# How to verify a signed xcframework programmatically

In this blog post, I'll explain how you can programmatically verify a binary framework (`.xcframework` file).

This can help determine build/archive issues on a CI machine related to <mark>error: signature-collection failed: The operation couldn’t be completed</mark>. Once you know that a binary framework was tempered and how, i.e., which files were added/modified/removed, then you can easily chase down the root cause.

I use the LineSDK.xcframework, accessible for download on GitHub, in my examples below.

## Details

Use the `codesign` tool ([MAN page](https://keith.github.io/xcode-man-pages/codesign.1.html)) to verify the signature and integrity of a binary framework.

### Display the signature of the binary framework

```plaintext
codesign -dv LineSDK.xcframework
```

Output

```plaintext
Executable=/Users/marcoeidinger/Downloads/LineSDK.xcframework/Info.plist
Identifier=LineSDK
Format=bundle
CodeDirectory v=20200 size=199 flags=0x0(none) hashes=1+3 location=embedded
Signature size=9179
Timestamp=Oct 31, 2023 at 6:43:37 PM
Info.plist entries=3
TeamIdentifier=VUTU7AKEUR
Sealed Resources version=2 rules=10 files=70
Internal requirements count=1 size=176
```

We know that the binary framework was signed with Team Identifier `VUTU7AKEUR` but is the binary framework untempered? Let's check its integrity next.

### Verify the integrity of the signed binary framework

```plaintext
codesign -vv LineSDK.xcframework
```

Output

```plaintext
LineSDK.xcframework: valid on disk
LineSDK.xcframework: satisfies its Designated Requirement
```

This output proves that the signed binary framework was not tempered 👍

Here is an example of when the signed binary framework was tempered (e.g. by deleting files)

```plaintext
LineSDK.xcframework: a sealed resource is missing or invalid
file missing: /Users/d041771/Downloads/Kingfisher-7.9.0/LineSDK.xcframework/ios-arm64/dSYMs/LineSDK.framework.dSYM/Contents/Resources/DWARF/LineSDK
file missing: /Users/d041771/Downloads/Kingfisher-7.9.0/LineSDK.xcframework/ios-arm64/dSYMs/LineSDK.framework.dSYM/Contents/Info.plist
```

## Alternative: use signature verification in Xcode 15+

Alternatively, Xcode 15 offers signature verification as a new feature in its IDE.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1705325760436/85a0e49f-1a96-4379-9047-b5528b14c396.png align="center")

If the binary framework would have been tempered

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704827062231/73359e6a-12fb-4809-b05f-739b81e9936b.png align="center")

If you want more details on this feature, check out my WWDCNotes article on signing and verifying a binary framework in Xcode 15.

%[https://www.wwdcnotes.com/notes/wwdc23/10061/]