---
id: "apple_cdhash"
kind: "datatype"
status: "draft"
is_pii: false
categories: ["software", "cryptography"]
langs: ["common"]
quality: 75
url: "https://registry.apicrafter.io/datatype/apple_cdhash"
---

# Apple code directory hash (cdhash) (`apple_cdhash`)

> **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions.

Hash of the code directory in an Apple code signature, which in turn holds the hashes of the signed code and resources, so the cdhash identifies one signed build of a Mach-O binary or bundle. It is 20 bytes, written as 40 lowercase hexadecimal digits: a SHA-1 hash, or a SHA-256 hash truncated to 20 bytes. codesign --display -vvv shows it as CDHash, and a notarization ticket is a set of cdhashes. Each architecture of a universal binary has its own cdhash. VirusTotal reports it in signature_info. The value alone looks like a SHA-1 hash.

- Personal data (PII): no
- Categories: Software development (software), Cryptographic identifiers (cryptography)
- Countries: global
- Languages: Common to most languages (common)
- Classification: identifier

## Detection

Regular expression (Python `re`):

```
^[0-9a-f]{40}$
```

## Examples

- `ff19a91b272a49d1a0f16ee54c672da60f0e116f` — SHA-256 cdhash truncated to 20 bytes, from Apple TN3126
- `4dbc916a07fb02653ceecef8bef09f43e55cf436` — SHA-1 cdhash of the same code, from Apple TN3126
- `ff19a91b272a49d1a0f16ee54c672da60f0e116fae890512a3609913a01b488c` (invalid example) — Full SHA-256 value (CandidateCDHashFull), not the 20-byte cdhash

## Sources

- doc: <https://developer.apple.com/documentation/technotes/tn3126-inside-code-signing-hashes>
- other: <https://virustotal.readme.io/reference/file-object-signature-info>

## Quality

Score 75/100. Missing: mapping (Wikidata, Schema.org, ...), translation, detector coverage.

JSON: <https://registry.apicrafter.io/api/v1/datatypes/apple_cdhash.json> · Edit: <https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/software/apple_cdhash.yaml>