45 lines
1.5 KiB
Bash
Executable File
45 lines
1.5 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
APP="${1:-}"
|
|
[[ -n "$APP" ]] || { echo "Usage: $0 /path/to/Rsync Studio.app" >&2; exit 2; }
|
|
[[ -d "$APP" ]] || { echo "ERROR: App not found: $APP" >&2; exit 2; }
|
|
|
|
for tool in codesign spctl; do
|
|
command -v "$tool" >/dev/null || { echo "ERROR: Missing required tool: $tool" >&2; exit 2; }
|
|
done
|
|
|
|
echo "== Verifying code signature =="
|
|
codesign --verify --deep --strict --verbose=2 "$APP"
|
|
|
|
echo "== Inspecting signing authority =="
|
|
SIGNING_INFO="$(codesign -dvvv "$APP" 2>&1)"
|
|
printf '%s\n' "$SIGNING_INFO"
|
|
grep -q 'Authority=Developer ID Application:' <<<"$SIGNING_INFO" || {
|
|
echo "ERROR: App is not signed with Developer ID Application." >&2
|
|
exit 1
|
|
}
|
|
|
|
echo "== Checking Hardened Runtime =="
|
|
grep -Eq '^CodeDirectory .* flags=.*runtime' <<<"$SIGNING_INFO" || {
|
|
echo "ERROR: Hardened Runtime flag was not found in the signed app." >&2
|
|
exit 1
|
|
}
|
|
|
|
echo "== Checking release entitlements =="
|
|
ENTITLEMENTS="$(codesign -d --entitlements :- "$APP" 2>/dev/null || true)"
|
|
if grep -q 'com.apple.security.get-task-allow' <<<"$ENTITLEMENTS"; then
|
|
echo "ERROR: Release app contains com.apple.security.get-task-allow." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if grep -q '<true/>' <<<"$(printf '%s\n' "$ENTITLEMENTS" | sed -n '/com.apple.security.app-sandbox/,+1p')"; then
|
|
echo "ERROR: App Sandbox is unexpectedly enabled in the direct-distribution build." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "== Gatekeeper assessment =="
|
|
spctl --assess --type execute --verbose=4 "$APP"
|
|
|
|
echo "Signed Developer ID app verification passed: $APP"
|