Code Signing
Cryptographically attesting who produced a binary, and the operating-system checks built on it.
Code signing attaches a cryptographic signature to an executable, attesting to its origin and proving it has not been modified since. Operating systems use signatures to decide whether to run something and what capabilities to grant it.
On macOS the layered system is worth understanding as a practical matter. An application can be unsigned, ad-hoc signed (a signature with no identity behind it), signed with a paid developer identity, or additionally notarized — submitted to Apple for automated scanning and stapled with a ticket. Files downloaded through a browser carry a quarantine attribute, and the system's Gatekeeper check refuses to launch quarantined applications that are not notarized.
The consequence for anyone sharing a small tool informally is concrete: an ad-hoc signed application, sent to another machine, presents a dialog claiming the app is damaged. It is not — it is unnotarized and quarantined. The reliable fix is removing the quarantine attribute; the folklore workaround of opening from the context menu no longer applies to ad-hoc signed applications on recent versions.
Testing this requires a machine other than the one that built it, since a local build has no quarantine attribute and a development-path fallback can mask the failure entirely. See Ground Truth.
See also4
Supply Chain Security
Protecting against compromise arriving through the code and tooling a project depends on.
Version Control & Delivery13 connections
Letterlocking
Folding, slitting and sealing a letter so the sheet becomes its own tamper-evident envelope.
Meaning & Society8 connections
Daemon
A long-running background process managed by the operating system's service supervisor.
Systems & Tooling13 connections
Least Privilege
Granting only the permissions actually required, so a compromise has a small ceiling.
Systems & Tooling17 connections
Related5
Nearby in the graph rather than deliberately chosen. Looser, sometimes surprising.
Linked from12
- Caller ID AuthenticationNetworks & Distribution
Cryptographic attestation of an originating telephone number, and why spoofed calls survive it.
- Confidence TrickMeaning & Society
Fraud that obtains trust first, so the victim hands over the money themselves.
- DaemonSystems & Tooling
A long-running background process managed by the operating system's service supervisor.
- EmulationPlay & Games
Software reimplementation of console hardware, and the fault line between preserving a game and possessing it legally.
- eSIMNetworks & Distribution
A SIM soldered into the device and provisioned over the air, with profiles downloaded rather than cards swapped.
- Game PreservationPlay & Games
The effort to keep games playable against delisting, license expiry, server shutdown and hardware rot.
- Least PrivilegeSystems & Tooling
Granting only the permissions actually required, so a compromise has a small ceiling.
- LetterlockingMeaning & Society
Folding, slitting and sealing a letter so the sheet becomes its own tamper-evident envelope.
- ProvenanceMethod
The recorded origin of a change or a claim — who made it, when, and on what evidence.
- Right to RepairMeaning & Society
the movement for consumer and independent-shop access to the parts, tools, and information needed to fix a device.
- Supply Chain SecurityVersion Control & Delivery
Protecting against compromise arriving through the code and tooling a project depends on.
- Virtual Private NetworkNetworks & Distribution
An encrypted tunnel that presents a remote network as local, and the narrow set of things a commercial one actually hides.