electronic signature on mac with validaty

Keep in mind that most code signed software that has been modified by an unauthorized party will be rejected by Gatekeeper in OS X, unless Gatekeeper has been disabled or otherwise circumvented, but even with Gatekeeper left on it’s theoretically possible for an enterprising goon to find a way around it, and of course software that hasn’t been certified by a identified developer can always be launched around Gatekeeper anyway. Yes, you can also use the command line to just check sha1 or md5 hashes of application installers and downloads and compare them to a legitimate source, but that won’t reveal the code signing and certificate details. In this case the hash type is sha1 and the signed authority is Apple, which is what you’d expect.

What you’re looking for are the hash type, hash, and authority entries. Sealed Resources version=2 rules=13 files=996 We’ll be using the aptly named ‘codesign’ command, complete with the -dv and –verbose=4 flags to show identifying information about any application, including it’s hash type, hash checksum, and signing authority.Ĭode sign -dv -verbose=4 /Path/To/Application.appįor example, let’s check the signature on Terminal.app, located in /Applications/Utilities/Ĭodesign -dv -verbose=4 /Applications/Utilities/Terminal.appĮxecutable=/Applications/Utilities/Terminal.app/Contents/MacOS/TerminalĬodeDirectory v=20100 size=5227 flags=0x0(none) hashes=255+3 location=embeddedĬDHash=0941049019f9fa3499333fb5b52b53735b498aed6cde6a23Īuthority=Apple Code Signing Certification Authority

To get started, launch Terminal, found in /Applications/Utilities/.

Such a situation is when it would be important to know and verify that the installer has not been tampered with and is legitimately coming from Apple, and aside from checking sha1 hash directly, the easiest way to do that is to check the code signature and cryptographic hash of the app in question. For a practical example, let’s say a user can’t access the Mac App Store for whatever reason, but needs to download an OS X installer application and thus relies on a third party source. Verifying a code signature is particularly important for those getting software and installers from p2p and distributed sources, perhaps a torrent site or newsgroups, IRC, public ftp, or another network resource.

Electronic signature on mac with validaty