Compiling
Required compiler option
Since Mojave (10.14) Apple insists that binaries be hardened.
The first step is that all binaries and shared libraries must indicate the earliest version of OSX the executable will run on.
In other words, the LC_VERSION_MIN_MACOSX flag must be set.
A modern alternative is the LC_BUILD_VERSION flag.
The corresponding ifort (prior to OneAPI) option is:
ifort -mmacosx-version-min=xx.xx .... with xx.xx or xx.xx.xx greater or equal to 10.9
This compiler option is no longer supported with ifort OneAPI which sets the LC_BUILD_VERSION by default.
A binary or library can be tested as follows
otool -l <library or binary> | grep -B1 -A3 MIN_MACOS
Here the result for an X11 library:
otool -l /opt/X11/lib/libXinerama.1.dylib | grep -B1 -A3 MIN_MACOS
Load command 8
cmd LC_VERSION_MIN_MACOSX
cmdsize 16
version 10.6 <-- the minimum OS supported
sdk 10.11
A modern alternative is as follows
vtool -show-build <library or binary>
Here the result for an X11 library which implements 3 architectures:
/opt/X11/lib/libXinerama.1.dylib (architecture i386):
Load command 8
cmd LC_VERSION_MIN_MACOSX
cmdsize 16
version 10.9
sdk 10.9
/opt/X11/lib/libXinerama.1.dylib (architecture x86_64):
Load command 8
cmd LC_VERSION_MIN_MACOSX
cmdsize 16
version 10.9
sdk 13.2
/opt/X11/lib/libXinerama.1.dylib (architecture arm64):
Load command 9
cmd LC_BUILD_VERSION
cmdsize 32
platform MACOS
minos 11.0
sdk 13.2
ntools 1
tool LD
version 820.1
Problems
The build server used UPX (Utimate Packer eXecutable) which modify the binary to make it more compact.
However this had several negative side effects:
- the required LC_VERSION_MIN_MACOSX or LC_BUILD_VERSION flags are removed
- the entitlement <com.apple.security.cs.allow-unsigned-executable-memory> is required since the compacted binary modifies itself at runtime
- the compacted binaries worked with Big Sur and even Ventura for Apple silicon but crashed with Ventura for Intel with error "Segmentation fault 11"