PyInstaller exits zero, then the real work starts: notarization traps that report success

The shape shared by most of what broke here is a tool that reports success on an artifact a user cannot run. `codesign --verify` passes ad-hoc signed binaries, because verification checks integrity rather than who signed ^[9]. `xcrun notarytool submit --wait` returns a clean exit code for a completed upload, not an accepted build, so Apple can answer `status: Invalid` while the script marches on, tries to staple a ticket that was never issued, collects "Record not found" and error 65, and declares the release shipped ^[11]. Add the script's own success report and that is three places in one pipeline where a green result sits on top of a build that will not install ^[16].

The identity trap runs the other way. `security find-identity -v -p codesigning` says "0 valid identities found" with the certificate and its private key both sitting in the keychain, because Apple's Developer ID G2 CA intermediate is absent and the trust chain cannot be built; the error text does not mention any of that ^[5]. The check that actually settles it is `codesign -d -vvv` showing three authority lines, from the Developer ID Application leaf up through the Developer ID Certification Authority to Apple Root CA ^[6].

What the author ends up building is a distrust of the tools rather than a better one: pick binaries by `file -b` type instead of filename, since Qt and Python framework binaries carry no extension at all and every `find -name "*.dylib"` loop online skips them ^[7]; use `find -exec` to avoid the argument-length ceiling that a long `Developer ID Application: Name (TEAMID)` string pushes `xargs` into ^[8]; then grep the authority back out of every Mach-O as a guard ^[10]. The payoff is arithmetic. A broken build fails on your own machine in 20 seconds instead of 15 minutes into Apple's queue, a loop 45 times shorter on exactly the error class most likely to repeat ^[15].

The translocation bug is the one no local test reaches. A user who launches from Downloads or a mounted DMG gets a randomized read-only path, so the updater downloaded, installed, relaunched the old version and downloaded again without end, and it never reproduced on the developer's machine because developers do not run their own app out of quarantine ^[13].

One caution on scope. The account puts Windows antivirus heuristics and browser download blocking next to notarization as the things that consumed weeks ^[1], but the material here documents the Apple half at error-message granularity and leaves the Windows half asserted. It is one engineer's log of one app, roughly 33k lines of PySide6, MediaPipe and ONNX ^[3]. The $99 a year Apple Developer fee is the only sum of money in the whole gauntlet; every other cost in it is engineering time ^[14].