Thanks again @IndigoUser for your research into this. Am I right thinking the motivation for you specifically is that you need imagick? I'm trying to get a sense for Indigo users' reliance on PHP extensions; my gut feel is that very few are looking for anything beyond—say—the "common 10" extensions.
In order to make "the 90% easy, and the 10% possible", I think the path forward on this topic is twofold;
Provide a better selection of included extensions
This would hopefully allow most users to sidestep any extension issues (signing etc) altogether.
Any of these (currently 45) extensions should be straightforward candidates for me to include with each php distributed with Indigo. Just have to work out which ones to include. I've started with imagick, so that will be in the next Indigo release.
Fix PECL / PEAR
This forum issue was initially created regarding an extension called "ChartDirector" — a good reminder that exceptions to the common extension requirements will always exist — but it's been the only request of its type in over a year, so I think represents the "10%" use-case mentioned above.
In that light, I would ideally like Indigo to provide a solution for compiling your own extensions (need a working phpize etc), or using PECL — but until that point perhaps a willingness at my end to compile bespoke stuff is sufficient for those users.
@croy & @IndigoUser — your thoughts?
re signing:
Your research is really helpful, thanks! In particular, the com.apple.security.cs.disable-library-validation entitlement; I'm not sure that its existence on MAMP.app is so relevant, but it's very interesting to see it on their bundled php binaries, as those are what actually load the extension.so's.
I believe Homebrew-installed PHP binaries are not signed at all (sidenote: how do they run without throwing warnings?), and thus don't need this entitlement, also explaining why they happily load extensions provided as prebuilt PECL binaries.
I am currently wondering, if I could give the Indigo PHP binaries this entitlement, do you think it would resolve the issues when attempting to load 3rd-party-provided extensions?