I have been upgrading a project from Python2.7 to Python3.8 while at the same time dealing with deployment/signing issues on MacOS Mojave and Catalina.
The Python app is build using Py2app and then signed, but exactly one file is failing when signing:
codesign --sign "${IDENTITY}" --entitlements ../entitleme.plist --deep "demo.app/" --force --options runtime
demo.app/: main executable failed strict validation
In subcomponent: /demo.app/Contents/Frameworks/liblzma.5.dylib
and without strict:
codesign --sign "${IDENTITY}" --entitlements ../entitleme.plist --deep "demo.app/" --no-strict --force --options runtime
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/codesign_allocate: the __LINKEDIT segment does not cover the end of the file (can't be processed) in: demo.app/Contents/Frameworks/liblzma.5.dylib
demo.app/: the codesign_allocate helper tool cannot be found or used
In subcomponent: demo.app/Contents/Frameworks/liblzma.5.dylib
Another question here indicated that PyInstaller or other systems had similar problems and that this incomplete solution fixed it. However, the actual solution (if found) appears uninteligible in the edits or in changes to the linked material. Also, I note that codesign_allocate is listed as not found but it is in the path and runs fine, so I suspect its usage on a file with the __LINKEDIT segment error is bad.
It appears that the liblzma comes from compressed algorithms incorporated by a library during the py2app build, and attempts to pursue an update have thusfar been unfruitful---though I have begun to wonder whether recompiling the source material on the latest MacOS will correct these errors.
Is there a known path for resolving this issue?