<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
Hi,
<div class=""><br class="">
</div>
<div class="">I realize this is an old thread but I have some recent experience based on setting up an M2 Mac that might be relevant.</div>
<div class=""><br class="">
</div>
<div class="">I was dreading moving to Apple Silicon Macs because of issues like these but I actually did not run into this particular problem. </div>
<div class="">While I can’t be certain I think it is because in the process of installing another piece of software I had to modify Apple’s security </div>
<div class="">restrictions to make them more permissive. Details of how to do this are in the following and it takes only a minute to implement: </div>
<div class="">
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""><br class="">
</span></div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""><a href="https://rogueamoeba.com/support/knowledgebase/?showArticle=ACE-StepByStep&product=Audio+Hijack" class="">https://rogueamoeba.com/support/knowledgebase/?showArticle=ACE-StepByStep&product=Audio+Hijack</a></span></div>
</div>
<div class=""><br class="">
<div>Incidentally, I built mpich from source followed by PETSc in the usual way.</div>
<div class=""><br class="">
</div>
<div>Something else that might be helpful for others is my experience getting ifort to work. (My needs were somewhat specific: mixed </div>
<div>fortran/C code, preferably ifort, and avoid package managers.) The intel OneAPI installer ran smoothly (via rosetta) but when </div>
<div>building mpich (or PETSc) I ran into an obvious problem: clang produces arm64 object files while ifort produces x86 ones. I couldn’t </div>
<div>manage to set the correct CFLAGS to tell clang to target x86. Instead, the (simpler) solution turned out to be (1) the fact that all the </div>
<div>executables in Apple’s toolchain are universal binaries, and (2) the ‘arch’ command can let you run programs for any of the two </div>
<div>architectures. Specifically, executing in the terminal:</div>
<div><br class="">
</div>
<div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">arch -x86_64 bash</span></div>
</div>
<div><br class="">
</div>
<div>starts a bash shell and *every* program that is then run from that shell is automatically the x86 version. So I could then do:</div>
<div>
<div style="margin: 0px; font-stretch: normal; line-height: normal;" class="">FC=ifort</div>
<div style="margin: 0px; font-stretch: normal; line-height: normal;" class="">./configure --prefix=/usr/local/mpichx86 --enable-two-level-namespace</div>
<div style="margin: 0px; font-stretch: normal; line-height: normal;" class="">make</div>
<div style="margin: 0px; font-stretch: normal; line-height: normal;" class="">sudo make install</div>
<div class=""><br class="">
</div>
<div class="">and get an x86 build of mpich which I could then use (from the same shell or a new one started as above) to build [x86] PETSc. </div>
<div class="">Except for some annoying warnings from MKL (I think because it is confused what architecture it is running on) everything runs </div>
<div class="">smoothly and - even in emulation - surprisingly fast.</div>
<div class=""><br class="">
</div>
<div class="">Sorry if this is all well know and already documented on PETSc’s install page.</div>
<div class=""><br class="">
</div>
<div class="">Samar</div>
<div class=""><br class="">
</div>
</div>
<div>
<blockquote type="cite" class="">
<div class="">On Mar 20, 2023, at 6:39 AM, Pierre Jolivet <<a href="mailto:pierre@joliv.et" class="">pierre@joliv.et</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
<div class=""><br class="Apple-interchange-newline">
On 20 Mar 2023, at 2:45 AM, Barry Smith <<a href="mailto:bsmith@petsc.dev" class="">bsmith@petsc.dev</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div class=""><br class="">
</div>
I found a bit more information in gmakefile.test which has the magic sauce used by make test to stop the firewall popups while running the test suite.
<div class=""><br class="">
</div>
<div class="">
<div class=""># MACOS FIREWALL HANDLING</div>
<div class=""># - if run with MACOS_FIREWALL=1</div>
<div class=""># (automatically set in $PETSC_ARCH/lib/petsc/conf/petscvariables if configured --with-macos-firewall-rules),</div>
<div class=""># ensure mpiexec and test executable is on firewall list</div>
<div class="">#</div>
<div class="">ifeq ($(MACOS_FIREWALL),1)</div>
<div class="">FW := /usr/libexec/ApplicationFirewall/socketfilterfw</div>
<div class=""># There is no reliable realpath command in macOS without need for 3rd party tools like homebrew coreutils</div>
<div class=""># Using Python's realpath seems like the most robust way here</div>
<div class="">realpath-py = $(shell $(PYTHON) -c 'import os, sys; print(os.path.realpath(sys.argv[1]))' $(1))</div>
<div class="">#</div>
<div class="">define macos-firewall-register</div>
<div class=""> @APP=$(call realpath-py, $(1)); \</div>
<div class=""> if ! sudo -n true 2>/dev/null; then printf "Asking for sudo password to add new firewall rule for\n $$APP\n"; fi; \</div>
<div class=""> sudo $(FW) --remove $$APP --add $$APP --blockapp $$APP</div>
<div class="">endef</div>
<div class="">endif</div>
<div class=""><br class="">
</div>
<div class="">and below. When building each executable it automatically calls socketfilterfw on that executable so it won't popup.</div>
<div class=""><br class="">
</div>
<div class="">From this I think you can reverse engineer how to turn it off for your executables.</div>
<div class=""><br class="">
</div>
<div class="">Perhaps PETSc's make ex1 etc should also apply this magic sauce, Pierre?</div>
</div>
</div>
</div>
</blockquote>
<div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
<br class="">
</div>
<div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
This configure option was added in <a href="https://gitlab.com/petsc/petsc/-/merge_requests/3131" class="">https://gitlab.com/petsc/petsc/-/merge_requests/3131</a> but it never worked on my machines.</div>
<div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
I just tried again this morning a make check with MACOS_FIREWALL=1, it’s asking for my password to register MPICH in the firewall, but the popups are still appearing afterwards.</div>
<div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
That’s why I’ve never used that configure option and why I’m not sure if I can trust this code from makefile.test, but I’m probably being paranoid.</div>
<div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
Prior to Ventura, when I was running the test suite, I manually disabled the firewall <a href="https://support.apple.com/en-gb/guide/mac-help/mh11783/12.0/mac/12.0" class="">https://support.apple.com/en-gb/guide/mac-help/mh11783/12.0/mac/12.0</a></div>
<div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
Apple has done yet again Apple things, and even if you disable the firewall on Ventura (<a href="https://support.apple.com/en-gb/guide/mac-help/mh11783/13.0/mac/13.0" class="">https://support.apple.com/en-gb/guide/mac-help/mh11783/13.0/mac/13.0</a>), the popups
are still appearing.</div>
<div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
Right now, I don’t have a solution, except for not using my machine while the test suite runs…</div>
<div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
I don’t recall whether this has been mentioned by any of the other devs, but this is a completely harmless (though frustrating) message: MPI and/or PETSc cannot be used without an action from the user to allow others to get access to your machine.</div>
<div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
<br class="">
</div>
<div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
Thanks,</div>
<div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
Pierre</div>
<br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
<blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
<div class="">
<div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div class="">
<div class="">
<blockquote type="cite" class="">
<div class="">On Mar 19, 2023, at 8:10 PM, Amneet Bhalla <<a href="mailto:mail2amneet@gmail.com" class="">mail2amneet@gmail.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class="">This helped only during the configure stage, and not during the check stage and during executing the application built on PETSc. Do you think it is because I built mpich locally and not with PETSc?</div>
<br class="">
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Sun, Mar 19, 2023 at 3:51 PM Barry Smith <<a href="mailto:bsmith@petsc.dev" target="_blank" class="">bsmith@petsc.dev</a>> wrote:<br class="">
</div>
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex;">
<div style="line-break: after-white-space;" class="">
<div class=""><br class="">
</div>
<div class=""> ./configure option with-macos-firewall-rules</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">
<blockquote type="cite" class="">
<div class="">On Mar 19, 2023, at 5:25 PM, Amneet Bhalla <<a href="mailto:mail2amneet@gmail.com" target="_blank" class="">mail2amneet@gmail.com</a>> wrote:</div>
<br class="">
<div class="">
<div dir="ltr" class="">Yes, this is MPI that is triggering the apple firewall. If I allow it it gets added to the allowed list (see the screenshot) and it does not trigger the firewall again. However, this needs to be done for all executables (there will be
several main2d's in the list). Any way to suppress it for all executables linked to mpi in the first place?
<div class=""><br class="">
</div>
<div class=""><span id="m_-8640580052742495038m_-2625297214711973251cid:ii_lffwpb3h0" class=""><Screenshot 2023-03-19 at 2.19.53 PM.png></span><br class="">
</div>
</div>
<br class="">
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Sun, Mar 19, 2023 at 11:01 AM Matthew Knepley <<a href="mailto:knepley@gmail.com" target="_blank" class="">knepley@gmail.com</a>> wrote:<br class="">
</div>
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex;">
<div dir="ltr" class="">
<div dir="ltr" class="">On Sun, Mar 19, 2023 at 1:59 PM Amneet Bhalla <<a href="mailto:mail2amneet@gmail.com" target="_blank" class="">mail2amneet@gmail.com</a>> wrote:<br class="">
</div>
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex;">
<div dir="ltr" class="">I'm building PETSc without mpi (I built mpich v 4.1.1 locally). Here is the configure command line that I used:
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; font-stretch: normal; font-size: 18px; line-height: normal; font-family: Monaco; color: rgb(242, 242, 242); background-color: rgba(0, 0, 0, 0.85);" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class="">./configure --CC=mpicc --CXX=mpicxx --FC=mpif90 --PETSC_ARCH=darwin-dbg --with-debugging=1 --download-hypre=1 --with-x=0</span></div>
</div>
</div>
<br class="">
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr"></div>
</div>
</blockquote>
<div class=""><br class="">
</div>
<div class="">No, this uses MPI, it just does not built it. Configuring with --with-mpi=0 will shut off any use of MPI, which is what Satish thinks is bugging the firewall.</div>
<div class=""><br class="">
</div>
<div class=""> Thanks,</div>
<div class=""><br class="">
</div>
<div class=""> Matt</div>
<div class=""> </div>
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex;">
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Sun, Mar 19, 2023 at 10:56 AM Satish Balay <<a href="mailto:balay@mcs.anl.gov" target="_blank" class="">balay@mcs.anl.gov</a>> wrote:<br class="">
</div>
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex;">
I think its due to some of the system calls from MPI.<br class="">
<br class="">
You can verify this with a '--with-mpi=0' build.<br class="">
<br class="">
I wonder if there is a way to build mpich or openmpi - that doesn't trigger Apple's firewall..<br class="">
<br class="">
Satish<br class="">
<br class="">
On Sun, 19 Mar 2023, Amneet Bhalla wrote:<br class="">
<br class="">
> Hi Folks,<br class="">
><span class="Apple-converted-space"> </span><br class="">
> I'm trying to build PETSc on MacOS Ventura (Apple M2) with hypre. I'm using<br class="">
> the latest version (v3.18.5). During the configure and make check stage I<br class="">
> get a request about accepting network connections. The configure and check<br class="">
> proceeds without my input but the dialog box stays in place. Please see the<br class="">
> screenshot. I'm wondering if it is benign or something to be concerned<br class="">
> about? Do I need to accept any network certificate to not see this dialog<br class="">
> box?<br class="">
><span class="Apple-converted-space"> </span><br class="">
> Thanks,<br class="">
><span class="Apple-converted-space"> </span><br class="">
><span class="Apple-converted-space"> </span><br class="">
<br class="">
</blockquote>
</div>
<br clear="all" class="">
<div class=""><br class="">
</div>
<span class="">--<span class="Apple-converted-space"> </span></span><br class="">
<div dir="ltr" class="">
<div dir="ltr" class="">
<div class="">--Amneet <br class="">
<br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
</div>
</div>
</blockquote>
</div>
<br clear="all" class="">
<div class=""><br class="">
</div>
<span class="">--<span class="Apple-converted-space"> </span></span><br class="">
<div dir="ltr" class="">
<div dir="ltr" class="">
<div class="">
<div dir="ltr" class="">
<div class="">
<div dir="ltr" class="">
<div class="">What most experimenters take for granted before they begin their experiments is infinitely more interesting than any results to which their experiments lead.<br class="">
-- Norbert Wiener</div>
<div class=""><br class="">
</div>
<div class=""><a href="http://www.cse.buffalo.edu/~knepley/" target="_blank" class="">https://www.cse.buffalo.edu/~knepley/</a><br class="">
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br clear="all" class="">
<div class=""><br class="">
</div>
<span class="">--<span class="Apple-converted-space"> </span></span><br class="">
<div dir="ltr" class="">
<div dir="ltr" class="">
<div class="">--Amneet <br class="">
<br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</blockquote>
</div>
<br clear="all" class="">
<div class=""><br class="">
</div>
<span class="">--<span class="Apple-converted-space"> </span></span><br class="">
<div dir="ltr" class="">
<div dir="ltr" class="">
<div class="">--Amneet </div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>