bug? in codesign --remove-signature feature

macos digital-signature
user532477 picture user532477 · Sep 21, 2011 · Viewed 15k times · Source

I would like to remove the digital signature from a Mac app that has been signed with codesign. There is an undocumented option to codesign, --remove-signature, which by it's name seems to be what I need. However, I can't get it to work. I realize it is undocumented, but I could really use the functionality. Maybe I'm doing something wrong?

 codesign -s MyIdentity foo.app

works normally, signing the app

 codesign --remove-signature foo.app

does disk activity for several seconds, then says

 foo.app: invalid format for signature

and foo.app has grown to 1.9 GB!!! (Specifically, it is the executable in foo.app/Contents/Resources/MacOS that grows, from 1.1 MB to 1.9 GB.)

The same thing happens when I try to sign/unsign a binary support tool instead of a .app.

Any ideas?

Background: This is my own app; I'm not trying to defeat copy protection or anything like that.

I would like to distribute a signed app so that each update to the app won't need user approval to read/write the app's entries in the Keychain. However, some people need to modify the app by adding their own folder to /Resources. If they do that, the signature becomes invalid, and the app can't use it's own Keychain entries.

The app can easily detect if this situation has happened. If the app could then remove it's signature, everything would be fine. Those people who make this modification would need to give the modified, now-unsigned app permission to use the Keychain, but that's fine with me.

Answer

user246672 picture user246672 · Oct 12, 2014

A bit late, but I've updated a public-domain tool called unsign which modifies executables to clear out signatures.

https://github.com/steakknife/unsign

Related questions

Kext with invalid signature can load on one machine, but not the other. Why?

I have an iMac and a Macbook Pro. I updated both to Yosemite beta (the public one). But my audio interface Focusrite Saffire 24 DSP (Firewire) works properly in the iMac, but not on the Macbook Pro. When installing the Saffire, …

Read More
Verifying digital signatures on Mac Adobe Reader

I'm attempting to sign PDFs with an SSL certificate issued from Go Daddy. These signatures show up as valid in the Windows Reader as long as you check the "Validating Signatures" check box under Edit->Preferences...->Security-&…

Read More
How do I install pip on macOS or OS X?

I spent most of the day yesterday searching for a clear answer for installing pip (package manager for Python). I can't find a good solution. How do I install it?

Read More