如何在不使用macOS特定工具的情况下从macOS应用程序中提取代码目录哈希（CDhash）？
应用程序的CDhash是Contents/Info.plist中标识的Contents/MacOS中主可执行文件的CDhash
每个散列都存储在XML语句中每个体系结构的二进制段的末尾。
嵌入的cdhash是用base64编码的。第一个是intel的，第二个是apple silicon的：

% grep -i -a -A3 'cdhashes' myApp.app/Contents/MacOS/mainexec | sed -n '4p;9p' | cut -f 3  
HPhKLQv1j2SFYTmIgyUi/L6B9Yo=
TVNDrCQEL9A/DMWVmphntZAq7kc=

% printf "HPhKLQv1j2SFYTmIgyUi/L6B9Yo=" | base64 -d | hexdump -v -e '/1 "%02x" ' && echo ""
1cf84a2d0bf58f6485613988832522fcbe81f58a

% printf "TVNDrCQEL9A/DMWVmphntZAq7kc=" | base64 -d | hexdump -v -e '/1 "%02x" ' && echo ""
4d5343ac24042fd03f0cc5959a9867b5902aee47

字符串
与codesign报告的cdhash相比：

% codesign -dvvv -a arm64 myApp.app
Executable=myApp.app/Contents/MacOS/mainexec
Identifier=com.mycompany.myApp
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=92199 flags=0x10000(runtime) hashes=2870+7 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=4d5343ac24042fd03f0cc5959a9867b5902aee47
CandidateCDHashFull sha256=4d5343ac24042fd03f0cc5959a9867b5902aee4725c5a75775cd711aae76b709
Hash choices=sha256
CMSDigest=4d5343ac24042fd03f0cc5959a9867b5902aee4725c5a75775cd711aae76b709
CMSDigestType=2
Launch Constraints:
    None
CDHash=4d5343ac24042fd03f0cc5959a9867b5902aee47

型

基于Richard's answer，这是我最终使用的（有更多的错误检查）：

import base64
import re
import plistlib

import requests

def bin2hex(bin):
    """return exencoded representation of bytes-object <bin>"""
    return "".join(["%02x" % _ for _ in bin])

def extractEmbeddedPlists(filename):
    """extract embedded plist data sections from binary file"""
    # this is a very crude way to do it!
    # LATER properly parse the macho file (with something like 'macholibre')
    with open(filename, "rb") as f:
        data = f.read()
    try:
        return [
            plistlib.loads(_)
            for _ in re.findall(b"<plist.*?</plist>", data, flags=re.DOTALL)
        ]
    except:
        pass
    return []

def getCDHashes(app):
    """get code directory hashes from a bundle
    not all cdhashes might be valid!
    """
    info_plist = os.path.join(app, "Contents", "Info.plist")
    try:
        with open(info_plist, "rb") as f:
            info = plistlib.load(f)
    except:
        return []
    if "CFBundleExecutable" not in info:
        return []
    plists = extractEmbeddedPlists(os.path.join(app, "Contents", "MacOS", info["CFBundleExecutable"]))
    cdhashes = [_["cdhashes"] for _ in plists if "cdhashes" in _]
    hashes = {bin2hex(_) for a in cdhashes for _ in a}
    return hashes

def getTicket(cdhash):
    """retrieve a notarization ticket for a given cdhash"""
    recordName = "2/2/%s" % cdhash
    data = {
        "records": {"recordName": recordName},
    }
    r = requests.post(ticket_url, json=data)

    j = r.json()
    record = j["records"][0]
    if record.get("serverErrorCode") == "NOT_FOUND":
        return

    ticket = record["fields"]["signedTicket"]["value"]
    return base64.b64decode(ticket)

def getTicket(app):
    for hash in getCDHashes(app):
        try:
            ticket = getTicket(hash)
            if ticket: return ticket
        except: pass

字符串
仍然有一些粗糙的边缘尚未处理（例如，如果二进制文件包含多个产生不同票据的CDHash（每个CDHash用于通用二进制文件的每个体系结构），则决定装订哪个票据），但基本工作现在正在进行。