name: codesign
platforms:
  - darwin
description: Retrieves codesign information of a given .app path. It doesn't perform (expensive) verification, it just parses the signature from the 'Contents' folder using the "codesign --display" command.
columns:
  - name: path
    type: text
    required: true
    description: Path is the absolute path to the app folder.
  - name: team_identifier
    type: text
    required: false
    description: Unique 10-character string generated by Apple that's assigned to a developer account to sign packages. This value is empty on unsigned applications and built-in Apple applications.
  - name: cdhash_sha256
    type: text
    required: false
    description: cdhash_sha256 is the SHA256 hash returned by codesign of the code directory for the macOS app or executable. It is a unique identifier for the code signature of the app.
notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)).
evented: false