Reading the developer docu about Code Signing, it says in section
Digital Signatures and Signed Code:
To create a digital signature, the signing software computes a special type of checksum called a hash (or digest) based on a piece of data or code and encrypts that hash with the signer’s private key. This encrypted hash is called a signature.
To verify that signature, the verifying software computes a hash of the data or code. It then uses the signer’s public key to decrypt the signature, thus obtaining the original hash as computed by the signer. If the two hashes match, the data has not been modified since it was signed by someone in possession of the signer’s private key.
Signed code contains several digital signatures:
- If the code is universal, the object code for each slice (architecture) is signed separately. This signature is stored within the binary file itself.
- Various components of the application bundle (such as the Info.plist file, if there is one) are also signed. These signatures are stored in a file called _CodeSignature/CodeResources within the bundle.
After some fiddling, I know the following:
- Inside the binary, I got the
0xfade0c02) containing all SHA-1 hashes or checksums of the Bundle, e.g.
- Inside the bundle, I got the
_CodeSignaturedirectory with the
CodeResourcesfile, which - as the cited paragraph above mentions - should contain all signatures. However, the
CodeResourcesonly contains base64 encoded SHA-1 hashes of several files.
- Inside the binary, I've got some certificates, which I can extract using
codesign -d --extract-certificates <binary>- generating
codesign1etc. These certificates actually are
0xfade0b01) that do contain certificate signatures. Looking up
CMSI get Cryptographic Message Syntax, which is used to sign data.
Now the paragraph tells me that some hash has to be stored as a signature (encrypted hash) in the binary or in the
I suspect that
codesign uses one of the certificates/
CMS Signatures to extract the public key, then decrypts a signature (encrypted hash) and compares the output to the original hash of a given file, e.g.
So my question is: Where is this signature (encrypted hash)? Is it the signature inside a certificate/
CMS Signature? Or is it somewhere else?