Python roulette ordering

[flammable]

I just moved from Outset version 2 to 3 (I know I'm a little late). I really like your approach to using Python, rather than bundling yet another one.

Here's the current order:

# Let's play python roulette, and choose from some popular options, in this order:
#  1. python.org https://www.python.org/downloads/
#  2. MacAdmins https://github.com/macadmins/python
#  3. Munki https://github.com/munki/munki
# If none of these are on disk, then fall back to Apple's system python,
# which can be installed via the Command Line Tools.

May I suggest swapping options 1 and 2? My thinking is that anyone can download and install from python.org, but the MacAdmins Python is likely to only be installed by an IT department.

[gregneagle]

one might even argue for 2, 3, 1...

[gregneagle]

On the other hand, if you actually have a preferred python, instead of relying on roulette, just explicitly set outset's python symlink to your preferred python.

[flammable]

On the other hand, if you actually have a preferred python, instead of relying on roulette, just explicitly set outset's python symlink to your preferred python.

That's fair. I'm repackaging outset in my org, so I can sign it (for TCC/PPPC reasons). I've modified the postinstall script for my needs, but figured it'd be worth suggesting a change anyway.

[gregneagle]

You don't even have to repackage. The symlink could be explicitly set later by a script or another pkg.

[flammable]

I do need to repackage to perform the code signing, but that's a nice workaround if I wasn't already repackaging.

[lincolnep]

@flammable I am signing my packaged version of Python3 for TCC/PPPC not outset works a treat.

[flammable]

Hmm, would that open things up to security issues? Could anyone use your signed Python to run code in a privileged context?

I probably don't need to be repackaging and signing outset anymore - the new dockutil is a Swift binary, and I've moved to desktoppr to set the initial background at login. I don't believe either of those require code signing for outset.