I'd like my shell script to verify if the /System/Library/Extensions folder (and subfolders) contains any kexts that don't pass signature validation. How do I do that?

There are a couple utilities that seem to include that kind of functionality, e.g.

kextcache -system-prelinked-kernel

but they either apply modifications to the system or do other unwanted lenghty checks. Only the signature validation is necessary here.

Many thanks in advance for your help!

1 Answer 1


Here's the script which will output not singed kexts inside this directory:


cd /System/Library/Extensions

find *.kext -prune -type d | while read d; do
    codesign -d "$d" 2>/dev/null
    if [[ $rc != 0 ]] ; then
        echo "$d" is not signed.
  • 1
    Thanks! I've however changed "find *" to find "find *.kext" in order to skip the signature checking of folders, and do kexts only.
    – DavidD
    Nov 7, 2014 at 13:28
  • @DavidD Good point! I'll add it to an answer. Nov 7, 2014 at 13:29
  • 1
    Oops: I noticed that the code above actually only outputs files that have no signature at all. For those looking to output files that were signed, but got modified and therefore don't pass validation, modify the code above: 1) use 'codesign -v "$d" 2>&1 | grep "invalid signature"' 2) remove the rc variable and if statement
    – DavidD
    Nov 8, 2014 at 9:02
  • Use find \*.kext.... you want to make sure the * gets through to to the find utility. Without it bash will do the expansion and that's not what you wanted. Sep 19, 2016 at 21:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .