{
  "id": "apple_cdhash",
  "kind": "datatype",
  "status": "draft",
  "name": "Apple code directory hash (cdhash)",
  "doc": "Hash of the code directory in an Apple code signature, which in turn holds the hashes of the signed code and resources, so the cdhash identifies one signed build of a Mach-O binary or bundle. It is 20 bytes, written as 40 lowercase hexadecimal digits: a SHA-1 hash, or a SHA-256 hash truncated to 20 bytes. codesign --display -vvv shows it as CDHash, and a notarization ticket is a set of cdhashes. Each architecture of a universal binary has its own cdhash. VirusTotal reports it in signature_info. The value alone looks like a SHA-1 hash.",
  "is_pii": false,
  "categories": [
    "software",
    "cryptography"
  ],
  "langs": [
    "common"
  ],
  "classification": "identifier",
  "regexp": "^[0-9a-f]{40}$",
  "examples": [
    {
      "value": "ff19a91b272a49d1a0f16ee54c672da60f0e116f",
      "description": "SHA-256 cdhash truncated to 20 bytes, from Apple TN3126",
      "valid": true
    },
    {
      "value": "4dbc916a07fb02653ceecef8bef09f43e55cf436",
      "description": "SHA-1 cdhash of the same code, from Apple TN3126",
      "valid": true
    },
    {
      "value": "ff19a91b272a49d1a0f16ee54c672da60f0e116fae890512a3609913a01b488c",
      "description": "Full SHA-256 value (CandidateCDHashFull), not the 20-byte cdhash",
      "valid": false
    }
  ],
  "links": [
    {
      "type": "doc",
      "url": "https://developer.apple.com/documentation/technotes/tn3126-inside-code-signing-hashes"
    },
    {
      "type": "other",
      "url": "https://virustotal.readme.io/reference/file-object-signature-info"
    }
  ],
  "quality": {
    "score": 75,
    "missing": [
      "mapping (Wikidata, Schema.org, ...)",
      "translation",
      "detector coverage"
    ]
  },
  "source": {
    "path": "data/datatypes/any/software/apple_cdhash.yaml",
    "url": "https://github.com/apicrafter/metacrafter-registry/blob/main/data/datatypes/any/software/apple_cdhash.yaml",
    "edit_url": "https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/software/apple_cdhash.yaml"
  },
  "urls": {
    "html": "https://registry.apicrafter.io/datatype/apple_cdhash",
    "json": "https://registry.apicrafter.io/api/v1/datatypes/apple_cdhash.json"
  }
}