Use the code signing API for this, and specifically SecStaticCodeCheckValidityWithErrors. That API lets you pass in a code signing requirement that it’ll check as part of its operation. If you pass in your app’s designated requirement, you can be sure that this app is both validly signed and is actually your app.We need to check the downloaded APP bundle from a ZIP to make sure
that it's our application (valid signature and our name in the
signature) before run it.
Honestly, I think you’re better of using code signing your this. You’re already taking steps to protect your Developer ID’s private key, so there’s no point adding to that burden.I'll use my own signature + hash of the file, this info will be
encoded in the filename and then checked after downloading.
You’ve misunderstood how this works. When you set up your Developer ID you create a private/public key pair and send the public key (as part of a certificate signing request) to Apple. Apple never has your private key and thus can’t sign code as you.So nobody will not able to replace the file, even Apple.