Signatures in macOS: Identity, Integrity, and the Mach-O Format

Unlike Linux or older versions of Windows, macOS doesn't just check permissions (can I read/write this?); it checks Identity and Integrity at the kernel level before a single instruction is executed. The Three Pillars of a Signature A macOS code signature isn't just a digital "stamp." It is a multi-layered security contract embedded directly into the Mach-O (the Mac executable format) binary. 1. The Seal (Integrity) When a developer signs a binary, the codesign utility creates a cryptographic hash (a unique fingerprint) for every "page" of the executable code. The Check: As the program loads into memory, the macOS kernel constantly re-calculates these hashes. The "Kill": If even one bit of the binary is modified (by a hex editor, a virus, or a corrupted download), the hashes no longer match the signature. The kernel doesn't show a popup; it simply terminates the process with a SIGKILL . 2. The Identity (Trust) The signature identifies who created the code. There are three tiers of trus