How to verify signature of a package

Question

Created Mar ’16

Replies 3

Boosts 1

Views 3.8k

Participants 5

In order to verify the signature of an application on disk, we can use SecStaticCodeCheckValidityWithErrors, which works as expected.

However, if this is used on a signed package, the following error occurs

The operation couldn’t be completed. (OSStatus error -67062.)

Error 67062 also represents that an application is not signed

It appears that SecStaticCodeCheckValidityWithErrors only works with binary code or application bundles. To confirm this, calling

codesign

also fails to verify the signature of a package:

codesign -dvvv myPackage.pkg

myPackage.pkg: code object is not signed at all

How can we programmatically verify the signature of a package (pkg), without resorting to calling an external process such as pkgutil?

Boost

Answer 1

DTS Engineer OP

Apple

Mar ’16

However, if this is used on a signed package, the following error occurs …

The code signing APIs work on code, not installer packages, so this failure is expected.

How can we programmatically verify the signature of a package (pkg), without resorting to calling an external process such as pkgutil?

[incorrect information removed; see rbrockerhoff’s answer below]

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

0

Answer 2

rbrockerhoff OP

Mar ’16

If the package is a flat XAR file (the first 4 bytes are 'xar!'), you can use the APIs in /usr/include/xar/xar.h.

Basically, open the file with xar_open(), call xar_signature_first() and then iterate over the certificates with xar_signature_get_x509certificate_data(), building a SecCertificateRef for each, then use the certificate array with SecTrustCreateWithCertificates(); then check the SecTrustRef with the X509 policy.

Fun! ;-)

1

Answer 3

watson-chen OP

Jan ’25

'xar_open' is deprecated: first deprecated in macOS 12.0 - xar is a deprecated file format and should not be used.

Any idea ?

1