{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/2054","repository_url":"https://api.github.com/repos/facebook/osquery","labels_url":"https://api.github.com/repos/facebook/osquery/issues/2054/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/2054/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/2054/events","html_url":"https://github.com/facebook/osquery/issues/2054","id":151196431,"number":2054,"title":"Signature not working for some apps","user":{"login":"JakubOnderka","id":163343,"avatar_url":"https://avatars.githubusercontent.com/u/163343?v=3","gravatar_id":"","url":"https://api.github.com/users/JakubOnderka","html_url":"https://github.com/JakubOnderka","followers_url":"https://api.github.com/users/JakubOnderka/followers","following_url":"https://api.github.com/users/JakubOnderka/following{/other_user}","gists_url":"https://api.github.com/users/JakubOnderka/gists{/gist_id}","starred_url":"https://api.github.com/users/JakubOnderka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JakubOnderka/subscriptions","organizations_url":"https://api.github.com/users/JakubOnderka/orgs","repos_url":"https://api.github.com/users/JakubOnderka/repos","events_url":"https://api.github.com/users/JakubOnderka/events{/privacy}","received_events_url":"https://api.github.com/users/JakubOnderka/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-04-26T17:46:24Z","updated_at":"2016-04-26T18:34:01Z","closed_at":null,"body":"Hi, \r\n\r\nI have problem with verifing signature on OS X for some apps, for example for Sublime Text.\r\n\r\nosquery output:\r\n```\r\n$ osqueryi --verbose \"SELECT signed, team_identifier, authority FROM signature WHERE path='/Applications/Sublime Text.app'\"\r\nI0426 19:37:53.097475 2028392448 init.cpp:309] osquery initialized [version=1.7.3]\r\nI0426 19:37:53.097703 2028392448 extensions.cpp:198] Could not autoload extensions: Failed reading: /etc/osquery/extensions.load\r\nI0426 19:37:53.097735 2028392448 extensions.cpp:205] Could not autoload modules: Failed reading: /etc/osquery/modules.load\r\nI0426 19:37:53.097823 2028392448 rocksdb.cpp:189] Opening RocksDB handle: /Users/jakubonderka/.osquery/shell.db\r\nI0426 19:37:53.105123 2028392448 init.cpp:524] Error reading config: config file does not exist: /var/osquery/osquery.conf\r\nI0426 19:37:53.642906 2028392448 signature.mm:101] Static code validity check failed for file: /Applications/Sublime Text.app\r\n+--------+-----------------+----------------------------------------------+\r\n| signed | team_identifier | authority                                    |\r\n+--------+-----------------+----------------------------------------------+\r\n| 0      | Z6D26JE4Y4      | Developer ID Application: Sublime HQ Pty Ltd |\r\n+--------+-----------------+----------------------------------------------+\r\n```\r\n\r\nso I think this output means, that app contains signature, but signature is invalid. But when I run `codesign` app, the ouput means, that signature is correct:\r\n\r\n```\r\n$ codesign -dvv \"/Applications/Sublime Text.app\"\r\nExecutable=/Applications/Sublime Text.app/Contents/MacOS/Sublime Text\r\nIdentifier=com.sublimetext.3\r\nFormat=app bundle with Mach-O thin (x86_64)\r\nCodeDirectory v=20200 size=60341 flags=0x0(none) hashes=3010+3 location=embedded\r\nSignature size=8558\r\nAuthority=Developer ID Application: Sublime HQ Pty Ltd\r\nAuthority=Developer ID Certification Authority\r\nAuthority=Apple Root CA\r\nTimestamp=9. 2. 2016 0.10:00\r\nInfo.plist entries=14\r\nTeamIdentifier=Z6D26JE4Y4\r\nSealed Resources version=2 rules=12 files=103\r\nInternal requirements count=1 size=180\r\n```"},"comment":{"url":"https://api.github.com/repos/facebook/osquery/issues/comments/214842314","html_url":"https://github.com/facebook/osquery/issues/2054#issuecomment-214842314","issue_url":"https://api.github.com/repos/facebook/osquery/issues/2054","id":214842314,"user":{"login":"sharvilshah","id":819943,"avatar_url":"https://avatars.githubusercontent.com/u/819943?v=3","gravatar_id":"","url":"https://api.github.com/users/sharvilshah","html_url":"https://github.com/sharvilshah","followers_url":"https://api.github.com/users/sharvilshah/followers","following_url":"https://api.github.com/users/sharvilshah/following{/other_user}","gists_url":"https://api.github.com/users/sharvilshah/gists{/gist_id}","starred_url":"https://api.github.com/users/sharvilshah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sharvilshah/subscriptions","organizations_url":"https://api.github.com/users/sharvilshah/orgs","repos_url":"https://api.github.com/users/sharvilshah/repos","events_url":"https://api.github.com/users/sharvilshah/events{/privacy}","received_events_url":"https://api.github.com/users/sharvilshah/received_events","type":"User","site_admin":false},"created_at":"2016-04-26T18:34:01Z","updated_at":"2016-04-26T18:34:01Z","body":"Does `codesign -vv --deep /Applications/Sublime\\ Text.app` report it as valid?\r\n\r\nMy Sublime build is 3103 and it is signed and reporting it as such correctly.\r\n\r\n```\r\n❯ osqueryi --line \"SELECT * FROM signature WHERE path='/Applications/Sublime Text.app'\"\r\n           path = /Applications/Sublime Text.app\r\n         signed = 1\r\n     identifier = com.sublimetext.3\r\n         cdhash = b389550b60426a34d340c971b93bae81d8026ebe\r\nteam_identifier = Z6D26JE4Y4\r\n      authority = Developer ID Application: Sublime HQ Pty Ltd\r\n```\r\n\r\n```\r\n❯ codesign -vv --deep /Applications/Sublime\\ Text.app\r\n/Applications/Sublime Text.app: valid on disk\r\n/Applications/Sublime Text.app: satisfies its Designated Requirement\r\n\r\n❯ codesign --display --verbose=4 /Applications/Sublime\\ Text.app\r\nExecutable=/Applications/Sublime Text.app/Contents/MacOS/Sublime Text\r\nIdentifier=com.sublimetext.3\r\nFormat=app bundle with Mach-O thin (x86_64)\r\nCodeDirectory v=20200 size=60341 flags=0x0(none) hashes=3010+3 location=embedded\r\nHash type=sha1 size=20\r\nCandidateCDHash sha1=b389550b60426a34d340c971b93bae81d8026ebe\r\nHash choices=sha1\r\nCDHash=b389550b60426a34d340c971b93bae81d8026ebe\r\nSignature size=8558\r\nAuthority=Developer ID Application: Sublime HQ Pty Ltd\r\nAuthority=Developer ID Certification Authority\r\nAuthority=Apple Root CA\r\nTimestamp=Feb 8, 2016, 3:10:00 PM\r\nInfo.plist entries=14\r\nTeamIdentifier=Z6D26JE4Y4\r\nSealed Resources version=2 rules=12 files=103\r\nInternal requirements count=1 size=180\r\n```"}}