Code snippit from NSConference presentation

Here’s the code I used to display the code signature status within the sample app at NSConference. You need to be using the 10.6 SDK, and link against Security.framework.

#import <Security/SecCode.h>

- (void)updateSignatureStatus {
    SecCodeRef myCode = NULL;
    OSStatus secReturn = SecCodeCopySelf(kSecCSDefaultFlags, &myCode);
    if (noErr != secReturn) {
        [statusField setIntValue: secReturn];
        return;
    }
    CFMakeCollectable(myCode);
    SecRequirementRef designated = NULL;
    secReturn = SecCodeCopyDesignatedRequirement(myCode,
                                                 kSecCSDefaultFlags,
                                                 &designated);
    if (noErr != secReturn) {
        [statusField setIntValue: secReturn];
        return;
    }
    CFMakeCollectable(designated);
    secReturn = SecCodeCheckValidity(myCode,
                                     kSecCSDefaultFlags,
                                     designated);
    [statusField setIntValue: secReturn];
}

That’s all there is to it. As discussed in my talk, the designated requirement is a requirement baked into the signature seal when the app is signed in Xcode. Application identity is verified by testing whether:

• the signature is valid;
• the seal is unbroken;
• the code satisfies its designated requirement.

Of course there’s nothing to stop you testing code against any requirement you may come up with: the designated requirement just provides “I am the same application that my developer signed”.