DMGKit Inspector: The macOS DMG Security and Trust Analyzer

Distributing or downloading macOS apps should not feel like a gamble. DMGKit Inspector helps developers and end users understand whether a DMG or PKG looks trusted, signed, notarized, and ready to open.

Instead of forcing people to run multiple Terminal commands and interpret raw output, Inspector turns Mac distribution trust signals into a readable report.

Why installer verification matters

Mac apps are commonly distributed as DMG or PKG files. But a file that mounts successfully is not automatically trustworthy.

• The app may be unsigned.
• The signature may be broken.
• The notarization ticket may be missing.
• The installer may contain unexpected files.
• The file may have been modified after signing.

What DMGKit Inspector checks

• Code signing validity.
• Developer identity.
• Apple notarization status.
• Gatekeeper assessment.
• Stapled ticket presence.
• SHA-256 hash.
• Bundle structure.
• Mountability and file integrity.

Manual checks Inspector replaces

codesign -dv --verbose=4 "YourApp.app"
spctl -a -vvv --type execute "YourApp.app"
xcrun stapler validate "YourApp.app"
hdiutil verify "YourInstaller.dmg"
shasum -a 256 "YourInstaller.dmg"

These commands are powerful, but they are not friendly to every developer and almost never friendly to normal users.

Trust score

DMGKit Inspector summarizes results into a trust-oriented report. A high score means the file presents expected security signals. A lower score tells you where to investigate before distributing or installing.

The DMGKit release loop

Design → Sign → Notarize → Export → Inspect → Ship

That loop gives developers a complete path from polished installer design to final trust verification.

FAQ

Related guides