Code signing breaks conda environment

Hi,

I am trying to release a small application which bundles a conda environment and a python script. I am using Platypus to turn it into a .app, and I include all necessary resources (libraries, binaries etc) inside the Resources directory. My application works correctly before code signing, and is portable between machines (so I don't think it is the case that the conda environment is missing something). However, after signing, it crashes when it runs one of the programs within the conda environment.

I am first signing all .so, .dylib and all files in conda_env/bin as follows:

# Within the conda environment directory in Resources 
find bin -type f | xargs -n1 codesign -f -o runtime --timestamp --sign "Developer ID Application: Whatever (123456789)"

find . -name "*.dylib" -o -name "*.so" -type f | xargs -n1 codesign -f -o runtime --timestamp --sign "Developer ID Application: Whatever (123456789)"

I am then signing the .app itself

codesign -f -o runtime --timestamp --sign "Developer ID Application: Whatever (123456789)" my_app.app

Finally, I convert it into a .dmg (with appdmg) and sign that.

codesign -f --sign "Developer ID Application: Whatever (123456789)" --timestamp my_app.dmg

I submit to the notary service, which succeeds, and then I staple the ticket to the .dmg:

xcrun notarytool submit my_app.dmg --keychain-profile my_notarytool_keychain_id --wait

xcrun stapler staple my_app.dmg

spcl is happy with the signed .app and .dmg and accepts them both.

spctl -a -vv my_app.app

# my_app.app: accepted
# source=Notarized Developer ID
# origin=Whatever (123456789)

spctl -a -vv -t install my_app.dmg

# my_app.dmg: accepted
# source=Notarized Developer ID
# origin=Whatever (123456789)

I have a valid Developer Application ID. All good, right?

Except, during execution, the signed .app crashes. When I look in the Console, the error log always looks similar - something like:

Exception Type:        EXC_BAD_ACCESS (SIGKILL (Code Signature Invalid))
Termination Reason:    Namespace CODESIGNING, Code 2 Invalid Page

Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
0   libsystem_platform.dylib      	       0x186e15848 sys_icache_invalidate + 40
1   libllvmlite.dylib             	       0x2a022f8e8 llvm::sys::Memory::protectMappedMemory(llvm::sys::MemoryBlock const&, unsigned int) + 384
2   libllvmlite.dylib             	       0x29d765528 LLVMPY_TryAllocateExecutableMemory + 92
3   libffi.8.dylib                	       0x103abc04c ffi_call_SYSV + 76
etc

I think all the .dylib, .so, and binaries are signed in my codesign scripts, except for the libsystem_platform.dylib mentioned in the first line of the log. Could this be the problem?

How can I find if I am not signing something that is being used? Are there other types of files that I should be signing that I am missing?

I've been trying to fix this for several days and I feel I have tried everything (constructing the conda env in different ways, signing in different ways, e.g. with/without --deep, with/without signing each type of library/binary) to no avail... Any help would be greatly appreciated!

All the best, George