darwin: packaged app writes .pyo files, invalidating code signature and breaking daemon installation

[Mike McCracken]

After running once, the verify script gives us this:

Verifying Main App:
+ /usr/bin/codesign -v -v UbuntuOne.app
UbuntuOne.app: a sealed resource is missing or invalid
In architecture: x86_64
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/__init__.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/glue.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/inischema/__init__.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/inischema/attributed.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/inischema/glue.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/inischema/parsers.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/inischema/typed.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/parser.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/schema.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/site.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/Ubuntu SSO Helper.app/Contents/Resources/site.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/UbuntuOne Syncdaemon.app/Contents/Resources/site.pyo

NOTE that the PYTHONOPTIMIZE env var is reset by the app wrapper, and set based on a flag in the app's Info.plist, so this should not be an environment-sensitive issue.

[Mike McCracken (mikemc)]

This is a bug in py2app:
https://bitbucket.org/ronaldoussoren/py2app/issue/59/generated-app-is-writing-pyo-files-inside

Until that's fixed, a workaround is to run the app once and re-sign before distributing.
Fortunately, all the .pyo files that could be generated are generated on startup without doing anything in the app, so this is fast.