Meson produces "bundle" library for iOS which does not pass App Store validation

[FeodorFitsner]

When cross-compiling Numpy, Pandas and any other Python module using Meson as their build system for iOS it produces .so libraries of "bundle" type which fail App Store validation with errors like this:

Validation failed (409) The binary is invalid. The executable 'Runner.app/Frameworks/numpy._core._simd.framework/numpy._core._simd' has type 'BUNDLE' that is not valid. Only 'EXECUTE' is permitted.

Checking file type with file gives:

Mach-O 64-bit bundle arm64

Indeed, -bundle option is hard-coded in the method returning linker args:

meson/mesonbuild/linkers/linkers.py

Lines 790 to 793 in e42cd6a

	def get_std_shared_module_args(self, options: 'KeyedOptionDictType') -> T.List[str]:
	return ['-bundle'] + self._apply_prefix('-undefined,dynamic_lookup')

Patching Meson and replacing ['-bundle'] with ['-dynamiclib'] in that file produces library of the correct type which passes App Store validation.

Correct file type:

Mach-O 64-bit dynamically linked shared library arm64

Is there any way to override that?

[eli-schwartz]

@rgommers

[rgommers]

I have little experience with iOS apps. Are you cross-compiling with the Beeware tooling @FeodorFitsner?

[FeodorFitsner]

Yes, with the fork that supports Meson builds: https://github.com/flet-dev/mobile-forge/tree/python3.12

Example of meson.cross file used for iphoneos:arm64:

[binaries]
c = 'arm64-apple-ios-clang'
cpp = 'arm64-apple-ios-clang++'
ar = 'arm64-apple-ios-ar'
strip = 'strip'
python = '/Users/feodor/projects/flet-dev/mobile-forge/build/cp312/numpy/1.26.4/venv3.12-ios_13_0_arm64_iphoneos/cross/bin/python3.12'
[built-in options]
c_args = '-fno-strict-overflow -Wsign-compare -Wunreachable-code -fno-common -dynamic -DNDEBUG -g -O3 -Wall -mios-version-min=13.0 -I/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS18.2.sdk/usr/include'
cpp_args = '-I. -I./Include -mios-version-min=13.0'
c_links_args = '-mios-version-min=13.0 -L/Users/feodor/projects/flet-dev/python-build/darwin/Python-Apple-support/support/3.12/iOS/Python.xcframework/ios-arm64/lib -L/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS18.2.sdk/usr/lib -F "/Users/feodor/projects/flet-dev/python-build/darwin/Python-Apple-support/support/3.12/iOS/Python.xcframework/ios-arm64"'
cpp_links_args = '-mios-version-min=13.0 -L/Users/feodor/projects/flet-dev/python-build/darwin/Python-Apple-support/support/3.12/iOS/Python.xcframework/ios-arm64/lib -L/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS18.2.sdk/usr/lib -F "/Users/feodor/projects/flet-dev/python-build/darwin/Python-Apple-support/support/3.12/iOS/Python.xcframework/ios-arm64"'
[properties]
needs_exe_wrapper = false
longdouble_format = 'IEEE_DOUBLE_LE'
[host_machine]
cpu_family = 'aarch64'
cpu = 'aarch64'
endian = 'little'
system = 'iphoneos'

[rgommers]

https://github.com/flet-dev/mobile-forge/tree/python3.12/recipes/numpy looks like it worked for numpy 2.1.1. So the build is fine, except for App Store validation?

This seems like a problem that's either generic to all packages built with Meson for iOS, or all Python packages built with Meson for iOS. The bug report says the latter, but can it be the former? AppleDynamicLinker.get_std_shared_module_args isn't specific to Python I'd think.

[bonzini]

Both dynamic libraries and bundles these days can be dynamically loaded using the dl APIs (e.g. dlopen, dlclose). It is not possible to include bundles on a linker command line as if they were shared libraries, but that's pretty much the only difference.

Therefore using -dynamiclib (or -shared too I think) should be harmless but it would be best to know exactly why Apple has that rule.

[FeodorFitsner]

@rgommers it's a problem for all iOS packages built with Meson.

@bonzini I can't find the exact place on Apple website where it's stated.

The full error Apple verification produces for every bundle in a package:

2025-02-10 13:54:09.095 ERROR: [ContentDelivery.Uploader.600001939800] Validation failed (409) The binary is invalid. The executable 'Runner.app/Frameworks/numpy._core._operand_flag_tests.framework/numpy._core._operand_flag_tests' has type 'BUNDLE' that is not valid. Only 'EXECUTE' is permitted. (ID: e09a913c-933d-4640-b213-f720637901e1)
2025-02-10 13:54:09.095 DEBUG: [ContentDelivery.Uploader.600001939800] Error Domain=ContentDelivery Code=409 "Validation failed" UserInfo={NSLocalizedFailureReason=The binary is invalid. The executable 'Runner.app/Frameworks/numpy._core._operand_flag_tests.framework/numpy._core._operand_flag_tests' has type 'BUNDLE' that is not valid. Only 'EXECUTE' is permitted. (ID: e09a913c-933d-4640-b213-f720637901e1), NSUnderlyingError=0x6000003468e0 {Error Domain=IrisAPI Code=-19241 "Validation failed" UserInfo={status=409, detail=The binary is invalid. The executable 'Runner.app/Frameworks/numpy._core._operand_flag_tests.framework/numpy._core._operand_flag_tests' has type 'BUNDLE' that is not valid. Only 'EXECUTE' is permitted., id=e09a913c-933d-4640-b213-f720637901e1, code=STATE_ERROR.VALIDATION_ERROR, title=Validation failed, NSLocalizedFailureReason=The binary is invalid. The executable 'Runner.app/Frameworks/numpy._core._operand_flag_tests.framework/numpy._core._operand_flag_tests' has type 'BUNDLE' that is not valid. Only 'EXECUTE' is permitted., NSLocalizedDescription=Validation failed}}, iris-code=STATE_ERROR.VALIDATION_ERROR, NSLocalizedDescription=Validation failed}
2025-02-10 13:54:09.096 ERROR: [ContentDelivery.Uploader.600001939800] Validation failed (409) Missing load commands. The executable at 'Runner.app/Frameworks/numpy._core._operand_flag_tests.framework' does not have the necessary load commands. Try rebuilding the app with the latest Xcode version. If you are using third party development tools, contact the provider. (ID: 235600b5-8aa3-441c-9e98-98e3af19d2bc)

I've just re-built numpy with Meson and -dynamiclib and the app successfully passed verification ✅

I don't know what would be an elegant way to fix that in Meson. As a quick hack I'd introduce an environment variable to override that -bundle value with anything from a var. Or maybe it could be configured via cross file.

[bonzini]

A few more questions on the file: 1) what are the permissions? 2) if they are rwx (755), does verification pass if they are changed to rw- (644)? 3) why doesn't the file name end with .so or .dylib if it's a shared module?

[FeodorFitsner]

1, 2) Both bundle (failed validation) and dynamic library (passed) have -rwxr-xr-x permissions. Looks like it's not an issue.
3) All binaries in Frameworks are extension-less. Once the package compiled it produces .so which then converted to frameworks according to this guide: https://docs.python.org/3/using/ios.html#binary-extension-modules (it actually says The iOS App Store requires that all binary modules in an iOS app must be dynamic libraries, contained in a framework with appropriate metadata, stored in the Frameworks folder of the packaged app.).

Edit: "not an issue".

[bonzini]

Then Meson must use -dynamiclib indeed, or I think -shared also works.

[FeodorFitsner]

-dynamiclib sounds great :)