After running once, the verify script gives us this:
Verifying Main App:
+ /usr/bin/codesign -v -v UbuntuOne.app
UbuntuOne.app: a sealed resource is missing or invalid
In architecture: x86_64
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/__init__.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/glue.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/inischema/__init__.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/inischema/attributed.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/inischema/glue.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/inischema/parsers.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/inischema/typed.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/parser.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/lib/python2.7/configglue/schema.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/site.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/Ubuntu SSO Helper.app/Contents/Resources/site.pyo
resource added: /Users/mmccrack/Documents/Canonical/Source/test-improve-buildout/scripts/dist/build_to_sign/UbuntuOne.app/Contents/Resources/UbuntuOne Syncdaemon.app/Contents/Resources/site.pyo
NOTE that the PYTHONOPTIMIZE env var is reset by the app wrapper, and set based on a flag in the app's Info.plist, so this should not be an environment-sensitive issue.
This is a bug in py2app: /bitbucket. org/ronaldousso ren/py2app/ issue/59/ generated- app-is- writing- pyo-files- inside
https:/
Until that's fixed, a workaround is to run the app once and re-sign before distributing.
Fortunately, all the .pyo files that could be generated are generated on startup without doing anything in the app, so this is fast.