Metal backend: add export-time code signing for Hardened Runtime#18768
Metal backend: add export-time code signing for Hardened Runtime#18768mergennachin wants to merge 1 commit intomainfrom
Conversation
🔗 Helpful Links🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/18768
Note: Links to docs will display an error until the docs builds have been completed. ⏳ 6 Pending, 2 Unrelated FailuresAs of commit 3517c6d with merge base e109ac8 ( BROKEN TRUNK - The following jobs failed but were present on the merge base:👉 Rebase onto the `viable/strict` branch to avoid these failures
This comment was automatically generated by Dr. CI and updates every 15 minutes. |
meta-cla
bot
added
the
CLA Signed
This PR needs a
|
mergennachin
force-pushed
the
turboquant
branch
2 times, most recently
from
f86121f to
fa44add
Compare
The Metal AOTI backend extracts a compiled .so from the .pte at runtime and dlopen's it. macOS Hardened Runtime rejects unsigned dlopen'd code, making Metal-backend .pte files unusable in notarized apps. Add a `codesign_so` hook to `AotiBackend` (no-op by default) that runs after AOTInductor compilation and before the .so is packed into the .pte. `MetalBackend` overrides it to run `codesign` when a `codesign_identity` compile spec is provided. Wire `--codesign-identity` through the Voxtral Realtime and Parakeet export scripts. Add an e2e test in test_modules that exports a toy model with ad-hoc signing.
1 participant
The Metal AOTI backend extracts a compiled .so from the .pte at runtime
and dlopen's it. macOS Hardened Runtime rejects unsigned dlopen'd code,
making Metal-backend .pte files unusable in notarized apps.
Add a
codesign_sohook toAotiBackend(no-op by default) that runsafter AOTInductor compilation and before the .so is packed into the .pte.
MetalBackendoverrides it to runcodesignwhen acodesign_identitycompile spec is provided. Wire
--codesign-identitythrough the VoxtralRealtime and Parakeet export scripts.