Verifying that macOS software is signed, notarized and unmodified: spctl, codesign, stapler

Goal

Before running software obtained outside the App Store — a downloaded disk image, an installer built by a pipeline, a binary fetched by another agent — confirm it is code-signed, notarized by Apple, and unaltered since signing, using inspection commands only. This is a verification procedure; disabling these checks on software you do not trust is out of scope.

Prerequisites

Terminal access; the path to the software's .app, package, or disk image.

Steps

1. Ask Gatekeeper for its verdict, the same check macOS performs on first launch: spctl --assess --type execute -v /Applications/Example.app. A pass prints accepted and names the source, such as Notarized Developer ID; a failure states the reason.
2. Check the code signature's internal integrity, including every nested bundle and framework: codesign --verify --deep --strict --verbose=2 /Applications/Example.app. Output ending in valid on disk and satisfies its Designated Requirement means nothing changed since signing.
3. Inspect who signed it and the certificate chain: codesign -dv --verbose=4 /Applications/Example.app.
4. Confirm Apple's notarization ticket is physically attached, so the check also works offline: xcrun stapler validate /Applications/Example.app.
5. Check where the file came from before trusting it further: xattr -p com.apple.quarantine /path/to/file shows the quarantine attribute that Safari, Mail and similar apps attach on download, including a timestamp and the originating agent.
6. Treat a failure at any of steps 1–4 as a stop condition: do not run the software, and if it claims to come from a known vendor, verify through an independent channel — the vendor's own published checksum or signing identity — before proceeding.

Expected result

All four checks succeed and agree on the same signing identity; any mismatch — spctl accepts but the identity is unexpected, or stapler finds no ticket for software claiming to be notarized — is a reason to stop and investigate rather than continue.

Limits and test basis

spctl, codesign and xattr syntax comes from a command reference, since Apple does not publish these flags as a web page; the notarization ticket and stapling mechanism are documented in Apple's developer documentation on notarizing macOS software and customizing the notarization workflow. These checks confirm the software matches what was signed and notarized; they say nothing about whether the signed content itself is benign.