check-codesign

Name: check-codesign
Author: iPlug3

84stars3forks

How to install check-codesign?

iplug3/audio-plugin-dev-skills/check-codesign

$npx -y skills add iPlug3/audio-plugin-dev-skills --skill check-codesign

Installs into the current project.

Summary

Check macOS code signature, hardened runtime, entitlements, and notarization of audio plugin bundles (.vst3, .component, .clap, .app/.appex). Use when user says "check code signing", "check codesign", "check signature", "verify signing", "check notarization", "why won't plugin lo

Files · 1

View on GitHub

SKILL.md

1	# macOS Code Signature Check
2
3	## Why This Matters
4
5	macOS DAWs built with hardened runtime (Logic Pro, GarageBand, recent versions of Ableton Live, etc.) will refuse to load unsigned or incorrectly signed plugins. Gatekeeper and library validation enforcement mean that even a plugin passing all functional tests can silently fail to load if its code signature is missing, invalid, or lacks required entitlements.
6
7	## Plugin Bundle Locations
8
9	\| Format \| Extension \| Typical Paths \|
10	\|--------\|-----------\|---------------\|
11	\| AudioUnit v2 \| `.component` \| `~/Library/Audio/Plug-Ins/Components/`, `/Library/Audio/Plug-Ins/Components/` \|
12	\| AudioUnit v3 \| `.appex` (inside `.app`) \| Built into host app bundle \|
13	\| VST3 \| `.vst3` \| `~/Library/Audio/Plug-Ins/VST3/`, `/Library/Audio/Plug-Ins/VST3/` \|
14	\| CLAP \| `.clap` \| `~/Library/Audio/Plug-Ins/CLAP/`, `/Library/Audio/Plug-Ins/CLAP/` \|
15
16	## Instructions
17
18	1. Locate the plugin bundle on disk
19	2. Run `codesign -vvv --deep --strict /path/to/plugin.bundle` to verify the signature
20	3. Run `codesign -d --verbose=4 /path/to/plugin.bundle` to display signing details
21	4. Check for hardened runtime flag in the output (flags should include `runtime`)
22	5. Run `codesign -d --entitlements - /path/to/plugin.bundle` to inspect entitlements
23	6. If the plugin is distributed outside the App Store, check notarization with `spctl --assess`
24	7. See Common Issues below if verification fails
25
26	## Basic Usage
27
28	```bash
29	# Verify the code signature is valid (deep checks nested code)
30	codesign -vvv --deep --strict /path/to/plugin.vst3
31
32	# Display full signing information
33	codesign -d --verbose=4 /path/to/plugin.vst3
34
35	# Display entitlements
36	codesign -d --entitlements - /path/to/plugin.vst3
37
38	# Display just the signing identity (Team ID and certificate name)
39	codesign -d --verbose=1 /path/to/plugin.vst3
40	```
41
42	## Checking Hardened Runtime
43
44	Hardened runtime is required for notarization and for loading into DAWs that enforce library validation.
45
46	```bash
47	# Check flags — look for "runtime" in the flags line
48	codesign -d --verbose=4 /path/to/plugin.vst3
49	```
50
51	In the output, look for the `flags` line:
52
53	- `flags=0x10000(runtime)` — hardened runtime is enabled
54	- `flags=0x0(none)` — hardened runtime is not enabled (will fail in hardened DAWs)
55
56	## Entitlements for Audio Plugins
57
58	Audio plugins that use JIT compilation, dynamically generated code, or load other unsigned libraries typically need specific entitlements.
59
60	\| Entitlement \| Purpose \|
61	\|------------\|---------\|
62	\| `com.apple.security.cs.disable-library-validation` \| Load unsigned or differently-signed libraries/plugins \|
63	\| `com.apple.security.cs.allow-unsigned-executable-memory` \| JIT / writable-executable memory (some DSP code, scripting engines) \|
64	\| `com.apple.security.cs.allow-jit` \| MAP_JIT support for JIT compilers \|
65	\| `com.apple.security.cs.allow-dyld-environment-variables` \| Allow DYLD_* environment variables \|
66
67	```bash
68	# View entitlements as XML plist
69	codesign -d --entitlements - --xml /path/to/plugin.vst3
70
71	# View entitlements in human-readable form
72	codesign -d --entitlements - /path/to/plugin.vst3
73	```
74
75	Note: The DAW (host) must also have `com.apple.security.cs.disable-library-validation` for it to load third-party plugins that are signed with a different Team ID.
76
77	## Checking Notarization
78
79	Notarized plugins have been scanned by Apple and stapled with a ticket, allowing them to pass Gatekeeper on first launch without an internet check.
80
81	```bash
82	# Check if a notarization ticket is stapled to the bundle
83	stapler validate /path/to/plugin.vst3
84
85	# Force an online notarization check (even without a stapled ticket)
86	codesign -v --check-notarization /path/to/plugin.vst3
87
88	# Check Gatekeeper assessment (requires the bundle to be in a standard location or downloaded)
89	spctl --assess --verbose=4 --type exec /path/to/plugin.vst3
90	```
91
92	For installer packages (`.pkg`):
93
94	```bash
95	spctl --assess --verbose=4 --type install /path/to/installer.pkg
96	```
97
98	## Checking a DAW Host
99
100	If a plugin won't load, it can help to check the host DAW's own signing and entitlements to understand its library validation policy.
101
102	```bash
103	# Check if a DAW has library validation disabled (allows loading third-party plugins)
104	codesign -d --entitlements - /Applications/SomeDAW.app
105
106	# Look for com.apple.security.cs.disable-library-validation = true
107	```
108
109	## Note on `--deep`
110
111	The `--deep` flag is deprecated for signing as of macOS 13. When signing, sign each nested component i

People who liked this also viewed

6 picks

Type

check-codesign

84stars3forks

View on GitHub

How to install check-codesign?

iplug3/audio-plugin-dev-skills/check-codesign

$npx -y skills add iPlug3/audio-plugin-dev-skills --skill check-codesign

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# macOS Code Signature Check
2
3	## Why This Matters
4
5	macOS DAWs built with hardened runtime (Logic Pro, GarageBand, recent versions of Ableton Live, etc.) will refuse to load unsigned or incorrectly signed plugins. Gatekeeper and library validation enforcement mean that even a plugin passing all functional tests can silently fail to load if its code signature is missing, invalid, or lacks required entitlements.
6
7	## Plugin Bundle Locations
8
9	\| Format \| Extension \| Typical Paths \|
10	\|--------\|-----------\|---------------\|
11	\| AudioUnit v2 \| `.component` \| `~/Library/Audio/Plug-Ins/Components/`, `/Library/Audio/Plug-Ins/Components/` \|
12	\| AudioUnit v3 \| `.appex` (inside `.app`) \| Built into host app bundle \|
13	\| VST3 \| `.vst3` \| `~/Library/Audio/Plug-Ins/VST3/`, `/Library/Audio/Plug-Ins/VST3/` \|
14	\| CLAP \| `.clap` \| `~/Library/Audio/Plug-Ins/CLAP/`, `/Library/Audio/Plug-Ins/CLAP/` \|
15
16	## Instructions
17
18	1. Locate the plugin bundle on disk
19	2. Run `codesign -vvv --deep --strict /path/to/plugin.bundle` to verify the signature
20	3. Run `codesign -d --verbose=4 /path/to/plugin.bundle` to display signing details
21	4. Check for hardened runtime flag in the output (flags should include `runtime`)
22	5. Run `codesign -d --entitlements - /path/to/plugin.bundle` to inspect entitlements
23	6. If the plugin is distributed outside the App Store, check notarization with `spctl --assess`
24	7. See Common Issues below if verification fails
25
26	## Basic Usage
27
28	```bash
29	# Verify the code signature is valid (deep checks nested code)
30	codesign -vvv --deep --strict /path/to/plugin.vst3
31
32	# Display full signing information
33	codesign -d --verbose=4 /path/to/plugin.vst3
34
35	# Display entitlements
36	codesign -d --entitlements - /path/to/plugin.vst3
37
38	# Display just the signing identity (Team ID and certificate name)
39	codesign -d --verbose=1 /path/to/plugin.vst3
40	```
41
42	## Checking Hardened Runtime
43
44	Hardened runtime is required for notarization and for loading into DAWs that enforce library validation.
45
46	```bash
47	# Check flags — look for "runtime" in the flags line
48	codesign -d --verbose=4 /path/to/plugin.vst3
49	```
50
51	In the output, look for the `flags` line:
52
53	- `flags=0x10000(runtime)` — hardened runtime is enabled
54	- `flags=0x0(none)` — hardened runtime is not enabled (will fail in hardened DAWs)
55
56	## Entitlements for Audio Plugins
57
58	Audio plugins that use JIT compilation, dynamically generated code, or load other unsigned libraries typically need specific entitlements.
59
60	\| Entitlement \| Purpose \|
61	\|------------\|---------\|
62	\| `com.apple.security.cs.disable-library-validation` \| Load unsigned or differently-signed libraries/plugins \|
63	\| `com.apple.security.cs.allow-unsigned-executable-memory` \| JIT / writable-executable memory (some DSP code, scripting engines) \|
64	\| `com.apple.security.cs.allow-jit` \| MAP_JIT support for JIT compilers \|
65	\| `com.apple.security.cs.allow-dyld-environment-variables` \| Allow DYLD_* environment variables \|
66
67	```bash
68	# View entitlements as XML plist
69	codesign -d --entitlements - --xml /path/to/plugin.vst3
70
71	# View entitlements in human-readable form
72	codesign -d --entitlements - /path/to/plugin.vst3
73	```
74
75	Note: The DAW (host) must also have `com.apple.security.cs.disable-library-validation` for it to load third-party plugins that are signed with a different Team ID.
76
77	## Checking Notarization
78
79	Notarized plugins have been scanned by Apple and stapled with a ticket, allowing them to pass Gatekeeper on first launch without an internet check.
80
81	```bash
82	# Check if a notarization ticket is stapled to the bundle
83	stapler validate /path/to/plugin.vst3
84
85	# Force an online notarization check (even without a stapled ticket)
86	codesign -v --check-notarization /path/to/plugin.vst3
87
88	# Check Gatekeeper assessment (requires the bundle to be in a standard location or downloaded)
89	spctl --assess --verbose=4 --type exec /path/to/plugin.vst3
90	```
91
92	For installer packages (`.pkg`):
93
94	```bash
95	spctl --assess --verbose=4 --type install /path/to/installer.pkg
96	```
97
98	## Checking a DAW Host
99
100	If a plugin won't load, it can help to check the host DAW's own signing and entitlements to understand its library validation policy.
101
102	```bash
103	# Check if a DAW has library validation disabled (allows loading third-party plugins)
104	codesign -d --entitlements - /Applications/SomeDAW.app
105
106	# Look for com.apple.security.cs.disable-library-validation = true
107	```
108
109	## Note on `--deep`
110
111	The `--deep` flag is deprecated for signing as of macOS 13. When signing, sign each nested component i

People who liked this also viewed

6 picks

Type