[Pythonmac-SIG] codesigning py2app/wxPython app failing

[Brendan Simon (eTRIX)]

I'm trying to codesign a wxPython app bundle generated with py2app.
(python2.7, wxPython 3.0.2, Intel 64/32-bit, build on 10.10.5, XCode 6.4
installed)

I'm getting the following error:

$ codesign -vvvv -f --deep -s <mycredentials>dist/<myapp>.app
dist/<myapp>.app: code failed to satisfy specified code requirement(s)
In subcomponent:
<path>/dist/<myapp>.app/Contents/Frameworks/libncursesw.5.dylib

I've read that this can be a problem if a framework is signed, but it
isn't.  Also "codesign -f" is supposed to replace any signed objects
anyway, right?

$ codesign -vvvv dist/<myapp>.app/Contents/Frameworks/libncursesw.5.dylib
dist/<myapp>.app/Contents/Frameworks/libncursesw.5.dylib: code object is
not signed at all
In architecture: x86_64

For testing, I removed libncursesw.5.lib, but now codesign complains
about dist/<myapp>.app/Contents/Frameworks/libwx_osx_cocoau-3.0.0.2.0.dylib.

If I remove libwx_osx_cocoau-3.0.0.2.0.dylib, it complains about
dist/<myapp>.app/Contents/Frameworks/Python.framework.

If I remove Python.framework, it complains about
dist/<myapp>.app/Contents/MacOS/python

If I remove python, I don't get any errors referencing any files or
directories, but I still get the "code failed to satisyfy specified code
requirement(s)".

$ codesign -vvvv -f --deep -s "Sureshot" dist/<myapp>.app
dist/<myapp>.app: code failed to satisfy specified code requirement(s)


I set up the following environment variable to resolve a
codesign_allocate error.  There were other codesign_allocate binaries on
my system but this is the only one that seemed to not complain.

export CODESIGN_ALLOCATE="/usr/bin/codesign_allocate"

Any ideas about what is going on and how to resolve this?

Is it a certificate issue perhaps?  I purchased a class2 cert from
sslstart.com.  I was a renewed one and I'm not 100% sure I'm using the
correct private key for the certificate.  Would that cause the above errors?

I've never had any success signing an app.  I get the same errors with
another cert/private key that someone else provided to me (from
www.digicert.com).  KeyChain says that both certs were signed by an
unknown authority.  Could this be the issue?

Thanks for any help.
Brendan.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/pythonmac-sig/attachments/20150823/188b6a62/attachment.html>