Mac M2 Code Signing Issue with Pyinstaller

[garrettmflynn]

When building the NWB GUIDE using the commoners branch (NeurodataWithoutBorders/nwb-guide#526), the code-signing of Pyinstaller and Electron conflict on Mac, throwing the following error when attempting to start the executable:

rosetta error: unable to mmap __TEXT: 1 
 /var/db/oah/4555e12ae8131e6cac90cd6d442757a07ec81de5ab7d30d89e635a1c1c03f07c/89222e36bf13899e9d7aecd753bb793dd39df17a5c68ff6a4a5e2372d4e120b2/libffi.8.dylib.aot

It appears this is a known problem from using the --deep flag, though it doesn't appear that @electron/notarize exposes this.

Oddly, this isn't an issue on Intel Mac builds.

---

Additionally, when excluding the custom build output folder from the signing process through the config.mac.signIgnore, another error is thrown:

Error: Failed to staple your application with code: 65

Processing: /Users/runner/work/nwb-guide/nwb-guide/.commoners/electron/mac/NWB GUIDE.app
Properties are {
    NSURLIsDirectoryKey = 1;
    NSURLIsPackageKey = 1;
    NSURLIsSymbolicLinkKey = 0;
    NSURLLocalizedTypeDescriptionKey = Application;
    NSURLTypeIdentifierKey = "com.apple.application-bundle";
    "_NSURLIsApplicationKey" = 1;
}
Props are {
    cdhash = {length = 20, bytes = 0x05e37bbb52cc83bf17ceb7792cd9b552dc7401a9};
    digestAlgorithm = 2;
    flags = 65536;
    secureTimestamp = "2023-12-15 18:24:13 +0000";
    signingId = "com.nwbguide.app";
    teamId = ***;
}
JSON Data is {
    records =     (
                {
            recordName = "2/2/05e37bbb52cc83bf17ceb7792cd9b552dc7401a9";
        }
    );
}
 Headers: {
    "Content-Type" = "application/json";
}
Domain is api.apple-cloudkit.com
Response is <NSHTTPURLResponse: 0x600001720dc0> { URL: https://api.apple-cloudkit.com/database/1/com.apple.gk.ticket-delivery/production/public/records/lookup } { Status Code: 200, Headers {
    Connection =     (
        "keep-alive"
    );
    "Content-Encoding" =     (
        gzip
    );
    "Content-Type" =     (
        "application/json; charset=UTF-8"
    );
    Date =     (
        "Fri, 15 Dec 2023 18:32:39 GMT"
    );
    Server =     (
        "AppleHttpServer/78689afb4479"
    );
    "Strict-Transport-Security" =     (
        "max-age=31536000; includeSubDomains;"
    );
    "Transfer-Encoding" =     (
        Identity
    );
    Via =     (
        "xrail:st53p00ic-qujn15050702.me.com:8301:23R615:grp60,631194250daa17e24277dea86cf30319:7e96b43b45da5d0b06d9f56c691eb9e4:ussjc1"
    );
    "X-Apple-CloudKit-Version" =     (
        "1.0"
    );
    "X-Apple-Edge-Response-Time" =     (
        75
    );
    "X-Apple-Request-UUID" =     (
        "0814cf0f-1c23-4943-ad32-f74ecd908d3f"
    );
    "X-Responding-Instance" =     (
        "ckdatabasews:16307601:st42p63ic-ztfb17163801:8807:2405B345:859bb2da9ab47f3215775d63a7ada1e4b19cac42"
    );
    "access-control-expose-headers" =     (
        "X-Apple-Request-UUID,X-Responding-Instance,Via"
    );
    "x-apple-user-partition" =     (
        63
    );
} }
Size of data is 165
JSON Response is: {
    records =     (
                {
            reason = "Record not found";
            recordName = "2/2/05e37bbb52cc83bf17ceb7792cd9b552dc7401a9";
            serverErrorCode = "NOT_FOUND";
        }
    );
}
CloudKit query for NWB GUIDE.app (2/05e37bbb52cc83bf17ceb7792cd9b552dc7401a9) failed due to "Record not found".
Could not find base64 encoded ticket in response for 2/05e37bbb52cc83bf17ceb7792cd9b552dc7401a9
The staple and validate action failed! Error 65.

With this, the code is not signed and users are forced to manually allow their Mac to run the application—although the Python executable runs fine.