Verify App Integrity with codesign --verify

Check that an application bundle's signature is intact and its code hasn't been modified since signing.

macOSverifyintegritycodesignLow risk

Run `codesign --verify --deep --strict /Applications/SomeApp.app` — silence plus 'valid on disk' in verbose mode means the app is intact.

01Command

Command

$ codesign --verify --deep --strict /Applications/SomeApp.app

02What it does

--verify validates the signature against the code actually on disk; --deep recursively checks nested bundles, frameworks, and helpers; --strict applies the strictest validation rules. Adding -vvvv prints 'valid on disk' and 'satisfies its Designated Requirement' on success, while tampering produces 'resource envelope is obsolete' or hash mismatch errors. A common companion is spctl --assess for the Gatekeeper policy verdict.

03Risk

RiskLow risk

RequirementsBuilt-in on macOS (Xcode Command Line Tools).

!Warning: --deep is a diagnostic aid, not a substitute for the developer's own signing workflow, but it's ideal for post-download checks.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

codesign — verify code signatures (macOS)
SS64 · technical · 2026-09-17
Evidence: Documents --verify, --deep to check nested code, --strict for full validation, and -v for verbose output.

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

Verify an App's Code Signature with codesign

macOSGatekeepersignaturecodesign

Check whether an application bundle was signed properly and hasn't been modified since.

Low risk ✓ 2026-09-17

Verify a .pkg Installer's Signature with pkgutil

macOSpkgutilcodesigninstaller

Inspect the certificate chain of a macOS package file before you install anything from it.

Low risk ✓ 2026-09-17