All code needs to be signed as of macOS 15

[ryandesign (Ryan Carsten Schmidt)]

After installing the buildbot worker software on a 2018 Mac mini running macOS Sequoia, it could not connect to the buildmaster, claiming "No route to host", despite ping and ssh being able to reach that host just fine from the Terminal.

It sounds like macOS 15 requires all code to be signed to access devices on the local network, unless they are run manually in the Terminal. After I ran

sudo codesign -dv -r- /opt/bblocal/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python

I got a dialog box asking if I wanted to allow Python to connect to devices on the local network, and after I said yes, then buildbot was able to connect to the master. Only after doing this did Python appear in System Settings > Privacy & Security > Local Network.

Previously I had installed buildbot on an unsupported Mac running macOS Sequoia via OpenCore Legacy Patcher and had not encountered this problem, probably because OCLP disables some aspects of System Integrity Protection.

The need to sign all code on macOS 15 was also mentioned in ​https://github.com/macports/macports-ports/pull/25862 where it was proposed to add code to a single port to sign its files. It needs to be handled in MacPorts base so that such signing code doesn't need to be added to all 40,000 ports individually.

How we are going to handle pushing out signed versions of all the ports that macOS 15 users have already installed without revbumping all ports, I don't know.