,

Did you check if all required plugins were deploy alongside Linguist ?
otool -L can also give you some hints about wrong paths.

ThierryLelegard

Hi @SGaist ,

All required frameworks, as seen by otool -L, were copied by macdeployqt.

How can we know which plugins are necessary?

Anyway, I tried to copy all plugins from $QTDIR/plugins into $OUTDIR/Linguist.app/Contents/PlugIns and it did not change the result. Still killed.

Can anyone reproduce the same set of commands and get a working bundle?

ThierryLelegard

Update: the kill is due to the invalid signature. All Qt applications, including Linguist, are signed by Qt.

Deploying the application means adjusting the path in the binary, meaning modifying the binary, meaning invalidating the signature. The same behaviour can be seen on a full working copy of the Qt environment. Linguist initially works. Then, I remove the signature (codesign --remove-signature) and the problem appears: killed 9

Normally, running an unsigned binary is quite normal. However, removing (not invalidating) the signature of a previously signed binary leads to that issue.

I tried to resign the binary with an adhoc signature. The binary works on the system on which the adhoc signature is generated but fails on other systems. Since the initial purpose is to provide a limited environment to a translator person, the whole purpose is missed.

So, we can limit the problem to the following: How can we successfully and totally remove the signature of a macOS application binary?

SGaist

That I don't know, sorry.

Might be a silly question but did you recursively remove the signature of everything in the app bundle ?

ThierryLelegard

@SGaist

Might be a silly question but did you recursively remove the signature of everything in the app bundle ?

Yes, I did. As well as many other sorts of tests and hacks, without luck.

That being said, an unsigned executable can use a signed dynamic library because it does not break the security structure. The opposite, on the other hand, is false. A signed executable can only call trusted libraries.