osquery-1/specs/darwin/signature.table

table_name("signature")
description("File (executable, bundle, installer, disk) code signing status.")
schema([
    Column("path", TEXT, "Must provide a path or directory", required=True),
    Column("signed", INTEGER, "1 If the file is signed else 0"),
    Column("identifier", TEXT, "The signing identifier sealed into the signature"),
    Column("cdhash", TEXT, "SHA1 hash of the application Code Directory"),
    Column("team_identifier", TEXT, "The team signing identifier sealed into the signature"),
    Column("authority", TEXT, "Certificate Common Name"),
])
implementation("signature@genSignature")
examples([
  "select * from signature where path = '/bin/ls'",
])