Before you open an app from the internet, or install an update to one, a few checks show who made it, whether it has been changed since they signed it, and whether Apple’s notarization service scanned it. macOS runs some of these for you through Gatekeeper; you can run them yourself in a minute.
What you’re checking
- Code signature. The developer signs the app with a certificate from Apple. The signature identifies them by a Team ID and breaks if any file inside the app changes.
- Notarization. The developer uploaded the app to Apple, and Apple’s automated scan found no known malicious content at that time. Gatekeeper requires it for Developer ID apps by default. (Apple’s documentation)
- Gatekeeper’s verdict. Whether macOS will open the app without a warning, and why.
The quick way: System Information
Hold Option, open the Apple menu, choose System Information, then Software → Applications, and select an app. You’ll see:
- Obtained from: App Store, Apple, Identified Developer (signed with a Developer ID) or Unknown (not signed with one).
- Signed by: the developer’s certificate, for example Developer ID Application: Zed Industries, Inc. (MQ55VZLNZQ). The code in brackets is the Team ID.
- Kind: Apple Silicon, Intel or Universal, which tells you whether it runs natively on your Mac.
In Terminal: who signed it
codesign -dv --verbose=2 /Applications/App.appLook for the Authority= lines (the certificate chain, ending in Apple Root CA) and TeamIdentifier=. The Team ID is the most useful line: an update to an app should carry the same Team ID as the copy you have. A different one means a different developer signed it.
Is the signature intact?
codesign --verify --deep --strict --verbose=2 /Applications/App.appvalid on disk and satisfies its Designated Requirement mean nothing has changed since signing. Errors such as a sealed resource is missing or invalid mean files were added, removed or modified; macOS shows these apps as “damaged” (what to do).
Would Gatekeeper open it?
spctl -a -vv /Applications/App.app| Result | What it means |
|---|---|
| accepted source=Mac App Store | Installed from the App Store and signed by Apple for distribution. |
| accepted source=Notarized Developer ID | Signed by an identified developer and notarized by Apple. The normal result for a good app from the web. |
| rejected source=Unnotarized Developer ID | Signed, but not notarized. macOS warns before the first launch. |
| rejected (no usable signature) | Not signed with a Developer ID. Only open it if you trust where it came from. |
A note on stapled tickets
xcrun stapler validate /Applications/App.app checks whether a notarization ticket is attached to the app itself. Many notarized apps don’t have one, especially after updating themselves, and that’s fine: Gatekeeper looks the ticket up online. Treat the spctl result as the answer, not the stapler one.
Will it run on your Mac?
lipo -archs /Applications/App.app/Contents/MacOS/App
defaults read /Applications/App.app/Contents/Info.plist LSMinimumSystemVersionThe first shows arm64 for Apple silicon, x86_64 for Intel, or both. The executable inside Contents/MacOS usually has the app’s name. The second shows the oldest macOS the app supports.
What these checks can’t tell you
A valid signature proves who signed an app and that it hasn’t changed since; notarization means Apple’s automated scan found nothing known at that time. Neither proves an app is bug-free or that a developer’s account was never misused. Download from the developer’s own site, keep apps updated, and be wary of anything that asks you to turn Gatekeeper off.
Running these checks on every update
Checking one app by hand is quick; checking every update to every app isn’t. Current, which we make, runs these checks on each app update before installing it: same Team ID as the installed app, notarized by Apple (plus the developer’s published signature or checksum when there is one), built for your macOS and processor, and actually newer. Each app’s details show a receipt of which checks ran. More background: How to update Mac apps more safely.