Code signing and notarization

Every release of FindDiskKiller is:

  • Developer ID signed: the app and all bundled executables (including the background helper) are signed with a Developer ID certificate issued by Apple.
  • Apple notarized: every DMG is submitted to Apple’s notary service, scanned for malicious content, and receives a notarization ticket.
  • Stapled: the notarization ticket is stapled to the DMG so Gatekeeper can verify it even offline.

How verification works at launch

When you first open FindDiskKiller, macOS checks:

  1. The code signature is valid and the signing certificate has not been revoked.
  2. The notarization ticket is present and valid.
  3. The app has not been tampered with since signing.

If any check fails, Gatekeeper blocks the app and shows a warning.

Verify the installed app

Verify the code signature:

codesign --verify --verbose /Applications/FindDiskKiller.app

And check the stapled notarization:

stapler validate /Applications/FindDiskKiller.app

App architecture and XPC

FindDiskKiller uses XPC (macOS inter-process communication) to isolate the file tracing helper from the main app UI:

  • The helper runs in its own process with a minimal set of entitlements.
  • Communication between the app and helper is through fixed XPC command interfaces.
  • The helper does not have network access.
  • The helper cannot access files or directories beyond the specific paths the user chooses to trace.

Supported versions

Only the most recent release is actively supported. When a new version is released, the previous version is considered superseded.

If a critical security fix is needed for an older version (for example, for users who cannot upgrade macOS), a patch release will be published and announced on the Releases page.