Try emulating Mavericks' codesign --deep for earlier OS X versions.

dist/codesign.py

@@ -0,0 +1,41 @@
+#!/usr/bin/python
+# Emulates the behaviour of codesign --deep which is missing on OS X < 10.9
+
+import os
+import re
+import subprocess
+import sys
+
+def SignPath(path, developer_id):
+  args = [
+    'codesign',
+    '--preserve-metadata=identifier,entitlements,resource-rules,requirements',
+    '-s', developer_id,
+    '-fv', path
+  ]
+  subprocess.check_call(args)
+
+def main():
+  if len(sys.argv) != 3:
+    print 'Usage: %s <developer id> <app bundle>' % sys.argv[0]
+    sys.exit(1)
+
+  developer_id = sys.argv[1]
+  app_bundle = sys.argv[2]
+
+  for root, dirs, files in os.walk(app_bundle):
+    for dir in dirs:
+      if re.search(r'\.framework$', dir):
+        SignPath(os.path.join(root, dir), developer_id)
+
+    for file in files:
+      if re.search(r'\.(dylib|so)$', file):
+        SignPath(os.path.join(root, file), developer_id)
+      elif re.match(r'(clementine-spotifyblob|clementine-tagreader|gst-plugin-scanner)', file):
+        SignPath(os.path.join(root, file), developer_id)
+
+  SignPath(app_bundle, developer_id)
+
+
+if __name__ == '__main__':
+  main()

src/CMakeLists.txt

@@ -1403,7 +1403,7 @@ if (APPLE)
     add_custom_target(
       sign
       COMMAND
-      codesign --deep --preserve-metadata=identifier,entitlements,resource-rules,requirements -s ${APPLE_DEVELOPER_ID} -fv ${PROJECT_BINARY_DIR}/clementine.app
+      ${PROJECT_SOURCE_DIR}/dist/codesign.py ${APPLE_DEVELOPER_ID} ${PROJECT_BINARY_DIR}/clementine.app
       DEPENDS clementine
       VERBATIM
     )