Apple code directory hash (cdhash)
ID apple_cdhash
DatatypeNot PIIidentifierDraft
This record is a draft: it has not been reviewed yet and may be incomplete or wrong. Do not rely on it for compliance decisions. Help improve it (see CONTRIBUTING.md).
Hash of the code directory in an Apple code signature, which in turn holds the hashes of the signed code and resources, so the cdhash identifies one signed build of a Mach-O binary or bundle. It is 20 bytes, written as 40 lowercase hexadecimal digits: a SHA-1 hash, or a SHA-256 hash truncated to 20 bytes. codesign --display -vvv shows it as CDHash, and a notarization ticket is a set of cdhashes. Each architecture of a universal binary has its own cdhash. VirusTotal reports it in signature_info. The value alone looks like a SHA-1 hash.
- Categories
- Software development, Cryptographic identifiers
- Countries
- Global (not tied to a country)
- Languages
- Common to most languages
- Quality
- 75/100 · missing: mapping (Wikidata, Schema.org, ...), translation, detector coverage
- Metacrafter rules
- no detection rule yet
- Supported by tools
- no tool record lists this type yet
Regular expression
^[0-9a-f]{40}$Python re syntax.
Examples
| Value | Description |
|---|---|
| ff19a91b272a49d1a0f16ee54c672da60f0e116f | SHA-256 cdhash truncated to 20 bytes, from Apple TN3126 |
| 4dbc916a07fb02653ceecef8bef09f43e55cf436 | SHA-1 cdhash of the same code, from Apple TN3126 |
| ff19a91b272a49d1a0f16ee54c672da60f0e116fae890512a3609913a01b488c invalid | Full SHA-256 value (CandidateCDHashFull), not the 20-byte cdhash |
Sources
- doc: https://developer.apple.com/documentation/technotes/tn3126-inside-code-signing-hashes
- other: https://virustotal.readme.io/reference/file-object-signature-info
Use this record
- Page URL:
https://registry.apicrafter.io/datatype/apple_cdhash - JSON: API v1 · legacy shape (used by metacrafter) · Markdown (for LLMs)
- Improve it: edit
data/datatypes/any/software/apple_cdhash.yamlon GitHub