diff --git a/build/build.xml b/build/build.xml
index 8dd5ba298..618760b18 100644
--- a/build/build.xml
+++ b/build/build.xml
@@ -624,29 +624,41 @@
       <arg line="${jdk.path.macosx}/Contents/Home/bin/keytool macosx/work/Processing.app/Contents/PlugIns/jdk${jdk.esoteric}.jdk/Contents/Home/jre/bin"/>
     </exec>
 
+    <property name="contents.dir"
+              location="macosx/work/Processing.app/Contents" />
+
     <!-- Replace libjli.dylib symlink with actual file. 
          Deals with code signing issues on OS X 10.9.5+ -->
-    <property name="jli.path" value="macosx/work/Processing.app/Contents/PlugIns/jdk${jdk.esoteric}.jdk/Contents/MacOS/libjli.dylib" />
+    <property name="jli.path" value="${contents.dir}/PlugIns/jdk${jdk.esoteric}.jdk/Contents/MacOS/libjli.dylib" />
     <delete file="${jli.path}" />
     <exec executable="cp">
       <arg line="${jdk.path.macosx}/Contents/Home/jre/lib/jli/libjli.dylib ${jli.path}"/>
     </exec>
 
-    <copy todir="macosx/work/Processing.app/Contents/Java">
+    <copy todir="${contents.dir}/Java">
       <fileset dir=".." includes="core/library/**" /> <!-- why this? -->
       <!--<fileset dir="shared" includes="launch4j/**" />-->
       <fileset dir="shared" includes="lib/**" />
       <fileset file="shared/revisions.txt" />
     </copy>
 
+    <!-- Use the Processing executable as the stub for exported apps.
+         This works b/c everything app-specific is in Info.plist. -->
+    <property name="app.stub" value="${contents.dir}/Java/modes/java/application/mac-app-stub" />
+    <!-- Grab a copy of the stub binary before it is signed.
+         (See processing.mode.java.JavaBuild for usage.)
+         Prevents signing errors with exported apps. -->
+    <copy file="${contents.dir}/MacOS/Processing" tofile="${app.stub}" />
+    <!-- The ant copy command does not preserve permissions. -->
+    <chmod file="${app.stub}" perm="ugo+x" />
+
     <antcall target="assemble">
-      <param name="target.path" 
-             value="macosx/work/Processing.app/Contents/Java" />
+      <param name="target.path" value="${contents.dir}/Java" />
     </antcall>
 
     <exec executable="macosx/language_gen.py" />
 
-    <property name="launch4j.dir" value="macosx/work/Processing.app/Contents/Java/modes/java/application/launch4j" />
+    <property name="launch4j.dir" value="${contents.dir}/Java/modes/java/application/launch4j" />
 
     <!-- rename the version we need -->
     <move file="${launch4j.dir}/bin/windres-macosx"
@@ -717,17 +729,6 @@
           depends="macosx-build" 
           description="Create a downloadable .zip for the Mac OS X version">
 
-    <!-- The ant copy command does not preserve permissions. -->
-    <chmod file="macosx/work/Processing.app/Contents/MacOS/JavaApplicationStub" perm="ugo+x" />
-
-    <!-- Now handled by the app bundler -->
-    <!--
-    <replace file="macosx/work/Processing.app/Contents/Info.plist"
-             token="VERSION" value="${version}" />
-    <replace file="macosx/work/Processing.app/Contents/Info.plist"
-             token="REVISION" value="${revision}" />
-    -->
-
     <antcall target="macosx-dist-sign" />
 
     <exec executable="ditto" dir="macosx/work">
diff --git a/java/src/processing/mode/java/JavaBuild.java b/java/src/processing/mode/java/JavaBuild.java
index 8e0c679b5..88f6fc3be 100644
--- a/java/src/processing/mode/java/JavaBuild.java
+++ b/java/src/processing/mode/java/JavaBuild.java
@@ -796,7 +796,8 @@ public class JavaBuild {
 
       File macosFolder = new File(contentsFolder, "MacOS");
       macosFolder.mkdirs();
-      Util.copyFile(new File(contentsOrig, "MacOS/Processing"),
+      // This is an unsigned copy of the app binary (see build/build.xml)
+      Util.copyFile(mode.getContentFile("application/mac-app-stub"),
                     new File(contentsFolder, "MacOS/" + sketch.getName()));
 
       File pkgInfo = new File(contentsFolder, "PkgInfo");
diff --git a/todo.txt b/todo.txt
index fac329e9b..fc3671e07 100755
--- a/todo.txt
+++ b/todo.txt
@@ -5,11 +5,15 @@ X   https://github.com/processing/processing/issues/4825
 X clean up error message for sketchbook location
 X   https://github.com/processing/processing/issues/4942
 
+gohai
+X IO library updates
+X   https://github.com/processing/processing/pull/5044
 
 _ Application Exports report as "Damaged" on macOS Sierra
 _   https://github.com/processing/processing/issues/4705
 _   could provide script to un-quarrantine
 _   xattr -d -r com.apple.quarantine
+_   https://github.com/steakknife/unsign
 
 _ should ant run launch the .app so that launchsvcs stuff works properly?