Problem with missing code signature (sealing) on cltool

[zuckschwerdt]

The MacOS app bundle (Unison-v2.51.4_rc1.ocaml-4.11.1.macos-10.15.app.tar.gz) has two executables:

• Contents/MacOS/Unison (the UI)
• Contents/MacOS/cltool (the CLI)

Only Unison seems to be signed, and cltool is not. This prevents launching the UI with "Unison" is damaged and can't be opened.

I have no deeper understanding of signing, in Mach-O executable the signature is embedded but I don't know how to display infos.
However checking the signing (sealing?) shows:

$ codesign --verify --deep --strict --verbose=2 Unison.app
Unison.app: a sealed resource is missing or invalid
file added: Unison.app/Contents/MacOS/cltool

If we either remove the unsigned (unsealed?) file cltool the bundle can start:

$ rm Unison.app/Contents/MacOS/cltool
$ codesign --verify --deep --strict --verbose=2 Unison.app
Unison.app: valid on disk
Unison.app: satisfies its Designated Requirement

or remove the signing from the other binary:

$ md5 Unison.app/Contents/MacOS/*
MD5 (Unison.app/Contents/MacOS/Unison) = 1e08f0eada4a2f5c50acb3c8605e3b68
MD5 (Unison.app/Contents/MacOS/cltool) = f8c0fe8671c198f5b23023680dcd290f

$ codesign --remove-signature Unison.app/Contents/MacOS/Unison
$ codesign --remove-signature Unison.app/Contents/MacOS/cltool

$ md5 Unison.app/Contents/MacOS/*
MD5 (Unison.app/Contents/MacOS/Unison) = 2fd89606ce1a20b1badbcab7409a6317 <- different
MD5 (Unison.app/Contents/MacOS/cltool) = f8c0fe8671c198f5b23023680dcd290f <- same

$ codesign --verify --deep --strict --verbose=2 Unison.app
Unison.app: code object is not signed at all

Best solution would be to also sign (seal) the cltool. Alternativly remove the signing from Unison executable.

Not sure how to roll that into the Actions, sorry :/