# Code Signing

Starting in macOS Sierra, disk images can be code signed to verify the integrity of their contents. When a disk image is not code signed, macOS’s Gatekeeper will launch applications bundled inside the disk image from a virtual randomized path, which prevents certain attack vectors for maliciously crafted application resources. Applications inside of disk images which have been properly code signed are not subject to this launch path randomization. To learn more about this security issue, see the WWDC 2016 session 706 “What’s New in Security” and Technote 2206.

### Install the Certificate

To code sign your disk image, you’ll need to have a “Developer ID Application” certificate from Apple, installed with Keychain Access.

1. Log into your developer account
2. create the Developer ID Application certificate
3. Download the certificate
4. Double-click the certificate in Finder to install it with Keychain Access

In the DMG Canvas application Settings, you will see a list of code signing certificates available for DMG Canvas to use. You can use the refresh button to have DMG Canvas scan for installed certificates again.

### Set a Disk Image to be Code Signed

1. In a DMG Canvas document, select the Disk Image at the top of the sidebar.
2. Select one of the Code Sign options in the “Gatekeeper” setting.
3. Select the Developer ID Application certificate from the certificates popup.

DMG Canvas will then code sign and verify the disk image for you, notifying you if there’s an error. That’s all there is to it.

- Note that code-signed disk images should also be notarized to open on macOS 10.15 Catalina and later.

## Why You Should Code Sign Your Disk Image

Known as the repackaging problem, a bad actor can repackage your app bundle with a different, potentially malicious version of the external-to-your-app-bundle resources, and distribute the altered disk image as if it came from you. If your application then loads this extra content at runtime, because the extra code is outside the app bundle and thus not covered by the app’s code signature, you can’t be certain that the extra content is unmodified and secure. This is a security risk.

To combat this problem, beginning in macOS 10.12 Sierra, when an app is launched from a read-only disk image, the operating system employs Gatekeeper path randomization. The system copies the app to a random location in the file system before executing it, invalidating any relative paths that the app uses to access unprotected content outside its own app bundle.

You can bypass path randomization by code signing your disk image before you distribute it. When launching an app from a code-signed disk image, Gatekeeper disables path randomization because all the contents of the disk image are covered by a code signature.

- Whether or not Gatekeeper employs path randomization, it still evaluates an app and its code signature on first launch as usual. In other words, even when you distribute an app using a signed disk image, you still separately sign your app bundle in the usual way, before adding it to the disk image.

- Also note that code-signed disk images should also be notarized to open on macOS 10.15 Catalina and later.