gh-81218: Make macOS framework builds relocatable via @rpath

macOS framework builds (--enable-framework) now produce relocatable
frameworks. The installed framework can be moved to any location and
will work without requiring install_name_tool rewriting by users.

This uses install-time transformation: build-time behavior is unchanged
(absolute install names), and install_name_tool transforms the installed
binaries to use @rpath.

Changes:
- Add -headerpad_max_install_names to LINKFORSHARED and pythonw build
- Transform dylib install name to @rpath at install time
- Add LC_RPATH entries to installed binaries (bin/python3, Python.app)
- Compute rpath depths dynamically via os.path.relpath()

Signed-off-by: Dominique Fuchs <df@0x9d.net>

Author: DominiqueFuchs

Mac/Makefile.in

@@ -19,6 +19,9 @@ LDFLAGS=@LDFLAGS@
 FRAMEWORKUNIXTOOLSPREFIX=@FRAMEWORKUNIXTOOLSPREFIX@
 PYTHONFRAMEWORK=@PYTHONFRAMEWORK@
 PYTHONFRAMEWORKIDENTIFIER=@PYTHONFRAMEWORKIDENTIFIER@
+PYTHONFRAMEWORKDIR=@PYTHONFRAMEWORKDIR@
+PYTHONFRAMEWORKPREFIX=@PYTHONFRAMEWORKPREFIX@
+PYTHONFRAMEWORKINSTALLNAMEPREFIX=@PYTHONFRAMEWORKINSTALLNAMEPREFIX@
 LIPO_32BIT_FLAGS=@LIPO_32BIT_FLAGS@
 LIPO_INTEL64_FLAGS=@LIPO_INTEL64_FLAGS@
 CC=@CC@
@@ -173,7 +176,8 @@ altinstallunixtools:
 	fi
 
 pythonw: $(srcdir)/Tools/pythonw.c Makefile
-	$(CC) $(LDFLAGS) -DPYTHONFRAMEWORK='"$(PYTHONFRAMEWORK)"' -o $@ \
+	$(CC) $(LDFLAGS) -Wl,-headerpad_max_install_names \
+		-DPYTHONFRAMEWORK='"$(PYTHONFRAMEWORK)"' -o $@ \
 		$(srcdir)/Tools/pythonw.c -I.. -I$(srcdir)/../Include \
 		../$(PYTHONFRAMEWORK).framework/Versions/$(VERSION)/$(PYTHONFRAMEWORK)
 
@@ -224,6 +228,13 @@ install_Python:
 		done; \
 	done
 	$(INSTALL_PROGRAM) $(STRIPFLAG) $(BUILDPYTHON) "$(DESTDIR)$(APPINSTALLDIR)/Contents/MacOS/$(PYTHONFRAMEWORK)"
+	@# Use @rpath to avoid encoded actual prefix in Python.app
+	install_name_tool \
+		-change $(PYTHONFRAMEWORKINSTALLNAMEPREFIX)/$(PYTHONFRAMEWORK) \
+			@rpath/$(PYTHONFRAMEWORKDIR)/Versions/$(VERSION)/$(PYTHONFRAMEWORK) \
+		-add_rpath @executable_path/`$(RUNSHARED) $(BUILDPYTHON) -c \
+			"import os; print(os.path.relpath('$(PYTHONFRAMEWORKPREFIX)', '$(APPINSTALLDIR)/Contents/MacOS'))"` \
+		"$(DESTDIR)$(APPINSTALLDIR)/Contents/MacOS/$(PYTHONFRAMEWORK)"
 	sed -e "s!%bundleid%!$(PYTHONFRAMEWORKIDENTIFIER)!g" \
 		-e "s!%version%!`$(RUNSHARED) $(BUILDPYTHON) \
 		-c 'import platform; print(platform.python_version())'`!g" \

Makefile.pre.in

@@ -2457,6 +2457,12 @@ altbininstall: $(BUILDPYTHON) @FRAMEWORKPYTHONW@
 		$(INSTALL_PROGRAM) $(BUILDPYTHON) $(DESTDIR)$(BINDIR)/python$(LDVERSION)$(EXE); \
 	else \
 		$(INSTALL_PROGRAM) $(STRIPFLAG) Mac/pythonw $(DESTDIR)$(BINDIR)/python$(LDVERSION)$(EXE); \
+		install_name_tool \
+			-change $(PYTHONFRAMEWORKINSTALLNAMEPREFIX)/$(PYTHONFRAMEWORK) \
+				@rpath/$(PYTHONFRAMEWORKDIR)/Versions/$(VERSION)/$(PYTHONFRAMEWORK) \
+			-add_rpath @executable_path/`$(RUNSHARED) ./$(BUILDPYTHON) -c \
+				"import os; print(os.path.relpath('$(PYTHONFRAMEWORKPREFIX)', '$(BINDIR)'))"` \
+			"$(DESTDIR)$(BINDIR)/python$(LDVERSION)$(EXE)"; \
 	fi
 	-if test "$(VERSION)" != "$(LDVERSION)"; then \
 		if test -f $(DESTDIR)$(BINDIR)/python$(VERSION)$(EXE) -o -h $(DESTDIR)$(BINDIR)/python$(VERSION)$(EXE); \
@@ -3059,6 +3065,9 @@ frameworkinstallversionedstructure:	$(LDLIBRARY)
 	$(LN) -fsn Versions/Current/Headers $(DESTDIR)$(PYTHONFRAMEWORKINSTALLDIR)/Headers
 	$(LN) -fsn Versions/Current/Resources $(DESTDIR)$(PYTHONFRAMEWORKINSTALLDIR)/Resources
 	$(INSTALL_SHARED) $(LDLIBRARY) $(DESTDIR)$(PYTHONFRAMEWORKPREFIX)/$(LDLIBRARY)
+	@# Use @rpath-based install name to avoid encoded actual prefix
+	install_name_tool -id @rpath/$(PYTHONFRAMEWORKDIR)/Versions/$(VERSION)/$(PYTHONFRAMEWORK) \
+		"$(DESTDIR)$(PYTHONFRAMEWORKPREFIX)/$(LDLIBRARY)"
 
 # iOS/tvOS/watchOS uses a non-versioned framework with Info.plist in the
 # framework root, no .lproj data, and only stub compilation assistance binaries

Misc/NEWS.d/next/macOS/2026-01-28-15-17-41.gh-issue-81218.RMUUr3.rst

@@ -0,0 +1,3 @@
+macOS framework builds (``--enable-framework``) now produce relocatable
+frameworks that can be moved after installation without requiring
+``install_name_tool`` rewriting.

configure

@@ -3633,7 +3633,7 @@ then
 			LINKFORSHARED="-Wl,-stack_size,$stack_size $LINKFORSHARED"
 
 			if test "$enable_framework"; then
-				LINKFORSHARED="$LINKFORSHARED "'$(PYTHONFRAMEWORKDIR)/Versions/$(VERSION)/$(PYTHONFRAMEWORK)'
+				LINKFORSHARED="$LINKFORSHARED -Wl,-headerpad_max_install_names "'$(PYTHONFRAMEWORKDIR)/Versions/$(VERSION)/$(PYTHONFRAMEWORK)'
 			fi
 			LINKFORSHARED="$LINKFORSHARED"
 		elif test $ac_sys_system = "iOS"; then