cffi doesn't work inside a macOS app bundle signed with 'runtime' option without com.apple.security.cs.allow-unsigned-executable-memory entitlement

Created originally on Bitbucket by Glyph

per https://developer.apple.com/developer-id/, Apple is encouraging all developers to get their apps "notarized", which comes along with new code signing requirements.

One of these requirements is the new 'runtime' code signing option, which is intended to preserve signature integrity by preventing dynamic loading of malicious code.

I am guessing something is broken with libffi, because when I try to retrieve an https URL with treq inside an application code-signed with this option, I get a traceback as soon as it starts trying to talk to cffi-wrapped APIs:

2018-10-28T11:45:56-0700 [stderr#error]     treq.get("https://glyph.im/").addCallback(print, "hooray")
2018-10-28T11:45:56-0700 [stderr#error]   File "treq/api.pyc", line 24, in get
2018-10-28T11:45:56-0700 [stderr#error]   File "treq/client.pyc", line 112, in get
2018-10-28T11:45:56-0700 [stderr#error]   File "treq/client.pyc", line 239, in request
2018-10-28T11:45:56-0700 [stderr#error]   File "twisted/web/client.pyc", line 1975, in request
2018-10-28T11:45:56-0700 [stderr#error]   File "twisted/web/client.pyc", line 2043, in request
2018-10-28T11:45:56-0700 [stderr#error]   File "twisted/web/client.pyc", line 1850, in request
2018-10-28T11:45:56-0700 [stderr#error]   File "twisted/web/client.pyc", line 1651, in request
2018-10-28T11:45:56-0700 [stderr#error]   File "twisted/web/client.pyc", line 1635, in _getEndpoint
2018-10-28T11:45:56-0700 [stderr#error]   File "twisted/web/client.pyc", line 1510, in endpointForURI
2018-10-28T11:45:56-0700 [stderr#error]   File "twisted/web/client.pyc", line 945, in creatorForNetloc
2018-10-28T11:45:56-0700 [stderr#error]   File "twisted/internet/_sslverify.pyc", line 1304, in optionsForClientTLS
2018-10-28T11:45:56-0700 [stderr#error]   File "twisted/internet/_sslverify.pyc", line 1664, in getContext
2018-10-28T11:45:56-0700 [stderr#error]   File "twisted/internet/_sslverify.pyc", line 1695, in _makeContext
2018-10-28T11:45:56-0700 [stderr#error]   File "OpenSSL/SSL.pyc", line 1108, in set_verify
2018-10-28T11:45:56-0700 [stderr#error]   File "OpenSSL/SSL.pyc", line 333, in __init__
2018-10-28T11:45:56-0700 [stderr#error] SystemError: <built-in method callback of CompiledFFI object at 0x10824e3e8> returned NULL without setting an error