fix(setup): resolve macOS code-signing errors when installing pip packages#1231
Open
silverl wants to merge 1 commit intoDLR-RM:mainfrom
Open
fix(setup): resolve macOS code-signing errors when installing pip packages#1231silverl wants to merge 1 commit intoDLR-RM:mainfrom
silverl wants to merge 1 commit intoDLR-RM:mainfrom
Conversation
…kages On my Mac (M4 Pro, macOS 26.3 Tahoe), BlenderProc failed on first run with "Operation not permitted" errors. Two issues: 1. custom-python-packages is created inside the Blender.app bundle, which macOS seals via code-signing. Any attempt to mkdir or write files inside the .app fails with PermissionError. 2. The pip upgrade (pip install --upgrade pip) destroys pip entirely. What happens: pip first uninstalls itself (e.g. 23.2.1) from Blender's site-packages — deletion succeeds. Then it tries to install the new version into the same sealed location — which fails. The rollback also fails because the directory is still read-only. Result: no working pip at all, and every subsequent package install breaks with "No module named pip". Fix (1): when the default packages path doesn't already exist and its parent directory isn't writable, walk up the path to find the .app boundary and place custom-python-packages as a sibling directory outside the bundle. If the directory already exists (e.g. user previously granted Full Disk Access), the original path is preserved for backward compatibility. Fix (2): after attempting the pip upgrade, verify pip still works. If it was destroyed by a failed upgrade, re-run ensurepip to restore the bundled version. This is a no-op on systems where the upgrade succeeds. fixes DLR-RM#768
|
For contributing to BlenderProc you need to sign our Contributor License Agreement. As an individual please sign CLA_individuals.pdf, as a company please sign CLA_entities.pdf and send it to blenderproc@dlr.de |
Author
|
I mailed the contributor license on Feb 20, 2026. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #768
On macOS, BlenderProc fails on first run with
PermissionError: [Errno 1] Operation not permittedbecause thecustom-python-packagesdirectory is created inside the sealedBlender.appbundle. A second failure occurs whenpip install --upgrade pipdestroys pip entirely — it uninstalls the old version (succeeds), tries to install the new version into the read-only bundle (fails), and the rollback also fails, leaving no working pip.This PR fixes both issues:
Package path relocation — When the default
custom-python-packagespath doesn't already exist and its parent isn't writable, walk up the path to find the.appboundary and place the directory as a sibling outside the bundle. If the directory already exists (e.g. user previously granted Full Disk Access to their terminal), the original path is preserved for backward compatibility.Pip upgrade recovery — After attempting the pip upgrade, verify pip still works via
pip --version. If it was destroyed, re-runensurepipto restore the bundled version. This is a no-op on Linux/Windows where the upgrade succeeds normally.Test plan
custom-python-packagesdirectory inside.appis respected)