Edward Marczak

Use SecTaskGetCodeSignStatus for Platform Binaries

5

Every now and then, there's an Apple-supplied, system binary that isn't signed. (Currently: looking at you, RemotePairingDataVaultHelper) Naturally, Santa blocks these, but it doesn't have to be this way: SecTaskGetCodeSignStatus...

Use expand-full switch with pkgutil

3

The (undocumented) expand-full switch will expand all components and better drill down into distribution-style packages.