If you start signing dynamic libs, I think you also need to set the min deployment target to 10.9 or above, at least for apps with a "hardened run-time" but I'm not sure if Pd does since we are (re)using the Wish app from the Tk build process. (I *think* it is as it is enabled during the code sign steps which apply the entitlements?.) The security settings like these are much more obvious when making a more "native app" via Xcode but less so when building on the command line. In any case, I did a quick search and found the following: