Code signing to check for IOS ipa integrity .

Guys need your inputs on this please. Thanks

Guys need your inputs on this please.

Dude, patience.

Oh, and as a reminder, DevForums is an informal support channel. If you want formal support, open a DTS tech support incident. And if you follow that link you’ll find that DTS aims to respond to queries “within three business days”.

An .ipa file is just a zip archive it disguise. It doesn’t have its own signature, and thus there’s nothing to check.

If you want to check the signature of the app within the .ipa file, the answer to that depends on the context. Is your goal to do this on iOS itself?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Basically i want to have a check on our side to know if my app has been tampered with or not.

The supported way to do that is with App Attest.

The path you’re going down is not supported by DTS. There are two reasons for this:

• Anti-tamper protection is a form of DRM, and DTS does not support DRM [1] development in general. Any DRM system involves a trade-off between effectiveness and compatibility: The more effective your system is, the less likely it is to be compatible in the long term. DTS falls on the compatibility side of this divide, and so we don’t support DRM.

• In this specific situation, Apple regularly transforms your app during the distribution process. For example:

  • Re-signing the app
  • Adding the App Store’s own DRM
  • App thinning
  • Applying bitcode

  Some of these you can avoid but not all of them, and Apple reserves the right to add more as time goes by. There’s no supported way to distinguish Apple’s valid tranformations from tampering.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] Well, non-Apple DRM. We do support various aspects of FairPlay.

in

But is there a way to get Get Certificate SHA1 Fingerprint in iOS.

You’ll need to be more specific as to what you’re looking for here. There are at least two two different ways that we calculate certificate SHA-1 fingerprints, and that’s just in the Apple ecosystem (-:

Also, please put those details in a new thread, as it’s kinda off-topic for this one. Tag it with Security so that I see it.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"