There is a suite of tools from the cloudmatrix guys that addresses that problem.
esky is an auto-update framework for frozen apps that is compatible with the common python “packaging” frameworks. signedimp tries to ensure that apps are not modified after they are signed, and to minimize invasive Windows UAC dialogs. myppy aims to insulate you from base library incompatibility issues on Linux eg installing on distributions with different gcc and libc versions. The whole set can be seen on github here.
The video and slides from this year’s PyCon are here: http://lanyrd.com/2012/pycon/spckh/