Verify a wallet .dmg with codesign on macOS

shasum is in the generic guide. This page adds codesign / spctl for Ledger Live and Trezor Suite .dmg files after the hash matches.

Security Guides · 7 min · Updated Jul 2026 · Expert

Use codesign after you SHA-256 a wallet .dmg: hash proves the image bytes, codesign -dv --verbose=2 shows who signed the .app inside. Gatekeeper alone is not a vendor checksum.

This page presets Ledger Live macOS. Switch the dropdown to Trezor Suite or Exodus if that is the file you mounted.

Do this now

  1. Download the official .dmg. Ledger Live from download.live.ledger.com/latest/mac, or Trezor Suite’s mac build from suite.trezor.io.
  2. SHA-256 the .dmg here. Drop the disk image into the verifier with ledger-live_mac (or the matching preset). Do not mount a mismatched image.
  3. codesign the .app after mount. Mount the dmg, then run the commands below on /Volumes/…/Ledger Live.app (path as mounted). Confirm Team ID / developer name against Ledger or Trezor’s docs — not against a random forum screenshot.

codesign and spctl commands

ToolProvesDoes not prove
SHA-256 on the .dmgImage matches published digestWho signed the app
codesign -dvSigner identity on the .appThat the digest on Twitter is official
spctl --assessGatekeeper assessmentThat the dApp you open later is safe
shasum -a 256 ~/Downloads/ledger-live.dmg
codesign -dv --verbose=2 "/Volumes/Ledger Live/Ledger Live.app"
spctl --assess --verbose=4 "/Volumes/Ledger Live/Ledger Live.app"
Right-click Open to bypass Gatekeeper on an unmatched hash is how people install fake Live. Hash first.

What codesign cannot do

It cannot replace Genuine Check on a Ledger device. It cannot see Trezor firmware. It inspects the macOS app bundle you mounted.

WalletGuard does not call Apple’s notary API. We hash the dmg in the browser.

Windows analog: certutil -hashfile. Ledger installer: Ledger Live official download.
Live artifact · preset ledger-live_mac

Catalog hash loads from WalletGuard’s wallet database. Confirm the same string on the developer’s signed release before you install.

Hash this file in the browser

Nothing is uploaded. Web Crypto SHA-256 stays on this device.

·
SHA-256

Compare to the catalog hash

This page pre-selects ledger-live_mac. Switch wallets if you grabbed a different build.

Preset hash: loads from catalog

No file selected yet.

Open the full verifier with this preset →

Frequently asked questions

Should I codesign or SHA-256 a wallet dmg first?

SHA-256 the dmg first against the vendor digest (and this page). Then codesign the mounted .app. A pretty signature on a file whose hash already failed is irrelevant.

Does Gatekeeper mean the wallet is official?

No. Gatekeeper means Apple’s assessment of that signed app. Vendors still publish SHA-256 because you want their digest, not only Apple’s policy.

Can this website codesign my app?

No. codesign runs on macOS. The embed only hashes the file you drop.

Open verifier · ledger-live_mac