How to Verify App Digital Signatures in macOS 13

Downloading software from the internet rather than the Mac App Store introduces potential security risks, making code validation essential. This guide explains how to verify the digital signature, developer identity, and notarization status of any third-party app in macOS 13 (Ventura) using built-in command-line utilities.

Step 1: Open Terminal

To inspect an application's signature, you will use macOS's built-in Terminal application:

  1. Press Command + Space to open Spotlight.
  2. Type Terminal and press Return.

Step 2: Check Developer Signature Using codesign

The codesign utility displays detailed information about the certificate used to sign the application.

Run the following command, replacing /Path/To/Application.app with the actual path (or drag and drop the .app file directly into the Terminal window):

codesign -dv --verbose=4 /Path/To/Application.app

Examine the output for the following key fields:

  • Authority=Developer ID Application: [Developer Name] (Team ID): Confirms that Apple issued the signing certificate to a registered developer.
  • Authority=Developer ID Certification Authority: Confirms the certificate chain leads back to Apple.
  • TeamIdentifier: A unique 10-character code assigned to the developer by Apple.
  • Sealed Resources: Indicates that the contents of the application have not been modified or tampered with since being signed.

If the output says code object is not signed at all, the app has no digital signature and should be handled with extreme caution.

Step 3: Verify Apple Notarization Using spctl

Apple requires apps distributed outside the App Store to be notarized—scanned by Apple for malicious components. You can verify Gatekeeper compliance using spctl:

spctl -a -vvv -t install /Path/To/Application.app

Check the final line of the output:

  • Accepted (source=Notarized Developer ID): The app is signed with a valid Developer ID and successfully cleared Apple's automated malware scanning service.
  • Rejected: The app is unsigned, the signature is invalid, or the app has been altered after signing.

Step 4: Verify Code Integrity

To ensure no files inside the application bundle have been corrupted or maliciously modified, run:

codesign --verify --deep --strict --verbose=2 /Path/To/Application.app

If the verification is successful, the output will return:

/Path/To/Application.app: valid on disk
/Path/To/Application.app: satisfies its Designated Requirement

Any mismatch or tampered resource will trigger an explicit error stating that the contents do not match the signature.