Details in gtk-mac-bundler: Code Signing: Until mid 2016 gtk-mac-bundler depended upon a launcher shell script to configure the environment. You can still do this, but it causes problems with code-signing. Apple recommends that one not install scripts into the Contents/MacOS folder of a bundle, nor should one attempt to sign scripts. Doing so will produce signatures that are incompatible across different versions of MacOS.
So Apple managed to screw up digital signatures on plain text files. How did they manage that?
See also #2385, #2384, #2422, #2441, #2454.
this ticket has been moved to: https://github.com/Xpra-org/xpra/issues/2388