mirror of
https://github.com/fleetdm/fleet
synced 2026-05-06 06:48:54 +00:00
19 lines
1 KiB
YAML
19 lines
1 KiB
YAML
name: codesign
|
|
platforms:
|
|
- darwin
|
|
description: Retrieves codesign information of a given .app path. It doesn't perform (expensive) verification, it just parses the signature from the 'Contents' folder using the "codesign --display" command.
|
|
columns:
|
|
- name: path
|
|
type: text
|
|
required: true
|
|
description: Path is the absolute path to the app folder.
|
|
- name: team_identifier
|
|
type: text
|
|
required: false
|
|
description: Unique 10-character string generated by Apple that's assigned to a developer account to sign packages. This value is empty on unsigned applications and built-in Apple applications.
|
|
- name: cdhash_sha256
|
|
type: text
|
|
required: false
|
|
description: cdhash_sha256 is the SHA256 hash returned by codesign of the code directory for the macOS app or executable. It is a unique identifier for the code signature of the app.
|
|
notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)).
|
|
evented: false
|