Do you know whether this applies to everything which executes? If my build scripts create a build script and run it I guess that will be ok, but if my build scr

Do you know whether this applies to everything which executes? If my build scripts create a build script and run it I guess that will be ok, but if my build scripts build a specialised parser (say, from C source) I need to add a step after linking to code sign the generated parser binary before using it? Is that about right?