Checking a downloaded Mac app before you open it

An app from outside the App Store is a ZIP or a disk image from a website, and the first you usually learn about who made it is the warning macOS shows when it’s opened. These tools let you look first: whether the file is the one its maker published, what came with it, and who signed the program inside. Everything is read in your browser; nothing is uploaded.

1. Check it’s the file that was published

Many developers list a SHA-256 checksum beside the download, on the download page or in the release notes. Drop the downloaded file on Hash / Checksum and paste the published value into Expected hash: it says whether they match. A mismatch means the file isn’t the one they published: it may be damaged, an older version, or a copy from somewhere else. Download it again from the developer’s own site before going further.

A matching checksum from the same page as the download only shows that the two agree. It’s worth more when the checksum comes from somewhere else, such as the project’s release notes on GitHub.

2. See what’s in the ZIP

Open a .zip in the ZIP Viewer & Maker to see what it holds before anything is unpacked. You’d expect one .app folder, perhaps with a licence or a read-me. An installer package (.pkg), a script, or an app nested inside an oddly named folder deserves a closer look: a package can run commands as an administrator while it installs.

A disk image (.dmg) can’t be read in a browser. Opening it in the Finder mounts it without running anything, so you can check the app inside as in the next step.

3. Who signed it

Drop the ZIP on the Mach-O Inspector, which finds the app and its program inside. For an app in a disk image or already in Applications, Control-click it, choose Show Package Contents, and pick the file in Contents › MacOS. Or compress the app first (Control-click it, then Compress) and drop the ZIP.

• Signed by should read Developer ID Application: followed by the company or person you expect, with the Team ID in brackets. The team ID stays the same across all of a developer’s apps, so it’s worth comparing with an earlier version or another of their apps.
• Signed ad hoc or isn’t signed means there’s no developer’s certificate at all. macOS will block it, and there’s no name to hold to account.
• Apple Development with a note that it allows debuggers is a build the developer made for testing, not one made for release.

The page checks that the signer’s key signed the app’s code directory. That shows the signature belongs to that certificate, not that the developer is trustworthy, and it doesn’t say whether Apple has since revoked the certificate.

4. Will it run natively on Apple silicon?

Architectures lists the processors the program was built for. arm64 (or arm64e) runs natively on Apple silicon, and x86_64 is for Intel Macs. A program with only x86_64 runs on an Apple silicon Mac through Rosetta, slower and using more battery, and the page notes it. Minimum OS is the oldest macOS version it says it needs.

5. What it’s allowed to do

Entitlements are the permissions written into the signature. com.apple.security.app-sandbox means the app runs in a sandbox, cut off from most of your files. Others ask to use the camera, the microphone or the network, or to control other apps (automation.apple-events), and macOS still asks you before most of those are used.

The ones the page points out loosen the hardened runtime, the protections that stop other code being slipped into an app: loading libraries signed by someone else (disable-library-validation), running code that isn’t signed, or being changed by environment variables. Plenty of legitimate apps need one of these, such as apps that load plug-ins, but together with a missing or ad hoc signature they’re a reason to stop.

6. Before you open it

What a browser can’t check is whether Apple has notarised the app (scanned it and found nothing known to be bad) or revoked its certificate since. In Terminal, these ask macOS directly:

codesign --verify --deep --strict --verbose=2 /path/to/App.app
spctl --assess --verbose /path/to/App.app

The first checks every file in the app against its signature. The second gives Gatekeeper’s verdict, with source=Notarized Developer ID for a notarised app. Drag the app from the Finder into Terminal to type its path.