search

RenderKit / oidn

Intel® Open Image Denoise library
https://www.openimagedenoise.org/
Apache License 2.0
1.77k stars 164 forks source link

Improve documentation for macOS Catalina with respect to code signing #42

Closed dyspropos closed 4 years ago

dyspropos commented 4 years ago

This is not a bug as such, but a suggestion to improve the documentation regarding support on macOS. We just spent a bit of time figuring out why the denoiser would not run on mac OS 10.15 after being installed, but worked fine when building from source. The culprit was the new requirements for code-signing needed for notarization in macOS.

It turns out special entitlements are needed for the denoiser since the MKL DNN uses some jit-compilation that are not allowed with default settings for code signing. In particular, the entitlement com.apple.security.cs.allow-unsigned-executable-memory is needed (I could not get the more restrictive com.apple.security.cs.allow-jit to work).

It can be hard to figure out, because the code-signing itself does not fail, but the denoiser fails silently at runtime (no errors were reported). The only indication of a problem is a message from the kernel in the Console app with the message CODE SIGNING: 2396[....] vm_map_protect can’t have both write and exec at the same time. No error of any kind is displayed to the user or written to stdout.

Some documentation on macOS entitlements: https://developer.apple.com/documentation/bundleresources/entitlements

This may be relevant for the MKL DNN project itself as well

jmengintel commented 4 years ago

Thank you for your report! We will add this to the documentation.