Apple Code Signing Utility
Codesign is a macOS utility that applies cryptographic signatures to executables and app bundles, binding them to a trusted developer or Apple certificate. It embeds a code signature blob into the binary, enabling the system to verify provenance, detect modifications, and enforce entitlements during execution, distribution, and OS security checks. Proper use ensures trusted software flow from development to deployment, reducing the risk of tampering.
It creates a signed code signature using a developer or Apple certificate, embeds the signature and entitlements into the binary, and allows verification with codesign --verify. The tool integrates with Gatekeeper and the security framework to maintain a trust chain for macOS apps.
Codesign itself is a legitimate macOS utility designed by Apple to bind binaries to a trusted certificate. When used as intended—signing your own software, validating third‑party apps, and verifying signatures—it enhances system security by making tampering detectable and protecting users from unsigned or modified code. Misuse, such as signing malicious binaries or bypassing entitlements, can undermine trust and lead to security vulnerabilities.
Codesign is not a virus. On macOS, it lives at /usr/bin/codesign and is part of the system's code signing and security infrastructure. Some malware may disguise itself with similar names or misuse the concept of signing, so always verify the binary path, digital signature, and publisher before trusting it. If you see unrelated behavior, investigate with system tools.
Red Flags: If codesign appears in an unexpected location, lacks a valid Apple signature, or shows a non‑Apple issuer, that may indicate tampering. Unexpected behavior such as altered signature details, repeated signing without reason, or missing entitlements warrants deeper inspection.
Reasons it's running: