title: Mapping process and mapped file have different Team IDs
body: <p>macOS 10.14.5 --> Sorry my Catalina is in quarantine at work!
  Xcode 11.2.1</p>
  
  <p>com.apple.security.cs.disable-library-validation does not behave as documented.</p>
  
  <p>My test application is X11 (XQuartz) based and thus needs libraries from /opt/X11/ and /usr/lib/ which have a different team ID from mine.</p>
  
  <p>The app contains a C binary which and works calls "winteracter" a small FORTRAN binary which displays an X11 window and dialogue. "winteracter" is signed/hardened/sandboxed (inherit) before importing to Xcode. It is placed in the Resources folder but placing it in MacOS makes no difference.</p>
  
  <p>The entitlements are as follows:
  Main application:</p>
  
  <pre><code>&lt;key&gt;com.apple.security.cs.disable-library-validation&lt;/key&gt;
  &lt;true/&gt;
  &lt;key&gt;com.apple.security.temporary-exception.files.absolute-path.read-only&lt;/key&gt;
  &lt;array&gt;
      &lt;string&gt;/opt/X11/lib/&lt;/string&gt;
      &lt;string&gt;/usr/lib/&lt;/string&gt;
  &lt;/array&gt;
  </code></pre>
  
  <p>Auxiliary binaries:</p>
  
  <pre><code>&lt;key&gt;com.apple.security.inherit&lt;/key&gt;
  &lt;true/&gt;
  </code></pre>
  
  <p>The application successfully notarizes (thus signing, hardening and sandboxing are Okay)
  High Sierra: It works. Mojave: it gives the runtime error (Console:error+fault+winteracter):</p>
  
  <pre><code>Library Validation failed: Rejecting '/opt/X11/lib/libXt.6.dylib' (Team ID: NA574AWV7E, platform: no) for process 'winteracter(11592)' (Team ID: P65398CN49, platform: no), reason: mapping process and mapped file (non-platform) **have different Team IDs**
  </code></pre>
  
  <p>This is odd for two reasons:
  1- the rejection of different team IDs contradicts with Apple's description of "disable-library-validation"
  2- december 2019 I got a functional notarized application by simply using the command line codesign with "-o runtime". This no longer works.</p>
  
  <p>Any suggestion ?</p>