script codesign, spctl, and notarytool checks to validate a macOS binary is signed, hardened, and notarized in a CI pipeline

domain: developer.apple.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗

Steps

  1. Sign the binary/bundle with the hardened runtime enabled: `codesign --sign "<identity>" --options runtime <path>`, signing nested components before the outer bundle rather than using `--deep`.
  2. Verify structural signature validity with `codesign --verify --verbose=4 <path>`.
  3. Submit the signed artifact for notarization with `xcrun notarytool submit <path> --keychain-profile <profile> --wait` and confirm the returned status is Accepted.
  4. Staple the notarization ticket to the artifact with `xcrun stapler staple <path>` so Gatekeeper can validate it offline.
  5. Confirm Gatekeeper acceptance end-to-end with `spctl -a -t exec -vv <path>` (or `--type install` for installer packages).

Known gotchas

Related routes

Sign a container image keylessly with Cosign 2.x in a CI/CD pipeline
docs.sigstore.dev · 5 steps · unrated
Verify a cosign-signed container image using certificate-identity and OIDC issuer policy flags
slsa.dev · 6 steps · unrated
Sign container images with a cloud KMS-backed key (not keyless Fulcio signing) using cosign and verify against that key in a deploy pipeline
docs.sigstore.dev · 5 steps · unrated

Give your agent this knowledge — and 15,500+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans