Apple devs: Don't let Apple's Xcode validation scare you

Apple told devs to validate their copy of Xcode using a simple procedure -- but unless you have Xcode version 7.0, your copy may not pass the test

Apple devs: Don't let Apple's Xcode validation scare you

The Apple App Store has long enjoyed a sterling reputation for screening out malware. But last weekend, the company pulled apps infected with XcodeGhost malware from the Chinese Apple App Store -- infected apps that had apparently been created with a counterfeit version of Apple's Xcode IDE by unsuspecting developers.

As a precaution, Apple emailed its developers on Tuesday, recommending that they validate their installed version of Xcode using a simple procedure to ensure it wasn't a hacked version. The email also contained a reminder to "always download Xcode directly from the Mac App Store, or from the Apple Developer website, and leave Gatekeeper enabled on all your systems to protect against tampered software."

InfoWorld contributing editor Peter Wayner followed the validation procedure to the letter -- and his copy of Xcode 6.4 didn't pass the test. Peter communicated with a fellow Mac developer who was also running version 6.4 and got the same result. Both had downloaded Xcode from Apple. Had Apple hosted a counterfeit version of Xcode?

After multiple queries, Apple got back to us late yesterday. An Apple spokesperson told us that the Xcode test recommended on the Apple developer blog verifies that "every single bit" is correct and older versions of Xcode may have "a few bits flipped" in the course of ordinary usage -- hence the false positive that 6.4 was not a valid version. The solution, we were told, was simply to downoad Xcode 7.0, the latest version, from Apple.

In other words: Unless you have version 7.0, you could easily get the same message Peter did: "a sealed resource is missing or invalid." Don't panic. Go to the App Store or to the Apple Developer website and download Xcode 7.0. If you want to be extra careful, run the recommended validation procedure, and the "accepted" message will give you additional peace of mind.

Copyright © 2015 IDG Communications, Inc.