Does anybody know a few details about signed software and /Applications/Utilities/Installer.app? I didn't find more at Wikipedia and the UNIX-Manual (man 8 installer).
Here's the valid signature from iLife 11 Installer.app:
Does this mean I can be 100% sure that nothing is modified? It means I can trust this PKG because it's signed by Apple? Or did I get something wrong?
Software being signed, just means that it was checked over by someone like verisign, or whomever. The problem with signed software, is that if your os doesnt check against reputable program signers, it can very well be modified. But if someone like apple, or verisign does sign it, and you got it directly from a good vendor, you can pretty sure that it wont be modified. Something like iLife wouldnt be let through on a mac if it were tampered with.
In essence, software being signed, is like when you buy something with a guarantee. Anyone can guarantee something, but not everyone will live up to that guarantee.
When Apple distributes software and updates, it signs the package to ensure that nothing has been modified, similarly to PGP signatures on emails. The Apple Software Update Certification Authority root certificate is installed with the operating system, and you can view it in Keychain Access.app.
Essentially, this signature ensures that the software was distributed and verified from Apple, and that it has not been tampered with or changed. Just like a PGP email, if you change the content of the message, the signature won't match. I've seen people who have tried to download "pre-cracked" or pirated software (for iLife, iWork etc.) and their installer wasn't signed; the person who modified the package removed the signature from the package and redistributed it (or just created a very similar looking installer).
If you're receiving software through Software Update or downloading official patches/updates from apple.com, the software should be signed by the Apple Software Update Certification Authority. If it's not, it's not genuine (Apple's stringency is a good thing).
Edit: The root certificate is the Apple Root Certificate Authority. The software distribution certificate is approved (not sure of the terminology) by the Apple Root Certificate Authority.
