有谁知道 Mac OS X 验证磁盘映像 (.dmg) 文件时幕后到底发生了什么？有什么方法可以扩展或定制该过程吗？
编辑：我想创建一个磁盘映像来验证它是否完全执行了它应该执行的操作，仅此而已。例如，如果我分发一些管理密码的软件，恶意用户可能会修改我的包以将密码发送给未经授权的第三方。对于最终用户来说，该功能似乎与我的程序相同，并且他们永远不会知道该软件包已被破坏。我想在安装时执行此验证。
Does anyone knows what exactly happens behind the scenes when Mac OS X verifies a disk image (.dmg) file? Is there any way to extend or customize the procedure?
EDIT: I would like to create a disk image that verifies that it does exactly what it should do and nothing more. For example, if I distribute some software that manages passwords, a malicious user could modify my package to send the passwords to an unwarranted third party. To the end user, the functionality would appear to be identical to my program, and they would never know the package was sabotaged. I would like to perform this verification at mount time.
发布评论
评论（2）
据我所知，您无法修改此过程（除非您进行了一些我不建议的系统黑客攻击）。我相信它会将其与内部校验和进行比较，并确保磁盘的卷标头正常。它会检查所有文件以查看其中是否有任何文件已损坏。
To my knowledge, you cannot modify this procedure (unless you do some system hacks which I don't recommend). I believe it compares it with the internal checksum and makes sure that the disk's volume header is OK. It goes through all of the files to see if any of them are corrupted.
我对 dmg 的理解有限，但据我了解，它本质上是 osx 特定的存档格式，类似于 zip。一种选择是同时分发 dmg 的校验和。这并不是很有用，因为攻击者可以更改用户从您的站点下载的 dmg，他们还可以修改校验和。
我相信您正在寻找的功能是协同设计。这是一种加密验证，表明应用程序自作者签名以来未被修改过。使用此功能有一点障碍，因为您需要苹果开发人员计划的开发人员证书。
Apple 关于协同设计的文档可以在这里找到：
https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html#//apple_ref/doc/uid/TP40005929-CH4-SW5
My understanding of dmg's is limited but as I understand it's essentially an osx specific archive format, similar to zips. One option would be to also distribute the checksum of your dmg. This isn't very useful as if an attacker can change the dmg a user downloads from your site they can also modify the checksum.
The functionality I believe you're looking for is codesigning. It's a cryptographic verification that an app hasn't been modified since it was signed by the author. There's a bit of a barrier to using this as you need a developer certificate from the apple developer program.
Apple's documentation on codesigning can be found here:
https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html#//apple_ref/doc/uid/TP40005929-CH4-SW5