How to Verify an App's Signature on macOS: A Guide to codesign and spctl

Introduction / Why This Is Needed

Verifying an application's digital signature is a critical step for ensuring the security of your macOS. The signature guarantees that the code has not been altered since it was released by the developer and that it originates from a verified source. The system Gatekeeper uses this data to automatically block untrusted software. This guide will help you manually verify any downloaded program, which is particularly useful when encountering errors like "Unidentified Developer" or for auditing installed software.

Requirements / Preparation

• macOS: Any modern version (Sierra or newer).
• Privileges: Standard user rights. To check system applications, administrator privileges may be required (use sudo at the beginning of the command if you get an access error).
• Terminal Familiarity: Basic understanding of filesystem navigation (cd, ls).

Step-by-Step Instructions

Step 1: Find the Application in Finder

Navigate to the folder containing the application you want to verify (e.g., Downloads or Applications). Typically, macOS applications have a .app extension and are packages (folders). Note or copy the full filename (e.g., Telegram.app).

Step 2: Open Terminal and Navigate to the Application

Launch Terminal. Use the cd command to navigate to the directory with your application. For example, if the application is in Downloads:

cd ~/Downloads

You can also drag the .app file directly into the Terminal window—the full path will be inserted automatically.

Step 3: Check Signature Details with codesign

The codesign command provides low-level information about the signature. Execute:

codesign -dv --verbose=4 "Telegram.app" 2>&1 | grep -E "Authority|TeamIdentifier|Identifier"

What the command does:

• -dv — Requests verification details.
• --verbose=4 — Most detailed output.
• 2>&1 — Merges stderr and stdout (to capture all data).
• grep — Filters only lines with the trust chain (Authority), the developer's team identifier (TeamIdentifier), and the application's identifier (Identifier).

Example of successful output:

Authority=Developer ID Application: Telegram FZ-LLC (Y29tcGxleCB...)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
TeamIdentifier=Y29tcGxleCB...
Identifier=ru.keepcoder.Telegram

If the command fails with code object is not signed at all, the application is unsigned.

Step 4: Assess Whether the System Trusts This Application (spctl)

The spctl command (SecAssessment) simulates Gatekeeper's behavior. It checks not only for a signature but also for trust in the publisher's certificate.

spctl -a -vv "Telegram.app"

Key parameters:

• -a — Perform assessment.
• -vv — Verbose output.

Example outputs:

• Trusted: accepted (and possibly source=Notarized for notarized apps).
• Rejected: rejected with a reason, such as:
  • source=Notarized — Notarization check failed (relevant for macOS Catalina 10.15+).
  • source=Developer ID — Developer is not in the trusted list (if the certificate was revoked or is unknown to the system).
  • source=System — System app, but with signature issues.

Step 5: Manual Verification via Finder (No Terminal)

If the terminal seems complex, you can perform a partial visual check:

1. In Finder, locate the .app file.
2. Ctrl+click (or right-click) on it and select "Show Package Contents".
3. In the opened folder, navigate to Contents/_CodeSignature/.
4. If this folder contains a CodeResources file (and possibly CodeDirectory, CodeSignature), it indicates a basic signature is present. The absence of this folder is a sign of an unsigned application.

Step 6: Signature Check for a Specific Binary File

Sometimes it's useful to verify not the entire .app package but the executable file inside it. This can provide more precise information.

codesign -dv --verbose=4 "Telegram.app/Contents/MacOS/Telegram" 2>&1 | grep -E "Authority|TeamIdentifier"

The path Contents/MacOS/ is standard for executable files inside macOS applications.

Verifying the Result

You have successfully verified the signature if:

1. The codesign command output a certificate chain (Authority=...) and did not report a "not signed" error.
2. The spctl command showed accepted.
3. The _CodeSignature folder with files is present in Finder.

If spctl returned rejected but codesign showed a valid chain, the issue is likely with Gatekeeper settings (e.g., notarization not passed) or the developer's certificate being revoked.

Potential Issues

• codesign: error: invalid argument — Ensure the path to the .app is correct and quotes are proper, especially if the name contains spaces. Dragging the file into Terminal is best.
• code object is not signed at all — The application has no digital signature. Launch may be blocked by Gatekeeper. It is recommended to find an official signed version.
• spctl: rejected with reason source=Notarized — The app is signed but failed mandatory notarization with Apple (for macOS Catalina 10.15+). Contact the developer.
• spctl: rejected with reason source=Developer ID — The developer's certificate is not trusted (possibly revoked, or you are using an older macOS version that doesn't recognize the new root certificate). Check for an app update.
• Access error (Operation not permitted) — Try running the command with sudo (e.g., sudo codesign -dv ...). Be cautious running unknown applications with elevated privileges.