Rather than using AddPostAction to sign files, make a new copyAndSign builder that copies a source file to the target, and then signs the target all in the same action, thus Scons treats the target as complete once signed. Replace any usage of env.AddPostAction and then env.Install with env.copyAndSign. This should all mean that re-running the build should not treat a target as being changed just because it was signed, then causing the target to be re-build and re-signed inappropriately.