signing an app with PyInstaller only works once

I made a simple Python based app for macOS using this code (empty lines removed):

import tkinter as tk
window = tk.Tk()
label = tk.Label(text="\n    I am a macOS app    \n")
label.pack()
window.mainloop()

Next I made it an .app using PyInstaller with this command (identity and paths shortened):

pyinstaller --noconfirm --onedir --windowed --osx-bundle-identifier "org.tk_test.tk_test" --codesign-identity "<my_identity>" path/to/tk-test.py

It worked like a charm and I was also able to notarize and staple the app for distribution.

...
4748 INFO: Signing the BUNDLE...
24899 INFO: Building BUNDLE BUNDLE-00.toc completed successfully.

I wanted to repeat the process to do some more testing and now without any reason I cannot sign the .app anymore (identity and paths shortened). Of course, I cleared the folder before trying:

...
5263 INFO: Signing the BUNDLE...
23050 WARNING: Error while signing the bundle: codesign command (['codesign', '-s', '<my_identity>', '--force', '--all-architectures', '--timestamp', '--options=runtime', '--deep', '/abs/path/to/dist/tk-test.app']) failed with error code 1!
output: /abs/path/to/dist/tk-test.app: replacing existing signature
/abs/path/to/dist/tk-test.app: A timestamp was expected but was not found.
In subcomponent: /abs/path/to/dist/tk-test.app/Contents/MacOS/lib-dynload/math.cpython-311-darwin.so

23050 WARNING: You will need to sign the bundle manually!
23050 INFO: Building BUNDLE BUNDLE-00.toc completed successfully.

I tried to create it in a fresh and differently named directory and I also made a complete fresh conda env. I don't see any reason, why this should not work anymore. Does anybody have an idea?

Looks like A timestamp was expected but was not found was just a temporary error.

signing an app with PyInstaller only works once
 
 
Q