I'm wondering how one might be able to securely load bundles signed by a developer ID into a parent app.
Here's my use case, we have a series of plugin-like bundles that each contain some compiled C code and some wrapper code. They are loaded at runtime to perform some function and maintained in memory for the lifetime of the app. These bundles can be rather large (10-15Mb each), and our app size is growing large as we add them.
Right now these are baked into a framework that is embedded in the app, but we're looking at using a Bundle to load each one individually on demand. We've been successful implementing the on-demand loading. But, we're concerned about maintaining security while loading these into the parent app.
Each bundle is signed by the parent app's developer ID, and it's feasible that we could verify a code signature before loading them without running into performance issues as usually only one is needed at a time.
What we'd like to try and prevent is a bad actor injecting some code into the bundle, and the parent app loading it leading to a compromise of user data. It seems like code signing could help prevent this by verifying that each bundle has not been modified and has been signed by us.
To verify code signature we'd be using SecCode objects and SecCodeCheckValidity to verify them.
So here's the question, is just verifying a code signature enough to prevent breaches of security like the one's we're concerned about? Is this the correct model for this type of use case on MacOS?