How to Verify the Code Signature of the MBS Plugin on macOS

21 hours ago21 hr

When installing an MBS FileMaker Plugin on macOS, especially in a production or security-sensitive environment, it can be useful to verify that the plugin has a valid Apple code signature and that its contents have not been modified.

MBS Plugin is available for FileMaker and Monkeybread Software signs its macOS plugins. Apple provides the codesign and spctl command-line tools for inspecting signatures and checking how macOS security policies treat signed software.

This article shows how to perform those checks from Terminal.

1. Locate the MBS Plugin

First, download the MBS Plugin from the official Monkeybread Software distribution.

For the MBS FileMaker Plugin, the macOS plugin is normally named:

MBS.fmplugin

If you already have the plugin installed, you can also navigate to the FileMaker plugins folder and locate the .fmplugin or corresponding plugin bundle.

A convenient Terminal trick is to type the beginning of a command and then drag the plugin from Finder into Terminal. macOS will insert the complete path automatically.

For example:

codesign --verify "/path/to/MBS.fmplugin"

2. Perform a Basic Signature Check

The simplest check is:

codesign --verify "/path/to/MBS.fmplugin"

If the signature is valid, codesign normally produces no output and returns an exit status of 0.

Apple documents codesign --verify as the standard way to verify that signed code has a valid signature and that its sealed contents have not been modified.

3. Get More Detailed Information

For a more useful diagnostic, add verbose output:

codesign --verify --verbose=4 "/path/to/MBS.fmplugin"

You can also use:

codesign -d -vvvv "/path/to/MBS.fmplugin"

The -d option displays information about the signature rather than performing the verification itself. The output can include information about the signing authority, identifier, and other details of the code signature.

For example, you may see information similar to:

Executable=/path/to/MBS.fmplugin/Contents/MacOS/MBS
Identifier=de.monkeybreadsoftware.fmplugin.MBS
Format=bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20400 size=69735 flags=0x0(none) hashes=2172+3 location=embedded
VersionPlatform=1
VersionMin=720896
VersionSDK=1705216
Hash type=sha256 size=32
CandidateCDHash sha256=f1d2bdb8c102532bb647e007180e2f13e4c15cc2
CandidateCDHashFull sha256=f1d2bdb8c102532bb647e007180e2f13e4c15cc2beb92bb7e59a7824cee87a1b
Hash choices=sha256
CMSDigest=f1d2bdb8c102532bb647e007180e2f13e4c15cc2beb92bb7e59a7824cee87a1b
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=26361856
Executable Segment flags=0x0
Page size=16384
CDHash=f1d2bdb8c102532bb647e007180e2f13e4c15cc2
Signature size=9012
Authority=Developer ID Application: Christian Schmitz Software GmbH (RZ52899P4B)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=10. Aug 2026 at 10:24:11
Info.plist entries=19
TeamIdentifier=RZ52899P4B
Sealed Resources version=2 rules=13 files=13
Internal requirements count=1 size=196

The exact output depends on the plugin version and how the bundle was signed.

You may check if the Christian Schmitz Software GmbH name appears here and the authority signing the app is Apple.

4. Don't Modify the Plugin After Verification

One important detail is that changing the contents of a signed plugin can invalidate its signature.

For example extracting an architecture from a universal MBS FileMaker Plugin with lipo breaks the existing code signature.

Similarly, modifying, replacing, or patching files inside the plugin bundle can cause FileMaker to reject the plugin.

For search.html, please make a copy into the Extensions folder and modify it there. Do not modify the copy inside the plugin.

If you have modified an MBS Plugin and subsequently see a signature error, the safest approach is to obtain a fresh copy from Monkeybread Software rather than attempting to repair the original plugin.

Troubleshooting a Failed Verification

If you get an error such as:

code object is not signed at all

or:

a sealed resource is missing or invalid

or:

code object is modified

the plugin should be treated as potentially modified or incomplete until the cause is understood.

Common causes include:

An incomplete download.
A file inside the plugin bundle was modified.
The plugin was repackaged.
A binary architecture was extracted with lipo.
The plugin was copied incorrectly.
A different or outdated plugin build was used.
Security software or another process modified the bundle.

The simplest test is to download a fresh copy directly from the official MBS distribution and repeat the verification.

Monkeybread Software currently publishes MBS Plugin downloads and provides SHA-256 hashes for its downloadable archives, giving you another useful integrity check for the downloaded archive itself.

Conclusion

Verifying an MBS Plugin on macOS is straightforward and does not require special software. The most useful command is:

codesign --verify --deep --strict --verbose=2 "/path/to/MBS.fmplugin"

These check let you confirm that the plugin has a valid code signature, inspect its signing information, determine its CPU architecture, and identify macOS quarantine attributes.

For production deployments, it is good practice to verify the plugin before installing it into FileMaker*. This provides an additional assurance that the MBS Plugin you are using is the expected, unmodified distribution.