The MongoDB release team digitally signs mongosync packages to certify that the packages are a valid and unaltered MongoDB release. Before you install mongosync, you can use the digital signature to validate the package.
The mongosync .zip download for macOS is notarized. This page describes how to use codesign to verify the integrity of the unzipped mongosync binary.
Before you Begin
If you don't have mongosync installed, download the mongosync package from the Download Center.
Steps
To verify the mongosync binary, run:
codesign -dv --verbose=4 <path_to_binary>If the binary is signed by MongoDB, the output includes the following information:
Authority=Developer ID Application: MongoDB, Inc. (4XWMY46275)Authority=Developer ID Certification AuthorityAuthority=Apple Root CA