"a sealed resource is missing or invalid" when X.app has nested Y.framework

[Draknek]

I'm having trouble signing a .app folder that contains a nested .framework folder. I believe this issue affects a large number of developers releasing games with Godot (which uses rcodesign as the built-in way to notarize Mac applications from Windows/Linux).

I sent this bug report by email last year (logged as #188) but I wanted to make an issue with the relevant details so that it's shared somewhere public, in case it's useful to anyone else. I'm coming back to this now because another Godot developer mentioned having the same issue.

Original report follows:

I've spent a few hours investigating it and looking at github issues, but couldn't find anything that seemed like my problem. (#148 / #149 are also about nested bundles but seem like a different issue).

The released version or Git commit that this tool was built from:
Apple Codesign 0.29.0, prebuilt binary.

The command line used.
./rcodesign sign --p12-file quill-notarize/draknek-notarization.p12 --p12-password [password] --for-notarization -v The\ Electrifying\ Incident/The\ Electrifying\ Incident.app/ > rcodesign-log.txt 2>&1

The full output of the command.
https://drive.google.com/file/d/1Y-UwUlCns4ogIuFAQedtEni5MjbPNKQP/view?usp=sharing

I think this is likely the crucial section:

bundle has no main executable to sign specially
leaving nested bundle Contents/Frameworks/libgodotsteam.macos.template_release.framework
signing bundle at The Electrifying Incident/The Electrifying Incident.app/ into The Electrifying Incident/The Electrifying Incident.app/
collecting code resources files
sealing nested directory as a bundle: Contents/Frameworks/libgodotsteam.macos.template_release.framework
could not find main executable of presumed nested bundle: Contents/Frameworks/libgodotsteam.macos.template_release.framework

The output of rcodesign diff-signatures comparing similar operations between Apple’s tooling and ours.
https://drive.google.com/file/d/1H9_0YdKSOXphnEXf98Je7WqKa5swTbHe/view?usp=sharing

A copy of the entity you were attempting to sign.
(Not included here - shared by email on 2025-04-11 from alan@draknek.org)

Text copy or screenshot of error from Apple tooling indicating what failed.

codesign --verify --deep --verbose The\ Electrifying\ Incident/The\ Electrifying\ Incident.app/
The Electrifying Incident/The Electrifying Incident.app/: a sealed resource is missing or invalid
file added: /Users/alan/Documents/The Electrifying Incident/The Electrifying Incident.app/Contents/Frameworks/libgodotsteam.macos.template_release.framework