[Pythonmac-SIG] packaged .app creating site.pyo and others, breaking code signature

[Michael McCracken]

I've been getting occasional issues where my code signature is invalid
because python has written .pyo files inside the app bundle.

Specifically it's writing

UbuntuOne.app/Contents/Resources/site.pyo

and a bunch of files in the one package that isn't included in my
.zip, for example:

UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/schema.pyo

This is confusing, because I'm not setting 'optimize' in the py2app options.

I looked into the py2app bundle template, and I see in main.c where it
sets PYTHONOPTIMIZE based on the info.plist PyOptions dict. My
Info.plist has optimize = 0, and if I print os.environ in my main
script, I see 'PYTHONOPTIMIZE': '0'.

OK, so then I print sys.flags immediately afterwards, just as a sanity
check, and I get this:
sys.flags(debug=0, py3k_warning=0, division_warning=0, division_new=0,
inspect=0, interactive=0, optimize=1, dont_write_bytecode=0,
no_user_site=0, no_site=0, ignore_environment=0, tabcheck=0,
verbose=0, unicode=0, bytes_warning=0, hash_randomization=0)

Note the optimize=1. That looks like the culprit, but I'm kind of
stumped as to where that's getting set. Any ideas?

On a related note, I tried to set sys.dont_write_bytecode = True at
the top of my main script, and it still writes the .pyo files.

I imagine I could run the app once before signing it, but that's not
ideal for automated builds.

Thanks for any help,
-mike