codesign

Codesign is the process and the accompanying tool used to attach a digital signature to executable code in order to verify its origin and integrity. In Apple’s software ecosystem, the codesign command-line utility signs macOS and iOS binaries. The signature binds the software to a certificate issued by a trusted authority, enabling verification by systems such as macOS Gatekeeper and the App Store.

Code signing relies on a developer identity stored in the system keychain. The signer can apply a signature to the main binary and ancillary resources, and may include entitlements that declare permissions or capabilities. For distribution, developers use either a Developer ID certificate for outside-the-store distribution or a distribution certificate tied to the Mac App Store. A timestamp can be embedded to preserve validity after certificate expiration; the Hardened Runtime option strengthens security.

Common commands include signing with codesign -s "Identity" /path/to/app; verification with codesign --verify /path/to/app; and signing with entitlements using codesign --entitlements plist --sign "Identity" /path/to/app. Additional flags such as --deep, --force, --timestamp, and --options runtime control scope, overwriting existing signatures, and runtime hardening behavior.

Code signing primarily ensures authorship and integrity; it does not guarantee safety from malicious code. Signatures can be revoked or become invalid if the signing certificate expires or is compromised, in which case the software may be blocked by security systems.