Looking at this, we may have to explicitly "sign" the bundled frameworks as well:

https://stackoverflow.com/questions/7697508/how-do-you-codesign-framework-bundles-for-the-mac-app-store

Here is a simple PR to test out: https://github.com/pure-data/pure-data/pull/1048

You could probably cherry-pick the commit, if needed.

On May 29, 2020, at 7:15 PM, Miller Puckette <msp@ucsd.edu> wrote:

Me too.

I had 2 days of hair-tearing because, somehow, my pre-compiled tcl/tk appeared
to be signed "incorrectly" - it could neither be un-signed, nor signed over
to Pd when I built the app.  Once I finally understood what was going on I
made a fresh compile of tcltk.

"codesign --verify" returns nothing now, neither complaint nor encouragement.
But "codesign --verify --deep Pd-0.51-0test1.app" gives me:

Pd-0.51-0test1.app: code object is not signed at all
In subcomponent: /Users/msp/work/build/Pd-0.51-0test1.app/Contents/Frameworks/Tcl.framework
In architecture: x86_64

This gives me some pause.  This is after (I believe) your new osc-app.sh has
run its codesign line.

thanks
M

On Fri, May 29, 2020 at 06:09:42PM +0200, Dan Wilcox wrote:
Howdy Miller,

Can you elaborate on the following? I'd like to confirm the new macOS builds are signed & notarized so they will run on macOS 10.15+. I'm now a bit unsure due to Alex's latest email on pd-list.

On May 26, 2020, at 12:00 PM, pd-dev-request@lists.iem.at wrote:

(I'm also having trouble with "codesign", will describe that in a separate
mail).

thanks
Miller

--------
Dan Wilcox
@danomatika <https://urldefense.com/v3/__http://twitter.com/danomatika__;!!Mih3wA!UxZLu_8SnKmFk-zUCsc_mfPL6R3DtVexQ-GVzY_fP_bvD8TYe9WyIHdYbRvT$ >
danomatika.com <https://urldefense.com/v3/__http://danomatika.com/__;!!Mih3wA!UxZLu_8SnKmFk-zUCsc_mfPL6R3DtVexQ-GVzY_fP_bvD8TYe9WyIBrOvTSb$ >
robotcowboy.com <https://urldefense.com/v3/__http://robotcowboy.com/__;!!Mih3wA!UxZLu_8SnKmFk-zUCsc_mfPL6R3DtVexQ-GVzY_fP_bvD8TYe9WyIGYMkTFm$ >

--------
Dan Wilcox
@danomatika
danomatika.com
robotcowboy.com