I'm interested in knowing when the key used to sign one of my macOS applications has changed after an update. How can I get information about which developer certificate was used to sign a given application/binary?

Note that I don't really trust the name on the certificate. I'm worried about people who game Apple's processes to get issued a legitimate developer cert, possibly with a duplicate—or at least plausible—name on them. I'm more interested in getting something like an SHA-256 hash of the developer cert used to sign a given binary.

  • I don't know if this will help, but maybe look at AppName/Contents/_CodeSignature/CodeResources. If you can't view it using TextEdit, try using an app like BBEdit. – Sam Sep 9 at 17:34
  • @Sam Thanks, but it doesn't help, at least not in the general case. For example, looking at this file for Valve's Steam.app, I see no indication of the key/cert used for signing. – Dale Sep 9 at 17:38
  • This GitHub Python project smells like it might dump the certs from a binary, but I haven't had the courage to install its deps and run it. Seems like finding the LC_CODE_SIGNATURE command and digging down into the blob with the good stuff might be easier than all this. Here's an additional reference about code signing, including parsing the blob with openssl pkcs7. – Dale Sep 9 at 17:48

You must log in to answer this question.

Browse other questions tagged .