codesign files put inside `python${VERSION}.zip`, as with `PIL/.dylibs` in `pillow`

[glyph]

encrust release cannot find binary files inside the zip file currently, leading to notarization failures; it probably needs to unzip then re-zip it.

[glyph]

As suggested by https://github.com/ronaldoussoren/py2app/issues/258 , this can be worked around by adding "packages": ["PIL"] into the options/py2app section of AppDescription.setupOptions.

As I write this comment I have verified that it no longer puts .dylibs into the zip file when doing this, and thus the .dylib and .so files in the package do end up in the bundle, but I am still waiting for a notarization of a stub build of PINPal that actually does this.

Given that we haven't actually parsed pyproject.toml at that point and don't know the dependency list, doing this automatically iff the app being packaged depends on pillow will require a bunch of additional work, so this may need an escape hatch.

[glyph]

"The staple and validate action worked!", allegedly

[glyph]

OK, the app appears to launch just fine, although I haven't done anything beyond import Image; it does fully get through notarization just fine now though.

[glyph]

so here's an idea; at the appropriate time:

• inspect $APP/Contents/Resources/lib/python3*.zip with zipfile.ZipFile, looking for any .dylib or .so files
• iff there are any .so or .dylib files in that zip file, we know that will cause a notarization failure, so emit a clearly-worded error message that describes what to do (i.e.: add something to encrust-setup.py to describe an explicit package to be included)

and then obviously add some way to pass through the packages= arg.

[glyph]

to avoid adding a ton of I/O to every build, I think "the appropriate time" is probably before notarization