codesign_allocate: fatal error: file not in an order that can be processed

[jeff6times7]

Bug description
I cannot sign the expanded jar file's org/sqlite/native/Mac/x86_64/libsqlitejdbc.dylib. The codesign command fails. I believe you deploy the jar file with the dylib signed but I want to replace its signature with one that I use for the entire app. I have no trouble signing the Mac/aarch64/libsqlitejdbc.dylib on macOS Sonoma 14.5 and Xcode 15.4.

To Reproduce

1. log into a macOS machine as specified in a later section
2. install a certificate that codesign can access
3. download sqlite-jdbc-3.50.2.0.jar to a temp folder
4. unzip -p sqlite-jdbc-3.50.2.0.jar org/sqlite/native/Mac/x86_64/libsqlitejdbc.dylib > libsqlitejdbc.dylib
5. codesign --force --sign yourSigningIdentity libsqlitejdbc.dylib

Expected behavior

The codesign process should exit with a return code of 0 and the following on stderr:

libsqlitejdbc.dylib: replacing existing signature

Behavior observed
The codesign process exits with a return code of 1 and the following on stderr:

/Library/Developer/CommandLineTools/usr/bin/codesign_allocate: fatal error: file not in an order that can be processed (code signature data out of place): sqlite-jdbc-bug/libsqlitejdbc.dylib
libsqlitejdbc.dylib: the codesign_allocate helper tool cannot be found or used

Environment (please complete the following information):

• OS: macOS Catalina 10.15.7 (uname -a says 19.6.0)
• CPU architecture: x86_64
• sqlite-jdbc version 3.50.2.0
• Xcode version 12.3

Additional context
There was no problem with doing this for sqlite-jdbc version 3.23.1 but I don't remember what version of macOS and Xcode I was using when I signed 3.23.1. At the time, I was lazy and signed it once and then stored it in my git repo and have been reusing that signed copy until today, when I found out that 3.23.1 doesn't have a Mac/aarch64 native library.

[jeff6times7]

I'm hoping that I can easily build from source and sign with no problem.

[jeff6times7]

It turns out that the easiest solution is to simply remove the signature from the dylibs and put them back into the jar file. Then my signing-at-build-time solution now works.