通过代码验证应用程序的签名
我已经签署了应用程序。我创建了一个 identity 并使用 codesign 根据 Apple 的 代码签名指南。
现在，如何检查我的应用程序中的签名？
我需要在 Cocoa 应用程序 (Objective-C) 和用 C 编写的应用程序上验证这一点。
I have app signed. I created an identity and used codesign to sign my app as per Apple's Code Signing Guide.
Now, how do I check the signature from within my application?
I need to verify this on Cocoa apps (Objective-C) and apps written in C.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您可以使用 NSTask 并运行“codesign --verify”并检查退出状态。当然，如果程序被更改，它可能会被更改以删除支票，所以我不确定这会给您带来什么。
如果您不担心定向篡改（例如可能会删除您对签名的检查的那种），您可以使用协同设计“kill”选项，如果您只是执行意味着签名有效（至少对于所有已被签名的页面）到目前为止已执行...但如果尚未驻留的页面已被篡改，那么无论如何读取该页面时您都会被杀死）。
也许如果您可以更多地解释一下为什么要验证签名，则可以形成更好的答案。
You could use
NSTaskand run "codesign --verify" and check the exit status. Of corse if the program was altered it could be altered to remove the check, so I'm not sure what that buys you.If you are not worried about directed tampering (like the kind that might remove your check of the signature) you can use the codesign "kill" option, if you do merely executing means the signature is valid (at least for all pages that have been executed so far...but if a not-yet-resident page has been tampered with you will get killed when that one is read in anyway).
Maybe if you could explain a little more about why you want to verify the signature a better answer could be formed.
注意：目前，MacOS X 在执行之前不会验证签名的代码。对于沙盒代码来说，这可能有所不同，否则任何人都可以编辑权利似乎是明智的。
要从应用程序本身检查应用程序签名，请使用 代码签名服务。特别要注意的是
SecCodeCheckValidity。进行检查的代码并不长，但有很多东西需要理解，所以我不会给出代码示例 - 您需要阅读并理解文档。检查签名允许您的应用程序检测其代码和内容的更改。资源并报告它“已损坏”（很可能是，并非所有更改都是恶意的）并拒绝运行。添加这样的代码当然并不能保证您的代码不会被损坏，但它确实提高了防止故意损坏的障碍（如果 MacOS X 开始自行进行检查，那么将会有一个巨大的胜利）。
Note: Currently MacOS X does not verify signed code prior to execution. This may be different for sandboxed code, and it would seem sensible that it is otherwise anybody could edit the entitlements.
To check an applications signature from within the application itself you use the Code Signing Services. In particular look at
SecCodeCheckValidity. The code to do the checking is not long, but there is quite a bit to understand so I won't give a code sample - you need to read and understand the documentation.Checking the signature allows your application to detect changes to its code & resources and report it is "damaged" (it may well be, not all changes are malicious) and refuse to run. Adding such code does not of course guarantee your code is not damaged, but certainly it does raise the barrier higher against intentional damage (and if MacOS X starts doing the check itself then there will be a big win).
iOS 上实现签名验证的方式是，当启动应用程序时，
launchd守护进程使用该设备的特定私钥解密二进制文件（这就是为什么您不能直接反编译应用程序或复制 -将它们从一台设备粘贴到另一台设备），如果解密失败，应用程序将无法启动。由于 iOS 沙箱，执行此操作的本机工具在应用程序中不可用。
如果您只是尝试跟踪是否有人修改了您的二进制文件，您可以对其执行 MD5 或 SHA1 哈希，将其存储在
NSUserDefaults中，并在每次应用启动时进行比较。如果哈希值在执行之间发生变化，您就知道它已被修改（可能是通过合法的应用程序更新或可能是恶意的。）这是 关于如何获取
NSData哈希值的示例。您要查找的二进制文件是：
AppName.app/AppNameThe way signiture verification is implemented on iOS is that when an application is being launched, the
launchddaemon decrypts the binary using that device's specific private key (this is why you can't just decompile apps or copy-paste them from one device to another), if the decryption fails, the application fails to launch.The native tools that do this are not available within applications due to the iOS sandboxing.
If you're simply attempting to track if someone has modified your binary, you can perform an MD5 or SHA1 hash of it, store it in
NSUserDefaultsand compare it at each app start. If the hash changes between executions you know it has been modified (possibly by a legitimate application update or possibly nefariously.)Here's an example on how to get the hash of an
NSData.The binary file you're looking for is:
AppName.app/AppName