{"id":3237,"date":"2023-06-09T14:32:17","date_gmt":"2023-06-09T18:32:17","guid":{"rendered":"https:\/\/michaelrowe01.com\/?p=3237"},"modified":"2023-06-09T14:32:20","modified_gmt":"2023-06-09T18:32:20","slug":"verify-app-dependencies-with-digital-signatures","status":"publish","type":"post","link":"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/","title":{"rendered":"Verify app dependencies with digital signatures"},"content":{"rendered":"\n<figure class=\"wp-block-image size-large\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"660\" height=\"371\" data-attachment-id=\"3240\" data-permalink=\"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/attachment\/%ef%a3%bfwwdc23-30\/\" data-orig-file=\"https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/%EF%A3%BFWWDC23-30.png?fit=1920%2C1080&amp;ssl=1\" data-orig-size=\"1920,1080\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"\uf8ffWWDC23-30\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/%EF%A3%BFWWDC23-30.png?fit=660%2C371&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/%EF%A3%BFWWDC23-30.png?resize=660%2C371&#038;ssl=1\" alt=\"\" class=\"wp-image-3240\" srcset=\"https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/%EF%A3%BFWWDC23-30.png?resize=1024%2C576&amp;ssl=1 1024w, https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/%EF%A3%BFWWDC23-30.png?resize=300%2C169&amp;ssl=1 300w, https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/%EF%A3%BFWWDC23-30.png?resize=768%2C432&amp;ssl=1 768w, https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/%EF%A3%BFWWDC23-30.png?resize=1536%2C864&amp;ssl=1 1536w, https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/%EF%A3%BFWWDC23-30.png?w=1920&amp;ssl=1 1920w, https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/%EF%A3%BFWWDC23-30.png?w=1320&amp;ssl=1 1320w\" sizes=\"auto, (max-width: 660px) 100vw, 660px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Automatically verify integrity of your dependencies, thru signature verification. This is trying to address the supply chain security attacks that have been happening.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Just like the discussion on privacy reporting, it is ultimately each developer\u2019s responsibility to ensure all your signatures are correct and you are not using maliciously modified code.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dependency Signatures<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>This is code signing is done by linking the binary, info.plist and privacy manifest to your developer identity.&nbsp; This is done via a CDHash and your Dev. Identify from your Certificate. This hash allows for validation that the object has not been modified and was signed by your key.<\/li>\n\n\n\n<li>New Signature verification will automatically handle the dependencies in your project\n<ul class=\"wp-block-list\">\n<li>It tracks identities of frameworks in your project. &nbsp;<\/li>\n\n\n\n<li>Note the chain of trust will help across changes in certificates, etc.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"660\" height=\"371\" data-attachment-id=\"3239\" data-permalink=\"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/attachment\/signing-xcframeworks\/\" data-orig-file=\"https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/Signing-XCFrameworks.png?fit=1920%2C1080&amp;ssl=1\" data-orig-size=\"1920,1080\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"Signing-XCFrameworks\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/Signing-XCFrameworks.png?fit=660%2C371&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/Signing-XCFrameworks.png?resize=660%2C371&#038;ssl=1\" alt=\"\" class=\"wp-image-3239\" srcset=\"https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/Signing-XCFrameworks.png?resize=1024%2C576&amp;ssl=1 1024w, https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/Signing-XCFrameworks.png?resize=300%2C169&amp;ssl=1 300w, https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/Signing-XCFrameworks.png?resize=768%2C432&amp;ssl=1 768w, https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/Signing-XCFrameworks.png?resize=1536%2C864&amp;ssl=1 1536w, https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/Signing-XCFrameworks.png?w=1920&amp;ssl=1 1920w, https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/Signing-XCFrameworks.png?w=1320&amp;ssl=1 1320w\" sizes=\"auto, (max-width: 660px) 100vw, 660px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A revoked certificate will trigger an alert to allow you to resolve or remove the framework from your application.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">App developers<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Demo with Backyard Birds app.- for any XCFrameworks you can see the signing information&nbsp;<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"660\" height=\"371\" data-attachment-id=\"3238\" data-permalink=\"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/attachment\/add-an-xcframework\/\" data-orig-file=\"https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/Add-an-XCFramework.png?fit=1920%2C1080&amp;ssl=1\" data-orig-size=\"1920,1080\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"Add-an-XCFramework\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/Add-an-XCFramework.png?fit=660%2C371&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/Add-an-XCFramework.png?resize=660%2C371&#038;ssl=1\" alt=\"\" class=\"wp-image-3238\" srcset=\"https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/Add-an-XCFramework.png?resize=1024%2C576&amp;ssl=1 1024w, https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/Add-an-XCFramework.png?resize=300%2C169&amp;ssl=1 300w, https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/Add-an-XCFramework.png?resize=768%2C432&amp;ssl=1 768w, https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/Add-an-XCFramework.png?resize=1536%2C864&amp;ssl=1 1536w, https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/Add-an-XCFramework.png?w=1920&amp;ssl=1 1920w, https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/Add-an-XCFramework.png?w=1320&amp;ssl=1 1320w\" sizes=\"auto, (max-width: 660px) 100vw, 660px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Notice the Kind and Status. When you build the app all signatures are validated in the app. &nbsp;<\/li>\n\n\n\n<li>You will get an error if they don\u2019t match and get an alert with an option to accept the change or trash the framework.&nbsp; Be careful with any self signed certificate.<\/li>\n\n\n\n<li>You should start using only signed SDKs<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">SDK Authors<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>For SDK Authors, it becomes important to sign your SDKs so that developers can confirm that the code has not been manipulated&nbsp;<\/li>\n\n\n\n<li>You can either use Apple Developer program (ADP) or Self Signed certificates.<\/li>\n\n\n\n<li>For ADP you should use Apple Distribution and Development Certificates\n<ul class=\"wp-block-list\">\n<li>Apple is attestation is provided by Apple for these certificates<\/li>\n\n\n\n<li>Validation is handled automatically<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>You can sing your code with <strong><em>codesign \u2014timestamp -v \u2014sign \u201cYOUR CERTIFICATE Apple Distribution: (XXXX)\u201d App.xcframework<\/em><\/strong>\n<ul class=\"wp-block-list\">\n<li>This is using self signed certificate if you are a ADP member<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>You should start signing right away either with ADP or self-signed<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Automatically verify integrity of your dependencies, thru signature verification. This is trying to address the supply chain security attacks that have been happening. Just like the discussion on privacy reporting, it is ultimately each developer\u2019s responsibility to ensure all your signatures are correct and you are not using maliciously modified code. Dependency Signatures App developers [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_wp_convertkit_post_meta":{"form":"-1","landing_page":"0","tag":"0","restrict_content":"0"},"hide_page_title":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[2,3],"tags":[727,725,728,356,680],"class_list":["post-3237","post","type-post","status-publish","format-standard","hentry","category-blog","category-personal-softwareandit","tag-code-signing","tag-day-5","tag-dependency-management","tag-security","tag-wwdc23"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Michael Rowe\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Random Thoughts | A blog about things that interest me.\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Verify app dependencies with digital signatures | Random Thoughts\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/michaelrowe01.com\/wp-content\/uploads\/2019\/04\/img_0391.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/michaelrowe01.com\/wp-content\/uploads\/2019\/04\/img_0391.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"3088\" \/>\n\t\t<meta property=\"og:image:height\" content=\"2316\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-06-09T18:32:17+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-06-09T18:32:20+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Verify app dependencies with digital signatures | Random Thoughts\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/michaelrowe01.com\/wp-content\/uploads\/2019\/04\/img_0391.jpg\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/blog\\\/verify-app-dependencies-with-digital-signatures\\\/#article\",\"name\":\"Verify app dependencies with digital signatures | Random Thoughts\",\"headline\":\"Verify app dependencies with digital signatures\",\"author\":{\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/author\\\/michaelrowe\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/michaelrowe01.com\\\/wp-content\\\/uploads\\\/2023\\\/06\\\/%EF%A3%BFWWDC23-30.png?fit=1920%2C1080&ssl=1\",\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/blog\\\/verify-app-dependencies-with-digital-signatures\\\/#articleImage\",\"width\":1920,\"height\":1080},\"datePublished\":\"2023-06-09T14:32:17-04:00\",\"dateModified\":\"2023-06-09T14:32:20-04:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/blog\\\/verify-app-dependencies-with-digital-signatures\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/blog\\\/verify-app-dependencies-with-digital-signatures\\\/#webpage\"},\"articleSection\":\"blog, Personal - Software and IT, code signing, Day 5, dependency management, security, wwdc23\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/blog\\\/verify-app-dependencies-with-digital-signatures\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/michaelrowe01.com#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/michaelrowe01.com\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/category\\\/blog\\\/#listItem\",\"name\":\"blog\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/category\\\/blog\\\/#listItem\",\"position\":2,\"name\":\"blog\",\"item\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/category\\\/blog\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/blog\\\/verify-app-dependencies-with-digital-signatures\\\/#listItem\",\"name\":\"Verify app dependencies with digital signatures\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/michaelrowe01.com#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/blog\\\/verify-app-dependencies-with-digital-signatures\\\/#listItem\",\"position\":3,\"name\":\"Verify app dependencies with digital signatures\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/category\\\/blog\\\/#listItem\",\"name\":\"blog\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/#organization\",\"name\":\"Michael Rowe\",\"description\":\"A blog about things that interest me.\",\"url\":\"https:\\\/\\\/michaelrowe01.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/michaelrowe01.com\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/IMG_0120.jpeg?fit=1024%2C1024&ssl=1\",\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/blog\\\/verify-app-dependencies-with-digital-signatures\\\/#organizationLogo\",\"width\":1024,\"height\":1024},\"image\":{\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/blog\\\/verify-app-dependencies-with-digital-signatures\\\/#organizationLogo\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/author\\\/michaelrowe\\\/#author\",\"url\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/author\\\/michaelrowe\\\/\",\"name\":\"Michael Rowe\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/blog\\\/verify-app-dependencies-with-digital-signatures\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/23f6c08c7576fa07e47f582da2eb7619aeb556ceddf53a274fdb9069926e5bc1?s=96&r=g\",\"width\":96,\"height\":96,\"caption\":\"Michael Rowe\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/blog\\\/verify-app-dependencies-with-digital-signatures\\\/#webpage\",\"url\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/blog\\\/verify-app-dependencies-with-digital-signatures\\\/\",\"name\":\"Verify app dependencies with digital signatures | Random Thoughts\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/blog\\\/verify-app-dependencies-with-digital-signatures\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/author\\\/michaelrowe\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/index.php\\\/author\\\/michaelrowe\\\/#author\"},\"datePublished\":\"2023-06-09T14:32:17-04:00\",\"dateModified\":\"2023-06-09T14:32:20-04:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/#website\",\"url\":\"https:\\\/\\\/michaelrowe01.com\\\/\",\"name\":\"Random Thoughts\",\"description\":\"A blog about things that interest me.\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/michaelrowe01.com\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Verify app dependencies with digital signatures | Random Thoughts","description":"","canonical_url":"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/#article","name":"Verify app dependencies with digital signatures | Random Thoughts","headline":"Verify app dependencies with digital signatures","author":{"@id":"https:\/\/michaelrowe01.com\/index.php\/author\/michaelrowe\/#author"},"publisher":{"@id":"https:\/\/michaelrowe01.com\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2023\/06\/%EF%A3%BFWWDC23-30.png?fit=1920%2C1080&ssl=1","@id":"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/#articleImage","width":1920,"height":1080},"datePublished":"2023-06-09T14:32:17-04:00","dateModified":"2023-06-09T14:32:20-04:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/#webpage"},"isPartOf":{"@id":"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/#webpage"},"articleSection":"blog, Personal - Software and IT, code signing, Day 5, dependency management, security, wwdc23"},{"@type":"BreadcrumbList","@id":"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/michaelrowe01.com#listItem","position":1,"name":"Home","item":"https:\/\/michaelrowe01.com","nextItem":{"@type":"ListItem","@id":"https:\/\/michaelrowe01.com\/index.php\/category\/blog\/#listItem","name":"blog"}},{"@type":"ListItem","@id":"https:\/\/michaelrowe01.com\/index.php\/category\/blog\/#listItem","position":2,"name":"blog","item":"https:\/\/michaelrowe01.com\/index.php\/category\/blog\/","nextItem":{"@type":"ListItem","@id":"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/#listItem","name":"Verify app dependencies with digital signatures"},"previousItem":{"@type":"ListItem","@id":"https:\/\/michaelrowe01.com#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/#listItem","position":3,"name":"Verify app dependencies with digital signatures","previousItem":{"@type":"ListItem","@id":"https:\/\/michaelrowe01.com\/index.php\/category\/blog\/#listItem","name":"blog"}}]},{"@type":"Organization","@id":"https:\/\/michaelrowe01.com\/#organization","name":"Michael Rowe","description":"A blog about things that interest me.","url":"https:\/\/michaelrowe01.com\/","logo":{"@type":"ImageObject","url":"https:\/\/i0.wp.com\/michaelrowe01.com\/wp-content\/uploads\/2024\/11\/IMG_0120.jpeg?fit=1024%2C1024&ssl=1","@id":"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/#organizationLogo","width":1024,"height":1024},"image":{"@id":"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/#organizationLogo"}},{"@type":"Person","@id":"https:\/\/michaelrowe01.com\/index.php\/author\/michaelrowe\/#author","url":"https:\/\/michaelrowe01.com\/index.php\/author\/michaelrowe\/","name":"Michael Rowe","image":{"@type":"ImageObject","@id":"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/23f6c08c7576fa07e47f582da2eb7619aeb556ceddf53a274fdb9069926e5bc1?s=96&r=g","width":96,"height":96,"caption":"Michael Rowe"}},{"@type":"WebPage","@id":"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/#webpage","url":"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/","name":"Verify app dependencies with digital signatures | Random Thoughts","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/michaelrowe01.com\/#website"},"breadcrumb":{"@id":"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/#breadcrumblist"},"author":{"@id":"https:\/\/michaelrowe01.com\/index.php\/author\/michaelrowe\/#author"},"creator":{"@id":"https:\/\/michaelrowe01.com\/index.php\/author\/michaelrowe\/#author"},"datePublished":"2023-06-09T14:32:17-04:00","dateModified":"2023-06-09T14:32:20-04:00"},{"@type":"WebSite","@id":"https:\/\/michaelrowe01.com\/#website","url":"https:\/\/michaelrowe01.com\/","name":"Random Thoughts","description":"A blog about things that interest me.","inLanguage":"en-US","publisher":{"@id":"https:\/\/michaelrowe01.com\/#organization"}}]},"og:locale":"en_US","og:site_name":"Random Thoughts | A blog about things that interest me.","og:type":"article","og:title":"Verify app dependencies with digital signatures | Random Thoughts","og:url":"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/","og:image":"https:\/\/michaelrowe01.com\/wp-content\/uploads\/2019\/04\/img_0391.jpg","og:image:secure_url":"https:\/\/michaelrowe01.com\/wp-content\/uploads\/2019\/04\/img_0391.jpg","og:image:width":3088,"og:image:height":2316,"article:published_time":"2023-06-09T18:32:17+00:00","article:modified_time":"2023-06-09T18:32:20+00:00","twitter:card":"summary","twitter:title":"Verify app dependencies with digital signatures | Random Thoughts","twitter:image":"https:\/\/michaelrowe01.com\/wp-content\/uploads\/2019\/04\/img_0391.jpg"},"aioseo_meta_data":{"post_id":"3237","title":null,"description":null,"keywords":[],"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":[],"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":0,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2023-06-09 18:30:56","updated":"2025-06-04 00:35:07","seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/michaelrowe01.com\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/michaelrowe01.com\/index.php\/category\/blog\/\" title=\"blog\">blog<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tVerify app dependencies with digital signatures\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/michaelrowe01.com"},{"label":"blog","link":"https:\/\/michaelrowe01.com\/index.php\/category\/blog\/"},{"label":"Verify app dependencies with digital signatures","link":"https:\/\/michaelrowe01.com\/index.php\/blog\/verify-app-dependencies-with-digital-signatures\/"}],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p2aMa8-Qd","jetpack-related-posts":[],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/michaelrowe01.com\/index.php\/wp-json\/wp\/v2\/posts\/3237","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/michaelrowe01.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/michaelrowe01.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/michaelrowe01.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/michaelrowe01.com\/index.php\/wp-json\/wp\/v2\/comments?post=3237"}],"version-history":[{"count":1,"href":"https:\/\/michaelrowe01.com\/index.php\/wp-json\/wp\/v2\/posts\/3237\/revisions"}],"predecessor-version":[{"id":3241,"href":"https:\/\/michaelrowe01.com\/index.php\/wp-json\/wp\/v2\/posts\/3237\/revisions\/3241"}],"wp:attachment":[{"href":"https:\/\/michaelrowe01.com\/index.php\/wp-json\/wp\/v2\/media?parent=3237"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/michaelrowe01.com\/index.php\/wp-json\/wp\/v2\/categories?post=3237"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/michaelrowe01.com\/index.php\/wp-json\/wp\/v2\/tags?post=3237"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}