Are Mac OS images (eg. "OS X El Capitan.app") digitally signed? Safe to install from torrent?

Solution 1:

The original macOS installer apps are not distributed as images (i.e. dmg files). So you won't find a digitally signed macOS Installer.dmg, dmg signing is possible though: How to add codesigning to dmg file in mac.

However, you can check the codesigning of the macOS/OS X Installer.app and the sha sum of the InstallESD.dmg (which contains the files which will be installed to your disk later):

codesign -dv --verbose=4 /Volumes/InstallMavericks/Install\ OS\ X\ Mavericks.app

and

shasum /Volumes/InstallMavericks/Install\ OS\ X\ Mavericks.app/Contents/SharedSupport/InstallESD.dmg

Compare the shasum result with the following list: Apple Installer Checksums. If the checksum is different the dmg is tampered.

The name of the mounted Mavericks.dmg (i.e. InstallMavericks) is just an example - so use the proper path to the macOS/OS X Installer.app.