fix(darwin): re-sign linker-signed macOS native modules while staging

Python extensions from python-build (the stdlib lib-dynload modules) and
from many wheels keep the ad-hoc signature the linker attached, whose
identifier is the file name including `.so`. Xcode's distribution signing
re-signs them with --preserve-metadata=identifier, which ignores linker
signatures, so codesign derives a new identifier without the extension,
while Xcode can write the designated requirement from the old one. The
result, reported with Xcode 26.5, is a signature that fails its own
requirement, and App Store Connect rejects the build with 90238 "does not
satisfy its designated Requirement" on every such file.

prepare_macos.sh (stdlib) and sync_site_packages.sh (site-packages, app)
now give every still-linker-signed .so/.dylib a regular ad-hoc signature,
whose identifier re-signing preserves. Only the staged dist_macos copies
are touched; the source directories and the provider xcframeworks are left
as they are. CocoaPods and SwiftPM both build from dist_macos.

Refs #250

Author: ndonkoHenri

src/serious_python_darwin/darwin/linker_signatures.sh

@@ -0,0 +1,50 @@
+# Signature normalization for the Mach-O libraries bundled into a macOS app.
+#
+# replace_linker_signatures <dir>...
+#
+# Re-signs ad-hoc every `.so`, `.so.*` and `.dylib` under the given directories
+# that carries the signature the linker attached when it built the file.
+#
+# A linker signature names the code after the output file, extension included
+# (`_ssl.cpython-314-darwin.so`), and codesign never carries metadata over from
+# one: re-signing the file derives a fresh identifier from the file name minus
+# its extension (`_ssl.cpython-314-darwin`). Xcode's distribution signing
+# (Organizer, `xcodebuild -exportArchive`) can write the designated requirement
+# from the identifier it read off the existing signature, so a linker-signed
+# library ends up with a requirement its own new signature does not satisfy,
+# and App Store Connect rejects the upload (error 90238, "does not satisfy its
+# designated Requirement"). A regular ad-hoc signature's identifier is carried
+# over by re-signing, so the requirement and the signature agree.
+#
+# Files are inspected one at a time, because `codesign -d` given several paths
+# stops at the first one that is not signed. Anything that is not
+# linker-signed -- already re-signed, unsigned, or not Mach-O at all -- is left
+# untouched, so a repeated run only re-checks. Ad-hoc signing is deterministic,
+# so re-signing a fresh copy of the same file reproduces the same bytes. Paths
+# containing newlines are not supported.
+#
+# Returns non-zero, after printing the error, when a directory cannot be listed
+# or a file cannot be re-signed.
+replace_linker_signatures() {
+    local dir files bin err
+    for dir in "$@"; do
+        [ -d "$dir" ] || continue
+        if ! files=$(find "$dir" -type f \( -name '*.so' -o -name '*.so.*' -o -name '*.dylib' \)); then
+            echo "replace_linker_signatures: cannot list $dir" >&2
+            return 1
+        fi
+        while IFS= read -r bin; do
+            [ -n "$bin" ] || continue
+            case $(codesign -d --verbose=1 "$bin" 2>&1) in
+                *"CodeDirectory "*linker-signed*) ;;
+                *) continue ;;
+            esac
+            if ! err=$(codesign --force --sign - "$bin" 2>&1); then
+                echo "replace_linker_signatures: codesign failed for $bin: $err" >&2
+                return 1
+            fi
+        done <<EOF
+$files
+EOF
+    done
+}

src/serious_python_darwin/darwin/prepare_macos.sh

@@ -57,6 +57,12 @@ if [ ! -d "$dist" ] || [ "$(cat "$marker" 2>/dev/null)" != "$pb_id" ]; then
     echo "$pb_id" > "$marker"
 fi
 
+# ---- stdlib native module signatures ----------------------------------------
+# Outside the extraction guard, so an already-extracted dist is covered as well.
+# The provider xcframeworks are not touched.
+. "$script_dir/linker_signatures.sh"
+replace_linker_signatures "$dist/stdlib" || exit 1
+
 # ---- flet-dev/dart-bridge (xcframework, same archive for macOS + iOS) -----
 # Separate cache guard so a stale $dist from before this change still picks
 # up the new artifact on first re-prepare.

src/serious_python_darwin/darwin/sync_site_packages.sh

@@ -3,6 +3,8 @@ script_dir=$(cd "$(dirname "$0")" && pwd -P)
 # Provider-signature + provider-integrity checks (see xcframework_verify.sh).
 # Sourced unconditionally so both the iOS and macOS branches can use it.
 source $script_dir/xcframework_verify.sh
+# Linker-signature replacement for the macOS resource trees.
+source "$script_dir/linker_signatures.sh"
 
 # App sources are arch- and platform-independent; stage them as a bare `app/`
 # resource bundle into BOTH dist trees, regardless of whether site-packages
@@ -16,6 +18,7 @@ if [[ -n "$SERIOUS_PYTHON_APP" && -d "$SERIOUS_PYTHON_APP" ]]; then
         mkdir -p "$app_dist/app"
         rsync -a --exclude '.pod' "$SERIOUS_PYTHON_APP/" "$app_dist/app/"
     done
+    replace_linker_signatures "$script_dir/dist_macos/app" || exit 1
 fi
 
 if [[ -n "$SERIOUS_PYTHON_SITE_PACKAGES" && -d "$SERIOUS_PYTHON_SITE_PACKAGES" ]]; then
@@ -136,6 +139,9 @@ if [[ -n "$SERIOUS_PYTHON_SITE_PACKAGES" && -d "$SERIOUS_PYTHON_SITE_PACKAGES" ]
         # file. .pod is only needed by package_command.dart at packaging
         # time to invoke this sync script; it does not belong in the bundle.
         rsync -av --delete --exclude '.pod' "$SERIOUS_PYTHON_SITE_PACKAGES/" "$dist/site-packages/"
+        # The staged copy is re-signed, never the source; each sync restores the
+        # linker-signed files and re-signing them reproduces the same bytes.
+        replace_linker_signatures "$dist/site-packages" || exit 1
 
         # macOS has no framework-ization step -- its .so's load flat from the
         # resource tree -- so nothing here should ever touch the provider