I'm somewhat confused about application code signing. My goal is not getting keychain access or any privileged API but to make our application more hacker and tamper resistance.
I already have a Verisign issued certificate that I can use to successfully sign our application bundle. I am also setting the kill flag like this :
codesign -s 'Our Name' -o kill OurApp.app
If I touch anything inside the application executable (or modify the Info.plist) codesign correctly reports it has been modified.
However, the application will still launch. From reading the man page of codesign, I would expect it not to run? I also tried modifying the application while it was still running, and the application didn't immediately exit.
Am I completely wrong about what 'kill' should do to an application?
If 'kill' doesn't automatically stop the application running, could someone point me to some code that would allow me to check the validity of the application inside our own code? From watching the WWDC session on signing, there was a demo application that could query its own validity (I didn't see the code for this available).
Does anyone have any experience with how codesigning improves hack resistance? Is it easy to strip the signing from the application and therefore disable any protection given by it? Does having a trusted certificate make any difference from using a self-signed untrusted cert?
Thanks in advance!
David
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Apple-cdsa mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/apple-cdsa/email@hidden
This email sent to email@hidden
