@theopolis when I use the signature table I get

+---------+--------+--------------+------------------------------------------+-----------------+------------------+
| path    | signed | identifier   | cdhash                                   | team_identifier | authority        |
+---------+--------+--------------+------------------------------------------+-----------------+------------------+
| /bin/ls | 1      | <http://com.apple.ls|com.apple.ls> | b7aa5322870358c31ecec59439537f7282832edc |                 | Software Signing |
+---------+--------+--------------+------------------------------------------+-----------------+------------------+

My reading of this is that the signed field is “Is the software signed” not “Is the software signature valid” . Am I mistaken? Does a

1

in that column mean that it is signed and valid?

Sorry, I’m sporadic this week. I think the assumption is wrong, and that field is reporting the status after checking the signature.

perfect I’ll get testing that

yes, maybe just a

signed

and

valid

?

I think it will help with the understanding of the output as well. We are going to continue testing but it will take a few days. Going to try and throw some stuff at it and see what it says. But to be less confusing to the community two columns would be great. And help when hunting for abnormalities

right! are you planning to create a PR for that change?

I can.

🙏