This gist contains my personal notes and gotchas identified while trying to create an .app out of a Python script and distribute it directly (outside App Store) via a .dmg. This subject has been the source of a lot of confusion and frustration throughout the years. Since altool was retired and replaced by notarytool things have improved in terms of documentation IMHO, but at the same time the 'screws are tightened' by Apple's Gatekeeper in incresingly short intervals. While I welcome added security as a whole, us developers need to jump through quite a few more hoops. It's almost as if they want to encourage you to distribute via the App Store...
All executable (incl. libaries) needs to be signed. pyinstaller does this with the codesign_identity specified (via command line option or in .spec file) and recursively to all dependencies bundled, including the Python executable.
The .dmg needs to be code-signed, too: `codesign --sign ${team_id} "${app_name}.dmg
