inspect_signature reduced the CodeDirectory to a hardened-runtime boolean
and never verified the signature. It now also reports:
- the parsed CodeDirectory: version, flags decoded from their numeric
value (runtime, library-validation, restrict, kill, adhoc,
linker-signed, unknown bits in hex), code and special slot counts,
location, hash type, platform identifier, runtime version, and
executable-segment flags;
- sealed resources (version, rules, files, or none);
- a local `codesign --verify --strict` result on the opened bundle or
Mach-O, with diagnostics and the sorted nested code it validated;
- whether a notarization ticket is stapled at Contents/CodeResources,
with its digest. The ticket and Apple's records are not checked
because that needs the network;
- derived security facets with their supporting evidence: library
validation, DYLD_* handling, debugger attach, executable-memory
policy, and App Sandbox. Facets stay unknown when flags or aggregate
entitlements are unavailable.
verify:code-signature re-signs copies of the clang-built fixture with
real codesign (ad hoc, hardened runtime, hardened runtime with relaxing
entitlements, library,restrict). It also checks a platform binary and a
tampered bundle, with CLI/MCP parity, and runs in the macOS CI job.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
