Tutorial

Date and Time Management on macOS

Manage date and time settings across your Roundfleet with enterprise-grade automation, validation controls, and comprehensive monitoring capabilities.

Understanding Enterprise Date and Time Management

Enterprise date and time management requires more than basic date setting, demanding:

• Automated validation and formatting with enterprise-grade error handling
• Scheduled date/time operations with business logic integration
• Compliance tracking for audit requirements and regulatory standards
• Real-time monitoring of date/time changes and system integrity
• Integration capabilities with enterprise scheduling and workflow systems
• Security controls to prevent unauthorized time manipulation

Core Date and Time Management Process

Basic Commands

1. Set Date/Time - date MMDDhhmm[[CC]YY][.ss]
2. Parameterized Setting - date $1 (with argument passing)

Core Date Format

The format follows: MMDDhhmm[[CC]YY][.ss]

• MM - Month (01-12)
• DD - Day (01-31)
• hh - Hour (00-23)
• mm - Minutes (00-59)
• CC - Century (optional)
• YY - Year (optional)
• ss - Seconds (optional)

Basic Configuration Examples

# Basic date setting
date 120614302023.00  # December 6, 2023 2:30 PM

# Parameterized version
date $1  # Pass date as argument

Enterprise Date and Time Management System

#!/bin/bash

# Roundfleet Enterprise Date and Time Management System
# Comprehensive date/time management with enterprise controls and monitoring

# Configuration
SCRIPT_NAME="Roundfleet Date/Time Manager"
VERSION="1.0.0"
LOG_FILE="/var/log/roundfleet_datetime.log"
AUDIT_LOG="/var/log/roundfleet_datetime_audit.log"
CONFIG_DIR="/etc/roundfleet/datetime"
POLICIES_DIR="/etc/roundfleet/datetime/policies"
BACKUP_DIR="/var/backups/datetime"
TEMP_DIR="/tmp/roundfleet_datetime"
ORGANIZATION_NAME="Roundfleet Enterprise"
DEPLOYMENT_MODE="enterprise"
ENABLE_VALIDATION=true
ENABLE_AUDIT_LOGGING=true
ENABLE_BACKUP_RESTORE=true
MAX_TIME_DRIFT_HOURS=24
BUSINESS_HOURS_START="08:00"
BUSINESS_HOURS_END="18:00"

# Date/Time Validation Patterns
declare -A DATE_FORMATS=(
    ["roundfleet"]="MMDDhhmm[[CC]YY][.ss]"
    ["iso8601"]="YYYY-MM-DDTHH:MM:SS"
    ["unix"]="seconds_since_epoch"
    ["readable"]="Month DD, YYYY HH:MM:SS"
)

# Enterprise Scheduling Policies
declare -A SCHEDULING_POLICIES=(
    ["immediate"]="execute_now"
    ["business_hours"]="within_business_hours_only"
    ["maintenance_window"]="scheduled_maintenance_only"
    ["emergency"]="override_all_restrictions"
)

# Compliance Standards
declare -A COMPLIANCE_REQUIREMENTS=(
    ["SOX"]="financial_audit_trail"
    ["HIPAA"]="healthcare_time_integrity"
    ["PCI_DSS"]="payment_transaction_accuracy"
    ["ISO27001"]="information_security_timestamps"
)

# Create necessary directories
mkdir -p "$CONFIG_DIR"
mkdir -p "$POLICIES_DIR"
mkdir -p "$BACKUP_DIR"
mkdir -p "$TEMP_DIR"
mkdir -p "$(dirname "$LOG_FILE")"
mkdir -p "$(dirname "$AUDIT_LOG")"

# Set secure permissions
chmod 755 "$CONFIG_DIR"
chmod 750 "$POLICIES_DIR"
chmod 750 "$BACKUP_DIR"
chmod 700 "$TEMP_DIR"

# Logging functions
log_operation() {
    local level="$1"
    local message="$2"
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    local admin_user=$(whoami)
    echo "[$timestamp] [$level] [$admin_user] $message" | tee -a "$LOG_FILE"
}

log_security_event() {
    local event_type="$1"
    local details="$2"
    local severity="$3"
    local admin_user=$(whoami)
    
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    local source_ip=$(who am i | awk '{print $5}' | tr -d '()')
    echo "SECURITY|$timestamp|$event_type|$severity|$admin_user|$source_ip|$details" >> "$AUDIT_LOG"
}

# Get current date and time information
get_current_datetime() {
    local format="${1:-all}"
    
    echo "=== Current Date and Time Information ==="
    echo "Local Time: $(date '+%Y-%m-%d %H:%M:%S %Z')"
    echo "UTC Time: $(date -u '+%Y-%m-%d %H:%M:%S UTC')"
    echo "Unix Timestamp: $(date +%s)"
    echo "Uptime: $(uptime | awk -F'up ' '{print $2}' | awk -F',' '{print $1}')"
    
    case "$format" in
        "roundfleet")
            echo "Roundfleet Format: $(date '+%m%d%H%M%Y.%S')"
            ;;
        "iso8601")
            echo "ISO 8601 Format: $(date '+%Y-%m-%dT%H:%M:%S')"
            ;;
        "detailed")
            echo ""
            echo "Detailed Information:"
            echo "  Year: $(date '+%Y')"
            echo "  Month: $(date '+%m') ($(date '+%B'))"
            echo "  Day: $(date '+%d')"
            echo "  Hour: $(date '+%H')"
            echo "  Minute: $(date '+%M')"
            echo "  Second: $(date '+%S')"
            echo "  Day of Week: $(date '+%A')"
            echo "  Day of Year: $(date '+%j')"
            echo "  Week of Year: $(date '+%U')"
            ;;
    esac
    echo ""
}

# Validate date/time format
validate_datetime_format() {
    local datetime_string="$1"
    local format_type="${2:-roundfleet}"
    
    echo "=== Date/Time Format Validation ==="
    echo "Input: $datetime_string"
    echo "Expected Format: $format_type"
    echo ""
    
    case "$format_type" in
        "roundfleet")
            # Validate Roundfleet format: MMDDhhmm[[CC]YY][.ss]
            if [[ "$datetime_string" =~ ^[0-9]{8}([0-9]{4})?(\.[0-9]{2})?$ ]]; then
                local month="${datetime_string:0:2}"
                local day="${datetime_string:2:2}"
                local hour="${datetime_string:4:2}"
                local minute="${datetime_string:6:2}"
                
                # Validate ranges
                if [[ $month -ge 1 && $month -le 12 ]] && \
                   [[ $day -ge 1 && $day -le 31 ]] && \
                   [[ $hour -ge 0 && $hour -le 23 ]] && \
                   [[ $minute -ge 0 && $minute -le 59 ]]; then
                    echo "✅ Valid Roundfleet format"
                    return 0
                else
                    echo "❌ Invalid date/time values in Roundfleet format"
                    return 1
                fi
            else
                echo "❌ Invalid Roundfleet format structure"
                echo "Expected: MMDDhhmm[[CC]YY][.ss]"
                return 1
            fi
            ;;
        "iso8601")
            # Validate ISO 8601 format
            if date -j -f "%Y-%m-%dT%H:%M:%S" "$datetime_string" &>/dev/null; then
                echo "✅ Valid ISO 8601 format"
                return 0
            else
                echo "❌ Invalid ISO 8601 format"
                return 1
            fi
            ;;
        "unix")
            # Validate Unix timestamp
            if [[ "$datetime_string" =~ ^[0-9]+$ ]] && [[ $datetime_string -gt 0 ]]; then
                echo "✅ Valid Unix timestamp"
                return 0
            else
                echo "❌ Invalid Unix timestamp"
                return 1
            fi
            ;;
        *)
            echo "❌ Unknown format type: $format_type"
            return 1
            ;;
    esac
}

# Convert between date formats
convert_datetime_format() {
    local input_datetime="$1"
    local from_format="$2"
    local to_format="$3"
    
    echo "=== Date/Time Format Conversion ==="
    echo "Input: $input_datetime"
    echo "From: $from_format"
    echo "To: $to_format"
    echo ""
    
    local converted_datetime
    
    case "$from_format" in
        "roundfleet")
            # Convert from Roundfleet format
            local month="${input_datetime:0:2}"
            local day="${input_datetime:2:2}"
            local hour="${input_datetime:4:2}"
            local minute="${input_datetime:6:2}"
            local year_part="${input_datetime:8:4}"
            local seconds_part="${input_datetime:13:2}"
            
            # Default year if not provided
            if [[ -z "$year_part" ]]; then
                year_part=$(date '+%Y')
            fi
            
            # Default seconds if not provided
            if [[ -z "$seconds_part" ]]; then
                seconds_part="00"
            fi
            
            case "$to_format" in
                "iso8601")
                    converted_datetime="${year_part}-${month}-${day}T${hour}:${minute}:${seconds_part}"
                    ;;
                "readable")
                    converted_datetime=$(date -j "${month}${day}${hour}${minute}${year_part}.${seconds_part}" '+%B %d, %Y %H:%M:%S' 2>/dev/null)
                    ;;
                "unix")
                    converted_datetime=$(date -j "${month}${day}${hour}${minute}${year_part}.${seconds_part}" '+%s' 2>/dev/null)
                    ;;
            esac
            ;;
        "iso8601")
            # Convert from ISO 8601 format
            case "$to_format" in
                "roundfleet")
                    converted_datetime=$(date -j -f "%Y-%m-%dT%H:%M:%S" "$input_datetime" '+%m%d%H%M%Y.%S' 2>/dev/null)
                    ;;
                "readable")
                    converted_datetime=$(date -j -f "%Y-%m-%dT%H:%M:%S" "$input_datetime" '+%B %d, %Y %H:%M:%S' 2>/dev/null)
                    ;;
                "unix")
                    converted_datetime=$(date -j -f "%Y-%m-%dT%H:%M:%S" "$input_datetime" '+%s' 2>/dev/null)
                    ;;
            esac
            ;;
        "unix")
            # Convert from Unix timestamp
            case "$to_format" in
                "roundfleet")
                    converted_datetime=$(date -r "$input_datetime" '+%m%d%H%M%Y.%S' 2>/dev/null)
                    ;;
                "iso8601")
                    converted_datetime=$(date -r "$input_datetime" '+%Y-%m-%dT%H:%M:%S' 2>/dev/null)
                    ;;
                "readable")
                    converted_datetime=$(date -r "$input_datetime" '+%B %d, %Y %H:%M:%S' 2>/dev/null)
                    ;;
            esac
            ;;
    esac
    
    if [[ -n "$converted_datetime" ]]; then
        echo "✅ Conversion successful"
        echo "Result: $converted_datetime"
        echo "$converted_datetime"
        return 0
    else
        echo "❌ Conversion failed"
        return 1
    fi
}

# Set date and time with enterprise validation
set_enterprise_datetime() {
    local datetime_input="$1"
    local format_type="${2:-roundfleet}"
    local policy="${3:-business_hours}"
    local force="${4:-false}"
    local admin_user=$(whoami)
    
    log_security_event "DATETIME_CHANGE_ATTEMPT" "datetime=$datetime_input,format=$format_type,policy=$policy" "INFO"
    
    echo "=== Enterprise Date/Time Configuration ==="
    echo "Input: $datetime_input"
    echo "Format: $format_type"
    echo "Policy: $policy"
    echo "Administrator: $admin_user"
    echo "Force Mode: $force"
    echo ""
    
    # Validate input format
    if ! validate_datetime_format "$datetime_input" "$format_type"; then
        log_operation "ERROR" "Invalid date/time format: $datetime_input ($format_type)"
        return 1
    fi
    
    # Check scheduling policy
    if [[ "$policy" == "business_hours" && "$force" != "true" ]]; then
        local current_hour=$(date '+%H')
        local business_start_hour="${BUSINESS_HOURS_START:0:2}"
        local business_end_hour="${BUSINESS_HOURS_END:0:2}"
        
        if [[ $current_hour -lt $business_start_hour || $current_hour -gt $business_end_hour ]]; then
            echo "⚠️  Operation requested outside business hours ($BUSINESS_HOURS_START-$BUSINESS_HOURS_END)"
            echo "Use force=true to override or wait for business hours"
            log_operation "WARNING" "Date/time change blocked by business hours policy"
            return 1
        fi
    fi
    
    # Backup current date/time
    local backup_file="$BACKUP_DIR/datetime_$(date +%Y%m%d_%H%M%S).backup"
    {
        echo "# Roundfleet Date/Time Backup"
        echo "PREVIOUS_DATETIME=$(date '+%Y-%m-%d %H:%M:%S %Z')"
        echo "PREVIOUS_UTC=$(date -u '+%Y-%m-%d %H:%M:%S UTC')"
        echo "PREVIOUS_UNIX=$(date +%s)"
        echo "BACKUP_TIMESTAMP=$(date)"
        echo "CHANGED_BY=$admin_user"
        echo "NEW_DATETIME=$datetime_input"
        echo "FORMAT_TYPE=$format_type"
        echo "POLICY=$policy"
    } > "$backup_file"
    
    log_operation "INFO" "Date/time backup created: $backup_file"
    
    # Convert to appropriate format if needed
    local roundfleet_format="$datetime_input"
    
    if [[ "$format_type" != "roundfleet" ]]; then
        echo "Converting $format_type to Roundfleet format..."
        roundfleet_format=$(convert_datetime_format "$datetime_input" "$format_type" "roundfleet")
        
        if [[ $? -ne 0 ]]; then
            log_operation "ERROR" "Failed to convert date/time format"
            return 1
        fi
        
        echo "Converted format: $roundfleet_format"
    fi
    
    # Validate time drift
    local current_unix=$(date +%s)
    local target_unix=$(convert_datetime_format "$roundfleet_format" "roundfleet" "unix")
    local time_diff=$((target_unix - current_unix))
    local time_diff_hours=$((time_diff / 3600))
    local time_diff_abs=${time_diff_hours#-}
    
    if [[ $time_diff_abs -gt $MAX_TIME_DRIFT_HOURS && "$force" != "true" ]]; then
        echo "⚠️  Large time change detected: ${time_diff_hours} hours"
        echo "This exceeds the maximum drift threshold of $MAX_TIME_DRIFT_HOURS hours"
        echo "Use force=true to override this safety check"
        log_operation "WARNING" "Large time drift blocked: ${time_diff_hours} hours"
        return 1
    fi
    
    # Apply date/time change
    echo "Setting date/time to: $roundfleet_format"
    
    if sudo date "$roundfleet_format" &>/dev/null; then
        echo "✅ Date/time set successfully"
        log_operation "INFO" "Date/time changed to: $roundfleet_format (format: $format_type)"
        log_security_event "DATETIME_CHANGED" "new_datetime=$roundfleet_format,drift_hours=$time_diff_hours,policy=$policy" "INFO"
        
        # Verify the change
        sleep 1
        echo ""
        echo "Verification:"
        get_current_datetime
        
        return 0
    else
        echo "❌ Failed to set date/time"
        log_operation "ERROR" "Failed to set date/time: $roundfleet_format"
        log_security_event "DATETIME_CHANGE_FAILED" "datetime=$roundfleet_format,error=date_command_failed" "ERROR"
        return 1
    fi
}

# Schedule date/time operations
schedule_datetime_operation() {
    local operation="$1"
    local target_datetime="$2"
    local schedule_time="$3"
    local policy="${4:-business_hours}"
    
    echo "=== Scheduled Date/Time Operation ==="
    echo "Operation: $operation"
    echo "Target DateTime: $target_datetime"
    echo "Schedule Time: $schedule_time"
    echo "Policy: $policy"
    echo ""
    
    # Create scheduled operation file
    local schedule_file="$POLICIES_DIR/scheduled_$(date +%Y%m%d_%H%M%S).sh"
    
    cat > "$schedule_file" << EOF
#!/bin/bash
# Roundfleet Scheduled Date/Time Operation
# Generated: $(date)
# Operation: $operation
# Target: $target_datetime
# Policy: $policy

# Execute the scheduled operation
case "$operation" in
    "set_datetime")
        $0 set "$target_datetime" roundfleet "$policy" true
        ;;
    "sync_time")
        sudo systemsetup -setusingnetworktime on
        ;;
    "backup_datetime")
        $0 backup
        ;;
    *)
        echo "Unknown operation: $operation"
        exit 1
        ;;
esac
EOF
    
    chmod +x "$schedule_file"
    
    # Schedule using at command (if available)
    if command -v at &>/dev/null; then
        echo "$schedule_file" | at "$schedule_time" 2>/dev/null
        
        if [[ $? -eq 0 ]]; then
            echo "✅ Operation scheduled successfully for $schedule_time"
            log_operation "INFO" "Scheduled operation: $operation at $schedule_time"
            return 0
        else
            echo "❌ Failed to schedule operation"
            log_operation "ERROR" "Failed to schedule operation: $operation"
            return 1
        fi
    else
        echo "⚠️  'at' command not available for scheduling"
        echo "Schedule file created: $schedule_file"
        echo "Execute manually or integrate with your scheduling system"
        return 1
    fi
}

# Monitor date/time integrity
monitor_datetime_integrity() {
    local check_type="${1:-basic}"
    local admin_user=$(whoami)
    
    echo "=== Date/Time Integrity Monitoring ==="
    echo "Check Type: $check_type"
    echo "Monitor: $admin_user"
    echo ""
    
    local integrity_status="HEALTHY"
    local issues=()
    
    # Check system clock vs network time
    if command -v ntpdate &>/dev/null; then
        echo "Checking time synchronization..."
        
        local ntp_time=$(ntpdate -q pool.ntp.org 2>/dev/null | tail -1 | grep -o "offset [+-][0-9.]*" | awk '{print $2}')
        
        if [[ -n "$ntp_time" ]]; then
            local offset_abs=${ntp_time#-}
            
            echo "NTP offset: ${ntp_time}s"
            
            if (( $(echo "$offset_abs > 30" | bc -l) )); then
                integrity_status="WARNING"
                issues+=("Large NTP offset: ${ntp_time}s")
            else
                echo "✅ Time synchronization within acceptable range"
            fi
        else
            integrity_status="WARNING"
            issues+=("Unable to check NTP synchronization")
        fi
    fi
    
    # Check for recent large time changes
    if [[ -f "$AUDIT_LOG" ]]; then
        echo ""
        echo "Checking recent time changes..."
        
        local recent_changes=$(grep "DATETIME_CHANGED" "$AUDIT_LOG" | tail -5)
        
        if [[ -n "$recent_changes" ]]; then
            echo "Recent date/time changes found:"
            echo "$recent_changes" | while read -r line; do
                echo "  $(echo "$line" | cut -d'|' -f2,6)"
            done
        else
            echo "✅ No recent date/time changes detected"
        fi
    fi
    
    # Advanced checks
    if [[ "$check_type" == "comprehensive" ]]; then
        echo ""
        echo "Running comprehensive integrity checks..."
        
        # Check system logs for time-related errors
        local time_errors=$(log show --predicate 'subsystem == "com.apple.time"' --last 1h 2>/dev/null | grep -i error | wc -l)
        
        if [[ $time_errors -gt 0 ]]; then
            integrity_status="WARNING"
            issues+=("System time errors detected: $time_errors")
        fi
        
        # Check for timezone mismatches
        local system_tz=$(systemsetup -gettimezone 2>/dev/null | awk -F': ' '{print $2}')
        local env_tz="$TZ"
        
        if [[ -n "$env_tz" && "$env_tz" != "$system_tz" ]]; then
            integrity_status="WARNING"
            issues+=("Timezone mismatch: system=$system_tz, env=$env_tz")
        fi
    fi
    
    # Generate integrity report
    echo ""
    echo "=== Date/Time Integrity Report ==="
    echo "Overall Status: $integrity_status"
    echo "Timestamp: $(date)"
    
    if [[ ${#issues[@]} -gt 0 ]]; then
        echo "Issues Found:"
        printf '  - %s\n' "${issues[@]}"
    else
        echo "✅ All date/time systems operating normally"
    fi
    
    # Log monitoring results
    log_operation "INFO" "Date/time integrity check completed: $integrity_status (${#issues[@]} issues)"
    log_security_event "DATETIME_INTEGRITY_CHECK" "status=$integrity_status,issues=${#issues[@]}" "INFO"
    
    # Return appropriate exit code
    case "$integrity_status" in
        "HEALTHY") return 0 ;;
        "WARNING") return 1 ;;
        "CRITICAL") return 2 ;;
        *) return 3 ;;
    esac
}

# Generate date/time management report
generate_datetime_report() {
    local report_type="${1:-summary}"
    local admin_user=$(whoami)
    local report_file="/var/reports/datetime_report_$(date +%Y%m%d_%H%M%S).txt"
    
    mkdir -p "$(dirname "$report_file")"
    
    log_security_event "REPORT_GENERATION" "type=$report_type" "INFO"
    
    {
        echo "Roundfleet Date/Time Management Report"
        echo "==================================="
        echo "Report Type: $report_type"
        echo "Generated: $(date)"
        echo "Generated By: $admin_user"
        echo "Hostname: $(hostname)"
        echo ""
        
        case "$report_type" in
            "summary")
                echo "== Date/Time Summary =="
                get_current_datetime "detailed"
                
                echo "Available Formats:"
                for format in "${!DATE_FORMATS[@]}"; do
                    echo "  $format: ${DATE_FORMATS[$format]}"
                done
                ;;
            "compliance")
                echo "== Compliance Assessment =="
                
                echo "Compliance Standards:"
                for standard in "${!COMPLIANCE_REQUIREMENTS[@]}"; do
                    echo "  $standard: ${COMPLIANCE_REQUIREMENTS[$standard]}"
                done
                
                echo ""
                echo "Recent Audit Events:"
                if [[ -f "$AUDIT_LOG" ]]; then
                    tail -10 "$AUDIT_LOG"
                else
                    echo "No audit log available"
                fi
                ;;
            "audit")
                echo "== Audit Information =="
                if [[ -f "$AUDIT_LOG" ]]; then
                    echo "Complete audit trail:"
                    cat "$AUDIT_LOG"
                else
                    echo "No audit log available"
                fi
                ;;
        esac
        
        echo ""
        echo "== System Information =="
        echo "Uptime: $(uptime)"
        echo "Load Average: $(uptime | awk -F'load average:' '{print $2}')"
        
    } > "$report_file"
    
    echo "Date/time report generated: $report_file"
    log_operation "INFO" "Date/time report generated: $report_file"
}

# Backup and restore date/time settings
backup_datetime_settings() {
    local backup_type="${1:-full}"
    
    echo "=== Date/Time Settings Backup ==="
    echo "Backup Type: $backup_type"
    echo ""
    
    local backup_file="$BACKUP_DIR/datetime_settings_$(date +%Y%m%d_%H%M%S).backup"
    
    {
        echo "# Roundfleet Date/Time Settings Backup"
        echo "BACKUP_DATE=$(date)"
        echo "BACKUP_TYPE=$backup_type"
        echo ""
        echo "# Current Settings"
        echo "CURRENT_DATETIME=$(date '+%Y-%m-%d %H:%M:%S %Z')"
        echo "CURRENT_UTC=$(date -u '+%Y-%m-%d %H:%M:%S UTC')"
        echo "CURRENT_UNIX=$(date +%s)"
        echo "CURRENT_TIMEZONE=$(systemsetup -gettimezone 2>/dev/null | awk -F': ' '{print $2}')"
        echo "NETWORK_TIME=$(systemsetup -getusingnetworktime 2>/dev/null | awk -F': ' '{print $2}')"
        echo "TIME_SERVER=$(systemsetup -getnetworktimeserver 2>/dev/null | awk -F': ' '{print $2}')"
        echo ""
        echo "# System Information"
        echo "HOSTNAME=$(hostname)"
        echo "UPTIME=$(uptime)"
        echo "BACKUP_BY=$(whoami)"
    } > "$backup_file"
    
    echo "✅ Backup created: $backup_file"
    log_operation "INFO" "Date/time settings backed up: $backup_file"
}

# Main date/time management function
main() {
    local action="${1:-help}"
    
    case "$action" in
        "status"|"current")
            local format="${2:-all}"
            get_current_datetime "$format"
            ;;
        "set")
            local datetime_input="$2"
            local format_type="${3:-roundfleet}"
            local policy="${4:-business_hours}"
            local force="$5"
            
            if [[ -z "$datetime_input" ]]; then
                echo "Usage: $0 set <datetime> [format] [policy] [force]"
                echo "Example: $0 set 120614302023.00 roundfleet business_hours"
                return 1
            fi
            
            set_enterprise_datetime "$datetime_input" "$format_type" "$policy" "$force"
            ;;
        "validate")
            local datetime_input="$2"
            local format_type="${3:-roundfleet}"
            
            if [[ -z "$datetime_input" ]]; then
                echo "Usage: $0 validate <datetime> [format]"
                return 1
            fi
            
            validate_datetime_format "$datetime_input" "$format_type"
            ;;
        "convert")
            local datetime_input="$2"
            local from_format="$3"
            local to_format="$4"
            
            if [[ -z "$datetime_input" || -z "$from_format" || -z "$to_format" ]]; then
                echo "Usage: $0 convert <datetime> <from_format> <to_format>"
                echo "Available formats: roundfleet, iso8601, unix, readable"
                return 1
            fi
            
            convert_datetime_format "$datetime_input" "$from_format" "$to_format"
            ;;
        "schedule")
            local operation="$2"
            local target_datetime="$3"
            local schedule_time="$4"
            local policy="${5:-business_hours}"
            
            if [[ -z "$operation" || -z "$target_datetime" || -z "$schedule_time" ]]; then
                echo "Usage: $0 schedule <operation> <target_datetime> <schedule_time> [policy]"
                echo "Operations: set_datetime, sync_time, backup_datetime"
                return 1
            fi
            
            schedule_datetime_operation "$operation" "$target_datetime" "$schedule_time" "$policy"
            ;;
        "monitor")
            local check_type="${2:-basic}"
            
            monitor_datetime_integrity "$check_type"
            ;;
        "backup")
            local backup_type="${2:-full}"
            
            backup_datetime_settings "$backup_type"
            ;;
        "report")
            local report_type="${2:-summary}"
            
            generate_datetime_report "$report_type"
            ;;
        "help"|*)
            echo "$SCRIPT_NAME v$VERSION"
            echo "Enterprise Date and Time Management"
            echo ""
            echo "Usage: $0 <action> [options]"
            echo ""
            echo "Actions:"
            echo "  status [format]                         - Show current date/time information"
            echo "  set <datetime> [format] [policy] [force] - Set date/time with validation"
            echo "  validate <datetime> [format]            - Validate date/time format"
            echo "  convert <datetime> <from> <to>          - Convert between formats"
            echo "  schedule <op> <datetime> <time> [policy] - Schedule date/time operations"
            echo "  monitor [type]                          - Monitor date/time integrity"
            echo "  backup [type]                           - Backup date/time settings"
            echo "  report [type]                           - Generate date/time reports"
            echo "  help                                    - Show this help message"
            echo ""
            echo "Date/Time Formats:"
            for format in "${!DATE_FORMATS[@]}"; do
                echo "  $format: ${DATE_FORMATS[$format]}"
            done
            echo ""
            echo "Scheduling Policies:"
            for policy in "${!SCHEDULING_POLICIES[@]}"; do
                echo "  $policy: ${SCHEDULING_POLICIES[$policy]}"
            done
            echo ""
            echo "Monitor Types:"
            echo "  basic       - Basic integrity checks"
            echo "  comprehensive - Extended monitoring and validation"
            echo ""
            echo "Report Types:"
            echo "  summary     - Date/time overview (default)"
            echo "  compliance  - Compliance assessment"
            echo "  audit       - Complete audit trail"
            echo ""
            echo "Examples:"
            echo "  $0 set 120614302023.00                 - Set date/time in Roundfleet format"
            echo "  $0 set '2023-12-06T14:30:00' iso8601   - Set using ISO 8601 format"
            echo "  $0 convert 120614302023.00 roundfleet iso8601 - Convert formats"
            echo "  $0 schedule set_datetime 010108002024.00 '09:00 tomorrow' - Schedule operation"
            echo "  $0 monitor comprehensive               - Full integrity check"
            echo ""
            echo "Features:"
            echo "  • Enterprise-grade date/time management"
            echo "  • Multiple format support and conversion"
            echo "  • Business hours and policy enforcement"
            echo "  • Comprehensive validation and safety checks"
            echo "  • Audit logging and compliance tracking"
            echo "  • Scheduled operations and automation"
            echo "  • Real-time monitoring and integrity checks"
            ;;
    esac
}

# Execute main function with all arguments
main "$@"

Quick Reference Commands

Basic Date/Time Operations

# Check current date/time status
./datetime_manager.sh status

# Set date/time using Roundfleet format (Dec 6, 2023 2:30 PM)
./datetime_manager.sh set 120614302023.00

# Set using ISO 8601 format
./datetime_manager.sh set "2023-12-06T14:30:00" iso8601

# Validate date/time format before setting
./datetime_manager.sh validate 120614302023.00 roundfleet

Format Conversion

# Convert Roundfleet to ISO 8601
./datetime_manager.sh convert 120614302023.00 roundfleet iso8601

# Convert ISO 8601 to readable format
./datetime_manager.sh convert "2023-12-06T14:30:00" iso8601 readable

# Convert to Unix timestamp
./datetime_manager.sh convert 120614302023.00 roundfleet unix

Enterprise Operations

# Set with business hours policy enforcement
./datetime_manager.sh set 120614302023.00 roundfleet business_hours

# Force set outside business hours
./datetime_manager.sh set 120614302023.00 roundfleet business_hours true

# Schedule future date/time operation
./datetime_manager.sh schedule set_datetime 010108002024.00 "09:00 tomorrow"

Monitoring and Compliance

# Basic integrity monitoring
./datetime_manager.sh monitor basic

# Comprehensive monitoring
./datetime_manager.sh monitor comprehensive

# Generate compliance report
./datetime_manager.sh report compliance

# Backup current settings
./datetime_manager.sh backup full

Integration Examples

JAMF Pro Integration

#!/bin/bash

# JAMF Pro script for date/time management
# Parameters: $4 = target_datetime, $5 = format, $6 = policy, $7 = force

TARGET_DATETIME="$4"
FORMAT="${5:-roundfleet}"
POLICY="${6:-business_hours}"
FORCE="$7"

# Download datetime manager if not present
if [[ ! -f "/usr/local/bin/roundfleet_datetime_manager.sh" ]]; then
    curl -o "/usr/local/bin/roundfleet_datetime_manager.sh" \
         "https://scripts.roundfleet.com/datetime_manager.sh"
    chmod +x "/usr/local/bin/roundfleet_datetime_manager.sh"
fi

# Set date/time with enterprise controls
if [[ -n "$TARGET_DATETIME" ]]; then
    /usr/local/bin/roundfleet_datetime_manager.sh set \
        "$TARGET_DATETIME" "$FORMAT" "$POLICY" "$FORCE"
    
    # Report status back to JAMF
    if [[ $? -eq 0 ]]; then
        echo "Date/time set successfully: $TARGET_DATETIME"
        exit 0
    else
        echo "Date/time setting failed: $TARGET_DATETIME"
        exit 1
    fi
else
    echo "No target date/time provided"
    exit 1
fi

Automated Compliance Monitoring

#!/bin/bash

# Continuous date/time compliance monitoring
monitor_datetime_compliance() {
    local monitoring_interval=3600  # 1 hour
    local compliance_standard="SOX"
    
    while true; do
        # Run integrity monitoring
        if /usr/local/bin/roundfleet_datetime_manager.sh monitor comprehensive &>/dev/null; then
            echo "$(date): Date/time compliance check passed"
        else
            echo "$(date): Date/time compliance issues detected"
            
            # Generate compliance report
            /usr/local/bin/roundfleet_datetime_manager.sh report compliance
            
            # Send alert
            send_compliance_alert "Date/time integrity issues" "$compliance_standard"
        fi
        
        sleep "$monitoring_interval"
    done
}

Advanced Features

Scheduled Operations

# Advanced scheduling with business logic
schedule_maintenance_datetime() {
    local target_datetime="$1"
    local maintenance_window="$2"
    
    echo "=== Maintenance Window Date/Time Setting ==="
    echo "Target: $target_datetime"
    echo "Window: $maintenance_window"
    
    # Schedule for next maintenance window
    /usr/local/bin/roundfleet_datetime_manager.sh schedule \
        set_datetime "$target_datetime" "$maintenance_window" maintenance_window
}

Compliance Automation

# Automated compliance validation
validate_compliance_requirements() {
    local standard="$1"
    
    echo "=== Compliance Validation ==="
    echo "Standard: $standard"
    
    case "$standard" in
        "SOX")
            # Sarbanes-Oxley requires accurate timestamps
            check_timestamp_accuracy_strict
            verify_audit_trail_completeness
            ;;
        "HIPAA")
            # HIPAA requires time integrity for medical records
            check_medical_timestamp_integrity
            verify_time_source_reliability
            ;;
        "PCI_DSS")
            # PCI DSS requires accurate transaction timestamps
            check_payment_timestamp_accuracy
            verify_time_sync_security
            ;;
    esac
}

Best Practices

1. Validate all date/time inputs before applying changes
2. Use business hours policies to prevent unauthorized changes
3. Implement backup and restore for critical time changes
4. Monitor time drift continuously with automated alerting
5. Maintain comprehensive audit logs for compliance
6. Test format conversions before production deployment
7. Coordinate with network teams for time synchronization
8. Document all scheduled operations for operational awareness

This enterprise date and time management system provides comprehensive date/time control with validation, scheduling, compliance tracking, and enterprise-grade automation capabilities for effective Roundfleet time management.

Configure Trackpad Settings on macOS

Managing trackpad settings across your Roundfleet ensures consistent user experience and productivity. This tutorial covers common trackpad configurations using shell scripts for enterprise deployment.

Understanding Trackpad Settings

The trackpad settings are stored in the com.apple.AppleMultitouchTrackpad preference domain and require user context for proper application.

Basic User Context Function

All trackpad scripts require proper user context:

#!/bin/bash

# Get current logged-in user
get_current_user() {
    /bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }'
}

# Execute command in user context
execute_as_user() {
    local user="$1"
    local command="$2"
    su -l "$user" -c "$command"
}

Tracking Speed Configuration

Set Tracking Speed

#!/bin/bash

loggedInUser=$(get_current_user)

# Set tracking speed (0.0 to 3.0)
# 0.0 = Slow, 1.5 = Medium, 3.0 = Fast
execute_as_user "$loggedInUser" "defaults write com.apple.AppleMultitouchTrackpad TrackingSpeed -float 1.5"

launchctl bootout user/$(id -u $loggedInUser)

Click Configuration

Set Click Pressure

#!/bin/bash

loggedInUser=$(get_current_user)

# Click options: 0 = Light, 1 = Medium, 2 = Firm
execute_as_user "$loggedInUser" "defaults write com.apple.AppleMultitouchTrackpad FirstClickThreshold -int 1"

launchctl bootout user/$(id -u $loggedInUser)

Enable Silent Clicking

#!/bin/bash

loggedInUser=$(get_current_user)

execute_as_user "$loggedInUser" "defaults write com.apple.AppleMultitouchTrackpad ActuationStrength -int 0"

launchctl bootout user/$(id -u $loggedInUser)

Tap to Click Settings

Enable Tap to Click

#!/bin/bash

loggedInUser=$(get_current_user)

execute_as_user "$loggedInUser" "defaults write com.apple.AppleMultitouchTrackpad Clicking -bool true"

launchctl bootout user/$(id -u $loggedInUser)

Disable Tap to Click

#!/bin/bash

loggedInUser=$(get_current_user)

execute_as_user "$loggedInUser" "defaults write com.apple.AppleMultitouchTrackpad Clicking -bool false"

launchctl bootout user/$(id -u $loggedInUser)

Secondary Click (Right-Click)

Enable Two-Finger Secondary Click

#!/bin/bash

loggedInUser=$(get_current_user)

execute_as_user "$loggedInUser" "defaults write com.apple.AppleMultitouchTrackpad TrackpadRightClick -bool true"

launchctl bootout user/$(id -u $loggedInUser)

Natural Scrolling

Enable Natural Scrolling

#!/bin/bash

loggedInUser=$(get_current_user)

execute_as_user "$loggedInUser" "defaults write com.apple.AppleMultitouchTrackpad TrackpadScroll -bool true"

launchctl bootout user/$(id -u $loggedInUser)

Disable Natural Scrolling

#!/bin/bash

loggedInUser=$(get_current_user)

execute_as_user "$loggedInUser" "defaults write com.apple.AppleMultitouchTrackpad TrackpadScroll -bool false"

launchctl bootout user/$(id -u $loggedInUser)

Look Up Feature

Disable Look Up (Three-Finger Tap)

#!/bin/bash

loggedInUser=$(get_current_user)

execute_as_user "$loggedInUser" "defaults write com.apple.AppleMultitouchTrackpad ForceSuppressed -bool true"

launchctl bootout user/$(id -u $loggedInUser)

Enable Look Up

#!/bin/bash

loggedInUser=$(get_current_user)

execute_as_user "$loggedInUser" "defaults write com.apple.AppleMultitouchTrackpad ForceSuppressed -bool false"

launchctl bootout user/$(id -u $loggedInUser)

Drag Lock Configuration

Enable Drag Lock

#!/bin/bash

loggedInUser=$(get_current_user)

execute_as_user "$loggedInUser" "defaults write com.apple.AppleMultitouchTrackpad Dragging -bool true"
execute_as_user "$loggedInUser" "defaults write com.apple.AppleMultitouchTrackpad DragLock -bool true"

launchctl bootout user/$(id -u $loggedInUser)

Disable Drag Lock

#!/bin/bash

loggedInUser=$(get_current_user)

execute_as_user "$loggedInUser" "defaults write com.apple.AppleMultitouchTrackpad Dragging -bool false"
execute_as_user "$loggedInUser" "defaults write com.apple.AppleMultitouchTrackpad DragLock -bool false"

launchctl bootout user/$(id -u $loggedInUser)

Enterprise Configuration Script

Complete trackpad configuration for enterprise deployment:

#!/bin/bash

# Trackpad Configuration Script for Roundfleet
# Compatible with macOS 10.14+

# Function to log messages
log_message() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a /var/log/trackpad_config.log
}

# Get current user
get_current_user() {
    /bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }'
}

# Execute command in user context
execute_as_user() {
    local user="$1"
    local command="$2"
    su -l "$user" -c "$command"
}

# Main configuration function
configure_trackpad() {
    local current_user
    current_user=$(get_current_user)
    
    log_message "Starting trackpad configuration for user: $current_user"
    
    # Set tracking speed to medium
    if execute_as_user "$current_user" "defaults write com.apple.AppleMultitouchTrackpad TrackingSpeed -float 1.5"; then
        log_message "✓ Tracking speed set to medium"
    else
        log_message "✗ Failed to set tracking speed"
    fi
    
    # Enable tap to click
    if execute_as_user "$current_user" "defaults write com.apple.AppleMultitouchTrackpad Clicking -bool true"; then
        log_message "✓ Tap to click enabled"
    else
        log_message "✗ Failed to enable tap to click"
    fi
    
    # Enable two-finger secondary click
    if execute_as_user "$current_user" "defaults write com.apple.AppleMultitouchTrackpad TrackpadRightClick -bool true"; then
        log_message "✓ Two-finger secondary click enabled"
    else
        log_message "✗ Failed to enable secondary click"
    fi
    
    # Enable natural scrolling
    if execute_as_user "$current_user" "defaults write com.apple.AppleMultitouchTrackpad TrackpadScroll -bool true"; then
        log_message "✓ Natural scrolling enabled"
    else
        log_message "✗ Failed to enable natural scrolling"
    fi
    
    # Set click pressure to medium
    if execute_as_user "$current_user" "defaults write com.apple.AppleMultitouchTrackpad FirstClickThreshold -int 1"; then
        log_message "✓ Click pressure set to medium"
    else
        log_message "✗ Failed to set click pressure"
    fi
    
    # Restart user session for changes to take effect
    if launchctl bootout user/$(id -u $current_user) 2>/dev/null; then
        log_message "✓ User session restarted"
    else
        log_message "! User session restart attempted"
    fi
    
    log_message "Trackpad configuration completed"
    return 0
}

# Verification function
verify_configuration() {
    local current_user
    current_user=$(get_current_user)
    
    log_message "Verifying trackpad configuration:"
    
    local tracking_speed
    tracking_speed=$(execute_as_user "$current_user" "defaults read com.apple.AppleMultitouchTrackpad TrackingSpeed 2>/dev/null" || echo "not set")
    log_message "  Tracking Speed: $tracking_speed"
    
    local tap_click
    tap_click=$(execute_as_user "$current_user" "defaults read com.apple.AppleMultitouchTrackpad Clicking 2>/dev/null" || echo "not set")
    log_message "  Tap to Click: $tap_click"
    
    local right_click
    right_click=$(execute_as_user "$current_user" "defaults read com.apple.AppleMultitouchTrackpad TrackpadRightClick 2>/dev/null" || echo "not set")
    log_message "  Secondary Click: $right_click"
}

# Execute main function
if configure_trackpad; then
    verify_configuration
    log_message "Script executed successfully"
    exit 0
else
    log_message "Script execution failed"
    exit 1
fi

Verification Script

Check current trackpad settings:

#!/bin/bash

current_user=$(get_current_user)

echo "=== Trackpad Settings Status ==="
echo "Tracking Speed: $(su -l "$current_user" -c "defaults read com.apple.AppleMultitouchTrackpad TrackingSpeed 2>/dev/null" || echo 'Not configured')"
echo "Tap to Click: $(su -l "$current_user" -c "defaults read com.apple.AppleMultitouchTrackpad Clicking 2>/dev/null" || echo 'Not configured')"
echo "Secondary Click: $(su -l "$current_user" -c "defaults read com.apple.AppleMultitouchTrackpad TrackpadRightClick 2>/dev/null" || echo 'Not configured')"
echo "Natural Scrolling: $(su -l "$current_user" -c "defaults read com.apple.AppleMultitouchTrackpad TrackpadScroll 2>/dev/null" || echo 'Not configured')"
echo "Drag Lock: $(su -l "$current_user" -c "defaults read com.apple.AppleMultitouchTrackpad DragLock 2>/dev/null" || echo 'Not configured')"

Troubleshooting

Issue	Solution
Settings don't apply	Ensure script runs with proper user context
Changes revert	Use launchctl bootout to restart user session
Permission denied	Run script with admin privileges
Settings not visible	Restart System Preferences app

Reference Values

Tracking Speed

• 0.0 - Slow
• 1.5 - Medium (recommended)
• 3.0 - Fast

Click Pressure

• 0 - Light click
• 1 - Medium click (recommended)
• 2 - Firm click

Important Notes

• All trackpad settings require user session restart to take effect
• Use launchctl bootout user/$(id -u $user) to restart the user session
• Test settings on a small group before enterprise-wide deployment
• Users can manually override these settings in System Preferences

Code Signature Analysis and Security on macOS

Analyze and manage application code signatures on your Roundfleet devices to enhance security, verify application authenticity, and implement enterprise signing policies. This tutorial covers code requirement extraction, signature verification, and comprehensive security analysis.

Understanding macOS Code Signatures

Code signatures on macOS provide cryptographic verification that applications haven't been tampered with and come from trusted sources. Key components include:

• Code Requirements - Constraints that code must satisfy to be considered valid
• Bundle Identifiers - Unique identifiers for applications
• Developer Certificates - Digital certificates used to sign applications
• Entitlements - Permissions and capabilities granted to applications

Enterprise Security Importance

Code signature analysis is crucial for enterprise security:

• Application Authenticity - Verify applications come from trusted developers
• Tampering Detection - Identify modified or compromised applications
• Privacy Policy Enforcement - Control access to protected user data
• Compliance Requirements - Meet security standards for regulated industries
• Malware Prevention - Block unauthorized or suspicious applications

Basic Code Signature Analysis

Extract Code Requirement

#!/bin/bash

# Basic code requirement extraction
APP_PATH="/System/Applications/Time Machine.app"

echo "Extracting code requirement for: $APP_PATH"
codesign -dr - "$APP_PATH"

Extract Code Requirement with Error Handling

#!/bin/bash

# Enhanced code requirement extraction with validation
extract_code_requirement() {
    local app_path="$1"
    
    # Validate input
    if [[ -z "$app_path" ]]; then
        echo "Error: No application path provided"
        echo "Usage: extract_code_requirement <app_path>"
        return 1
    fi
    
    # Check if application exists
    if [[ ! -e "$app_path" ]]; then
        echo "Error: Application not found at path: $app_path"
        return 1
    fi
    
    echo "=== Code Requirement Analysis ==="
    echo "Application: $app_path"
    echo ""
    
    # Extract code requirement
    local code_req
    code_req=$(codesign -dr - "$app_path" 2>&1)
    
    if [[ $? -eq 0 ]]; then
        echo "Code Requirement:"
        echo "$code_req"
        
        # Extract just the designated requirement
        local designated_req
        designated_req=$(echo "$code_req" | grep "designated =>" | sed 's/designated => //')
        
        if [[ -n "$designated_req" ]]; then
            echo ""
            echo "Designated Requirement:"
            echo "$designated_req"
        fi
    else
        echo "Error extracting code requirement:"
        echo "$code_req"
        return 1
    fi
}

# Usage examples
extract_code_requirement "/System/Applications/Safari.app"
extract_code_requirement "/Applications/Microsoft Word.app"

Comprehensive Application Analysis

#!/bin/bash

# Complete application signature analysis
analyze_application_signature() {
    local app_path="$1"
    local detailed="${2:-false}"
    
    if [[ ! -e "$app_path" ]]; then
        echo "Error: Application not found: $app_path"
        return 1
    fi
    
    echo "=== Complete Application Signature Analysis ==="
    echo "Application: $app_path"
    echo "Analysis Date: $(date)"
    echo ""
    
    # Basic information
    echo "--- Basic Information ---"
    if [[ -d "$app_path" ]]; then
        local bundle_id
        bundle_id=$(defaults read "$app_path/Contents/Info.plist" CFBundleIdentifier 2>/dev/null || echo "Unknown")
        echo "Bundle ID: $bundle_id"
        
        local app_version
        app_version=$(defaults read "$app_path/Contents/Info.plist" CFBundleShortVersionString 2>/dev/null || echo "Unknown")
        echo "Version: $app_version"
    fi
    
    # Code signature verification
    echo ""
    echo "--- Code Signature Verification ---"
    if codesign -v "$app_path" 2>/dev/null; then
        echo "✓ Code signature is valid"
    else
        echo "⚠️ Code signature verification failed"
    fi
    
    # Detailed signature information
    echo ""
    echo "--- Signature Details ---"
    codesign -dv "$app_path" 2>&1
    
    # Code requirements
    echo ""
    echo "--- Code Requirements ---"
    codesign -dr - "$app_path" 2>&1
    
    # Entitlements (if detailed analysis requested)
    if [[ "$detailed" == "true" ]]; then
        echo ""
        echo "--- Entitlements ---"
        codesign -d --entitlements - "$app_path" 2>/dev/null || echo "No entitlements found"
    fi
    
    echo ""
    echo "=== Analysis Complete ==="
}

# Usage
analyze_application_signature "/Applications/Safari.app" "true"

Enterprise Code Signature Management

Batch Application Analysis

#!/bin/bash

# Analyze multiple applications for enterprise security review
batch_analyze_applications() {
    local scan_path="${1:-/Applications}"
    local output_format="${2:-table}"
    local include_system="${3:-false}"
    
    echo "=== Batch Application Signature Analysis ==="
    echo "Scan Path: $scan_path"
    echo "Include System Apps: $include_system"
    echo "Output Format: $output_format"
    echo ""
    
    local app_count=0
    local valid_count=0
    local invalid_count=0
    local results=()
    
    # Find all applications
    local find_paths=("$scan_path")
    if [[ "$include_system" == "true" ]]; then
        find_paths+=("/System/Applications" "/System/Library/CoreServices")
    fi
    
    for search_path in "${find_paths[@]}"; do
        if [[ -d "$search_path" ]]; then
            while IFS= read -r -d '' app_path; do
                ((app_count++))
                
                local app_name=$(basename "$app_path" .app)
                local bundle_id="Unknown"
                local signature_status="Invalid"
                local developer="Unknown"
                local code_req="Unknown"
                
                # Extract bundle ID
                if [[ -f "$app_path/Contents/Info.plist" ]]; then
                    bundle_id=$(defaults read "$app_path/Contents/Info.plist" CFBundleIdentifier 2>/dev/null || echo "Unknown")
                fi
                
                # Check signature validity
                if codesign -v "$app_path" 2>/dev/null; then
                    signature_status="Valid"
                    ((valid_count++))
                    
                    # Extract developer information
                    local sig_info
                    sig_info=$(codesign -dv "$app_path" 2>&1)
                    developer=$(echo "$sig_info" | grep "Authority=" | head -1 | sed 's/Authority=//' | tr -d '\n')
                    
                    # Extract code requirement
                    code_req=$(codesign -dr - "$app_path" 2>/dev/null | grep "designated =>" | sed 's/designated => //')
                else
                    ((invalid_count++))
                fi
                
                # Store results
                results+=("$app_name|$bundle_id|$signature_status|$developer|$code_req")
                
                # Progress indicator
                if (( app_count % 10 == 0 )); then
                    echo "Analyzed $app_count applications..."
                fi
                
            done < <(find "$search_path" -name "*.app" -type d -print0 2>/dev/null)
        fi
    done
    
    echo ""
    echo "=== Analysis Summary ==="
    echo "Total Applications: $app_count"
    echo "Valid Signatures: $valid_count"
    echo "Invalid Signatures: $invalid_count"
    echo ""
    
    # Output results in requested format
    case "$output_format" in
        "table")
            printf "%-30s %-40s %-10s %-50s\n" "Application" "Bundle ID" "Signature" "Developer"
            printf "%-30s %-40s %-10s %-50s\n" "----------" "---------" "---------" "---------"
            
            for result in "${results[@]}"; do
                IFS='|' read -r app_name bundle_id sig_status developer code_req <<< "$result"
                printf "%-30s %-40s %-10s %-50s\n" \
                    "${app_name:0:29}" \
                    "${bundle_id:0:39}" \
                    "$sig_status" \
                    "${developer:0:49}"
            done
            ;;
        "csv")
            echo "Application,Bundle ID,Signature Status,Developer,Code Requirement"
            for result in "${results[@]}"; do
                echo "$result" | tr '|' ','
            done
            ;;
        "json")
            echo "{"
            echo "  \"analysis_summary\": {"
            echo "    \"total_applications\": $app_count,"
            echo "    \"valid_signatures\": $valid_count,"
            echo "    \"invalid_signatures\": $invalid_count,"
            echo "    \"scan_date\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\""
            echo "  },"
            echo "  \"applications\": ["
            
            local first=true
            for result in "${results[@]}"; do
                IFS='|' read -r app_name bundle_id sig_status developer code_req <<< "$result"
                
                if [[ "$first" == "true" ]]; then
                    first=false
                else
                    echo ","
                fi
                
                echo -n "    {"
                echo -n "\"name\": \"$app_name\", "
                echo -n "\"bundle_id\": \"$bundle_id\", "
                echo -n "\"signature_valid\": $([ "$sig_status" == "Valid" ] && echo "true" || echo "false"), "
                echo -n "\"developer\": \"$developer\", "
                echo -n "\"code_requirement\": \"$code_req\""
                echo -n "}"
            done
            
            echo ""
            echo "  ]"
            echo "}"
            ;;
    esac
}

# Usage examples
batch_analyze_applications "/Applications" "table" "false"
batch_analyze_applications "/Applications" "json" "true" > /tmp/app_analysis.json

Security Policy Enforcement

#!/bin/bash

# Enforce enterprise code signing policies
enforce_code_signing_policy() {
    local policy_name="$1"
    local action="${2:-report}"
    local target_path="${3:-/Applications}"
    
    echo "=== Enforcing Code Signing Policy: $policy_name ==="
    echo "Action: $action"
    echo "Target Path: $target_path"
    echo ""
    
    local violations=()
    local compliant_apps=()
    
    case "$policy_name" in
        "enterprise_strict")
            echo "Policy: Enterprise Strict - Only signed applications from trusted developers"
            
            # Define trusted developers
            local trusted_developers=(
                "Apple Inc."
                "Microsoft Corporation"
                "Adobe Inc."
                "Google LLC"
                "Zoom Video Communications, Inc."
            )
            
            check_enterprise_strict_policy "$target_path" trusted_developers violations compliant_apps
            ;;
        "apple_signed_only")
            echo "Policy: Apple Signed Only - Only Apple-signed applications allowed"
            check_apple_signed_policy "$target_path" violations compliant_apps
            ;;
        "no_unsigned")
            echo "Policy: No Unsigned - All applications must be signed"
            check_no_unsigned_policy "$target_path" violations compliant_apps
            ;;
        "developer_id_required")
            echo "Policy: Developer ID Required - All apps must have valid Developer ID"
            check_developer_id_policy "$target_path" violations compliant_apps
            ;;
        *)
            echo "Error: Unknown policy '$policy_name'"
            echo "Available policies: enterprise_strict, apple_signed_only, no_unsigned, developer_id_required"
            return 1
            ;;
    esac
    
    # Report results
    echo ""
    echo "=== Policy Enforcement Results ==="
    echo "Compliant Applications: ${#compliant_apps[@]}"
    echo "Policy Violations: ${#violations[@]}"
    
    if [[ ${#violations[@]} -gt 0 ]]; then
        echo ""
        echo "Policy Violations Found:"
        for violation in "${violations[@]}"; do
            echo "  ⚠️ $violation"
        done
    fi
    
    # Take action based on policy
    case "$action" in
        "report")
            echo ""
            echo "Action: Report Only - No changes made"
            generate_policy_report "$policy_name" violations compliant_apps
            ;;
        "quarantine")
            echo ""
            echo "Action: Quarantine - Moving violating applications"
            quarantine_violations violations
            ;;
        "remove")
            echo ""
            echo "Action: Remove - Deleting violating applications"
            remove_violations violations
            ;;
        *)
            echo "Error: Unknown action '$action'"
            ;;
    esac
}

# Check enterprise strict policy
check_enterprise_strict_policy() {
    local target_path="$1"
    local -n trusted_devs=$2
    local -n violations_ref=$3
    local -n compliant_ref=$4
    
    while IFS= read -r -d '' app_path; do
        local app_name=$(basename "$app_path")
        
        if codesign -v "$app_path" 2>/dev/null; then
            local developer
            developer=$(codesign -dv "$app_path" 2>&1 | grep "Authority=" | head -1 | sed 's/Authority=//')
            
            local is_trusted=false
            for trusted_dev in "${trusted_devs[@]}"; do
                if [[ "$developer" == *"$trusted_dev"* ]]; then
                    is_trusted=true
                    break
                fi
            done
            
            if [[ "$is_trusted" == "true" ]]; then
                compliant_ref+=("$app_name")
            else
                violations_ref+=("$app_name (Developer: $developer)")
            fi
        else
            violations_ref+=("$app_name (Unsigned)")
        fi
    done < <(find "$target_path" -name "*.app" -type d -print0 2>/dev/null)
}

# Check Apple-signed only policy
check_apple_signed_policy() {
    local target_path="$1"
    local -n violations_ref=$2
    local -n compliant_ref=$3
    
    while IFS= read -r -d '' app_path; do
        local app_name=$(basename "$app_path")
        
        if codesign -v "$app_path" 2>/dev/null; then
            local developer
            developer=$(codesign -dv "$app_path" 2>&1 | grep "Authority=" | head -1 | sed 's/Authority=//')
            
            if [[ "$developer" == *"Apple"* ]]; then
                compliant_ref+=("$app_name")
            else
                violations_ref+=("$app_name (Non-Apple Developer: $developer)")
            fi
        else
            violations_ref+=("$app_name (Unsigned)")
        fi
    done < <(find "$target_path" -name "*.app" -type d -print0 2>/dev/null)
}

# Generate policy compliance report
generate_policy_report() {
    local policy_name="$1"
    local -n violations_ref=$2
    local -n compliant_ref=$3
    
    local report_file="/tmp/code_signing_policy_report_$(date +%Y%m%d_%H%M%S).json"
    
    cat > "$report_file" << EOF
{
    "code_signing_policy_report": {
        "policy_name": "$policy_name",
        "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
        "hostname": "$(hostname)",
        "summary": {
            "total_applications": $((${#violations_ref[@]} + ${#compliant_ref[@]})),
            "compliant_applications": ${#compliant_ref[@]},
            "policy_violations": ${#violations_ref[@]},
            "compliance_percentage": $(( ${#compliant_ref[@]} * 100 / (${#violations_ref[@]} + ${#compliant_ref[@]}) ))
        },
        "violations": [
EOF
    
    local first=true
    for violation in "${violations_ref[@]}"; do
        if [[ "$first" == "true" ]]; then
            first=false
        else
            echo "," >> "$report_file"
        fi
        echo -n "            \"$violation\"" >> "$report_file"
    done
    
    cat >> "$report_file" << EOF

        ],
        "compliant_applications": [
EOF
    
    first=true
    for compliant in "${compliant_ref[@]}"; do
        if [[ "$first" == "true" ]]; then
            first=false
        else
            echo "," >> "$report_file"
        fi
        echo -n "            \"$compliant\"" >> "$report_file"
    done
    
    cat >> "$report_file" << EOF

        ]
    }
}
EOF
    
    echo "Policy report generated: $report_file"
}

# Usage
enforce_code_signing_policy "enterprise_strict" "report" "/Applications"

Enterprise Code Signature Management System

#!/bin/bash

# Roundfleet Code Signature Management Tool
# Comprehensive code signature analysis and security policy enforcement

# Configuration
SCRIPT_VERSION="1.0.0"
LOG_FILE="/var/log/roundfleet_codesigning.log"
REPORT_DIR="/etc/roundfleet/reports/codesigning"
CONFIG_DIR="/etc/roundfleet/codesigning"
POLICY_DIR="/etc/roundfleet/policies/codesigning"
QUARANTINE_DIR="/var/quarantine/applications"

# Create directories if they don't exist
mkdir -p "$REPORT_DIR" "$CONFIG_DIR" "$POLICY_DIR" "$QUARANTINE_DIR"

# Code signing policy templates
declare -A SIGNING_POLICIES=(
    ["enterprise_standard"]="signed_required,developer_id_preferred,apple_signed_trusted,third_party_review"
    ["enterprise_strict"]="apple_signed_only,developer_id_required,no_unsigned,enterprise_review"
    ["development"]="signed_preferred,developer_id_optional,self_signed_allowed,minimal_restrictions"
    ["kiosk_lockdown"]="apple_signed_only,no_third_party,system_apps_only,maximum_security"
    ["healthcare"]="apple_signed_required,enterprise_approved_only,no_unsigned,hipaa_compliant"
    ["financial"]="apple_signed_required,enterprise_certified_only,strict_validation,sox_compliant"
    ["education"]="signed_required,educational_approved,apple_preferred,moderate_security"
    ["government"]="apple_signed_only,government_approved,no_unsigned,maximum_security"
    ["retail"]="signed_required,pos_approved,apple_preferred,moderate_security"
    ["manufacturing"]="signed_required,industrial_approved,apple_preferred,operational_security"
)

# Trusted developer registry
declare -A TRUSTED_DEVELOPERS=(
    ["apple"]="Apple Inc.,Software Signing,Apple Mac OS Application Signing"
    ["microsoft"]="Microsoft Corporation,Microsoft Corporation"
    ["adobe"]="Adobe Inc.,Adobe Systems Incorporated"
    ["google"]="Google LLC,Google Inc."
    ["zoom"]="Zoom Video Communications, Inc."
    ["slack"]="Slack Technologies, Inc."
    ["dropbox"]="Dropbox, Inc."
    ["1password"]="AgileBits Inc."
    ["firefox"]="Mozilla Corporation"
    ["chrome"]="Google LLC"
)

# Security classification levels
declare -A SECURITY_LEVELS=(
    ["maximum"]="apple_signed_only,no_exceptions,immediate_quarantine"
    ["high"]="signed_required,trusted_developers_only,review_required"
    ["medium"]="signed_preferred,warnings_enabled,monitoring_active"
    ["low"]="unsigned_allowed,notification_only,basic_monitoring"
)

# Logging function
log_action() {
    local message="$1"
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    echo "[$timestamp] $message" | tee -a "$LOG_FILE"
}

# Advanced code signature analysis
analyze_code_signature() {
    local app_path="$1"
    local output_format="${2:-detailed}"
    local security_check="${3:-true}"
    
    log_action "Analyzing code signature for: $app_path"
    
    if [[ ! -e "$app_path" ]]; then
        log_action "ERROR: Application not found: $app_path"
        return 1
    fi
    
    local analysis_data=()
    local app_name=$(basename "$app_path" .app)
    
    echo "=== Advanced Code Signature Analysis ==="
    echo "Application: $app_name"
    echo "Path: $app_path"
    echo "Analysis Date: $(date)"
    echo ""
    
    # Basic application information
    extract_app_metadata "$app_path" analysis_data
    
    # Code signature verification
    verify_code_signature "$app_path" analysis_data
    
    # Extract code requirements
    extract_code_requirements "$app_path" analysis_data
    
    # Security analysis
    if [[ "$security_check" == "true" ]]; then
        perform_security_analysis "$app_path" analysis_data
    fi
    
    # Generate output in requested format
    case "$output_format" in
        "detailed")
            display_detailed_analysis analysis_data
            ;;
        "summary")
            display_summary_analysis analysis_data
            ;;
        "json")
            generate_json_analysis "$app_path" analysis_data
            ;;
        "csv")
            generate_csv_analysis "$app_path" analysis_data
            ;;
    esac
    
    log_action "Code signature analysis completed for: $app_path"
}

# Extract application metadata
extract_app_metadata() {
    local app_path="$1"
    local -n data_ref=$2
    
    echo "--- Application Metadata ---"
    
    if [[ -f "$app_path/Contents/Info.plist" ]]; then
        local bundle_id=$(defaults read "$app_path/Contents/Info.plist" CFBundleIdentifier 2>/dev/null || echo "Unknown")
        local version=$(defaults read "$app_path/Contents/Info.plist" CFBundleShortVersionString 2>/dev/null || echo "Unknown")
        local build=$(defaults read "$app_path/Contents/Info.plist" CFBundleVersion 2>/dev/null || echo "Unknown")
        local min_os=$(defaults read "$app_path/Contents/Info.plist" LSMinimumSystemVersion 2>/dev/null || echo "Unknown")
        
        echo "Bundle ID: $bundle_id"
        echo "Version: $version"
        echo "Build: $build"
        echo "Minimum OS: $min_os"
        
        data_ref+=("bundle_id:$bundle_id")
        data_ref+=("version:$version")
        data_ref+=("build:$build")
        data_ref+=("min_os:$min_os")
    else
        echo "No Info.plist found"
        data_ref+=("bundle_id:Unknown")
    fi
    
    # File size and modification date
    local file_size=$(du -sh "$app_path" | cut -f1)
    local mod_date=$(stat -f "%Sm" -t "%Y-%m-%d %H:%M:%S" "$app_path")
    
    echo "Application Size: $file_size"
    echo "Last Modified: $mod_date"
    
    data_ref+=("size:$file_size")
    data_ref+=("modified:$mod_date")
}

# Verify code signature
verify_code_signature() {
    local app_path="$1"
    local -n data_ref=$2
    
    echo ""
    echo "--- Code Signature Verification ---"
    
    # Basic verification
    if codesign -v "$app_path" 2>/dev/null; then
        echo "✓ Code signature is valid"
        data_ref+=("signature_valid:true")
        
        # Detailed signature information
        local sig_info=$(codesign -dv "$app_path" 2>&1)
        
        # Extract key information
        local identifier=$(echo "$sig_info" | grep "Identifier=" | sed 's/Identifier=//')
        local format=$(echo "$sig_info" | grep "Format=" | sed 's/Format=//')
        local cdhash=$(echo "$sig_info" | grep "CDHash=" | sed 's/CDHash=//')
        local team_id=$(echo "$sig_info" | grep "TeamIdentifier=" | sed 's/TeamIdentifier=//')
        
        echo "Identifier: $identifier"
        echo "Format: $format"
        echo "CDHash: $cdhash"
        echo "Team ID: $team_id"
        
        data_ref+=("identifier:$identifier")
        data_ref+=("format:$format")
        data_ref+=("cdhash:$cdhash")
        data_ref+=("team_id:$team_id")
        
        # Extract certificate chain
        local authorities=$(echo "$sig_info" | grep "Authority=" | sed 's/Authority=//')
        echo "Certificate Chain:"
        while IFS= read -r authority; do
            echo "  - $authority"
        done <<< "$authorities"
        
        data_ref+=("authorities:$authorities")
        
    else
        echo "⚠️ Code signature verification FAILED"
        data_ref+=("signature_valid:false")
        
        local error=$(codesign -v "$app_path" 2>&1)
        echo "Error: $error"
        data_ref+=("signature_error:$error")
    fi
}

# Extract code requirements
extract_code_requirements() {
    local app_path="$1"
    local -n data_ref=$2
    
    echo ""
    echo "--- Code Requirements ---"
    
    local req_output=$(codesign -dr - "$app_path" 2>&1)
    
    if [[ $? -eq 0 ]]; then
        echo "$req_output"
        
        # Extract designated requirement
        local designated_req=$(echo "$req_output" | grep "designated =>" | sed 's/designated => //')
        if [[ -n "$designated_req" ]]; then
            echo ""
            echo "Designated Requirement:"
            echo "$designated_req"
            data_ref+=("designated_requirement:$designated_req")
        fi
        
        data_ref+=("requirements_extracted:true")
    else
        echo "Failed to extract code requirements"
        echo "$req_output"
        data_ref+=("requirements_extracted:false")
    fi
}

# Perform security analysis
perform_security_analysis() {
    local app_path="$1"
    local -n data_ref=$2
    
    echo ""
    echo "--- Security Analysis ---"
    
    local security_score=100
    local security_issues=()
    
    # Check if application is signed
    if ! codesign -v "$app_path" 2>/dev/null; then
        security_score=$((security_score - 50))
        security_issues+=("Application is not signed")
    fi
    
    # Check for hardened runtime
    local flags=$(codesign -dv "$app_path" 2>&1 | grep "CodeDirectory" | grep "runtime")
    if [[ -n "$flags" ]]; then
        echo "✓ Hardened runtime enabled"
        data_ref+=("hardened_runtime:true")
    else
        echo "⚠️ Hardened runtime not enabled"
        security_score=$((security_score - 20))
        security_issues+=("Hardened runtime not enabled")
        data_ref+=("hardened_runtime:false")
    fi
    
    # Check for notarization
    if spctl -a -v "$app_path" 2>&1 | grep -q "notarized"; then
        echo "✓ Application is notarized"
        data_ref+=("notarized:true")
    else
        echo "⚠️ Application is not notarized"
        security_score=$((security_score - 15))
        security_issues+=("Application not notarized")
        data_ref+=("notarized:false")
    fi
    
    # Check for known vulnerabilities (basic check)
    check_known_vulnerabilities "$app_path" security_score security_issues
    
    echo ""
    echo "Security Score: $security_score/100"
    data_ref+=("security_score:$security_score")
    
    if [[ ${#security_issues[@]} -gt 0 ]]; then
        echo "Security Issues Found:"
        for issue in "${security_issues[@]}"; do
            echo "  ⚠️ $issue"
        done
        data_ref+=("security_issues:${security_issues[*]}")
    else
        echo "✓ No security issues found"
        data_ref+=("security_issues:none")
    fi
}

# Check for known vulnerabilities
check_known_vulnerabilities() {
    local app_path="$1"
    local -n score_ref=$2
    local -n issues_ref=$3
    
    local bundle_id
    bundle_id=$(defaults read "$app_path/Contents/Info.plist" CFBundleIdentifier 2>/dev/null || echo "Unknown")
    
    # Check against known vulnerable applications (simplified example)
    case "$bundle_id" in
        "com.adobe.flashplayer"*)
            score_ref=$((score_ref - 30))
            issues_ref+=("Flash Player has known security vulnerabilities")
            ;;
        "com.java."*)
            # Check Java version for known vulnerabilities
            local java_version
            java_version=$(defaults read "$app_path/Contents/Info.plist" CFBundleShortVersionString 2>/dev/null)
            if [[ -n "$java_version" ]]; then
                echo "Java version detected: $java_version"
                # Add specific version checks here
            fi
            ;;
    esac
    
    # Check for applications with expired certificates
    local cert_info=$(codesign -dv "$app_path" 2>&1 | grep "Timestamp=")
    if [[ -n "$cert_info" ]]; then
        # Extract timestamp and check if certificate is old
        local timestamp=$(echo "$cert_info" | sed 's/Timestamp=//')
        echo "Certificate timestamp: $timestamp"
    fi
}

# Generate comprehensive fleet analysis
analyze_fleet_applications() {
    local scan_paths=("$@")
    local report_file="$REPORT_DIR/fleet_analysis_$(date +%Y%m%d_%H%M%S).json"
    
    echo "=== Fleet-Wide Application Analysis ==="
    echo "Scanning paths: ${scan_paths[*]}"
    echo ""
    
    local total_apps=0
    local signed_apps=0
    local unsigned_apps=0
    local notarized_apps=0
    local security_issues=0
    local applications=()
    
    for scan_path in "${scan_paths[@]}"; do
        if [[ -d "$scan_path" ]]; then
            echo "Scanning: $scan_path"
            
            while IFS= read -r -d '' app_path; do
                ((total_apps++))
                
                local app_name=$(basename "$app_path" .app)
                local analysis_data=()
                
                # Quick analysis for fleet overview
                analyze_code_signature "$app_path" "summary" "true" > /dev/null
                
                # Extract key metrics
                if codesign -v "$app_path" 2>/dev/null; then
                    ((signed_apps++))
                else
                    ((unsigned_apps++))
                fi
                
                if spctl -a -v "$app_path" 2>&1 | grep -q "notarized"; then
                    ((notarized_apps++))
                fi
                
                # Add to applications array
                applications+=("$app_path")
                
                # Progress indicator
                if (( total_apps % 25 == 0 )); then
                    echo "Analyzed $total_apps applications..."
                fi
                
            done < <(find "$scan_path" -name "*.app" -type d -maxdepth 2 -print0 2>/dev/null)
        fi
    done
    
    # Generate fleet analysis report
    cat > "$report_file" << EOF
{
    "fleet_analysis": {
        "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
        "hostname": "$(hostname)",
        "scan_paths": [$(printf '"%s",' "${scan_paths[@]}" | sed 's/,$//')],
        "summary": {
            "total_applications": $total_apps,
            "signed_applications": $signed_apps,
            "unsigned_applications": $unsigned_apps,
            "notarized_applications": $notarized_apps,
            "signing_compliance": $(( signed_apps * 100 / total_apps )),
            "notarization_compliance": $(( notarized_apps * 100 / total_apps ))
        },
        "analysis_date": "$(date)",
        "script_version": "$SCRIPT_VERSION"
    }
}
EOF
    
    echo ""
    echo "=== Fleet Analysis Summary ==="
    echo "Total Applications: $total_apps"
    echo "Signed Applications: $signed_apps ($(( signed_apps * 100 / total_apps ))%)"
    echo "Unsigned Applications: $unsigned_apps ($(( unsigned_apps * 100 / total_apps ))%)"
    echo "Notarized Applications: $notarized_apps ($(( notarized_apps * 100 / total_apps ))%)"
    echo ""
    echo "Fleet analysis report: $report_file"
    
    log_action "Fleet analysis completed: $total_apps applications analyzed"
}

# Main execution function
main() {
    local action="${1:-help}"
    local param1="${2:-}"
    local param2="${3:-}"
    local param3="${4:-}"
    local param4="${5:-}"
    
    log_action "=== Roundfleet Code Signature Management Started ==="
    log_action "Action: $action"
    
    case "$action" in
        "analyze")
            if [[ -z "$param1" ]]; then
                echo "Usage: $0 analyze <app_path> [output_format] [security_check]"
                echo "Output formats: detailed, summary, json, csv"
                exit 1
            fi
            analyze_code_signature "$param1" "${param2:-detailed}" "${param3:-true}"
            ;;
        "extract")
            if [[ -z "$param1" ]]; then
                echo "Usage: $0 extract <app_path>"
                exit 1
            fi
            extract_code_requirement "$param1"
            ;;
        "batch")
            if [[ -z "$param1" ]]; then
                param1="/Applications"
            fi
            batch_analyze_applications "$param1" "${param2:-table}" "${param3:-false}"
            ;;
        "policy")
            if [[ -z "$param1" ]]; then
                echo "Available policies: ${!SIGNING_POLICIES[*]}"
                exit 1
            fi
            enforce_code_signing_policy "$param1" "${param2:-report}" "${param3:-/Applications}"
            ;;
        "fleet")
            local paths=("${@:2}")
            if [[ ${#paths[@]} -eq 0 ]]; then
                paths=("/Applications" "/System/Applications")
            fi
            analyze_fleet_applications "${paths[@]}"
            ;;
        "verify")
            if [[ -z "$param1" ]]; then
                echo "Usage: $0 verify <app_path>"
                exit 1
            fi
            if codesign -v "$param1" 2>/dev/null; then
                echo "✓ Code signature is valid for: $param1"
            else
                echo "⚠️ Code signature verification failed for: $param1"
                codesign -v "$param1"
            fi
            ;;
        "help")
            echo "Usage: $0 [action] [options...]"
            echo "Actions:"
            echo "  analyze <app_path> [format] [security] - Analyze application signature"
            echo "  extract <app_path> - Extract code requirement only"
            echo "  batch <scan_path> [format] [include_system] - Batch analyze applications"
            echo "  policy <policy_name> [action] [path] - Enforce signing policy"
            echo "  fleet [paths...] - Analyze fleet-wide applications"
            echo "  verify <app_path> - Quick signature verification"
            echo "  help - Show this help"
            echo ""
            echo "Output Formats: detailed, summary, json, csv, table"
            echo "Policies: ${!SIGNING_POLICIES[*]}"
            echo "Security Levels: ${!SECURITY_LEVELS[*]}"
            ;;
        *)
            log_action "ERROR: Unknown action: $action"
            echo "Use '$0 help' for usage information"
            exit 1
            ;;
    esac
    
    log_action "=== Code signature management completed ==="
}

# Execute main function
main "$@"

Security Best Practices

Enterprise Certificate Management

#!/bin/bash

# Enterprise certificate validation
validate_enterprise_certificates() {
    local cert_policy="${1:-strict}"
    
    echo "=== Enterprise Certificate Validation ==="
    echo "Policy: $cert_policy"
    echo ""
    
    local expired_certs=()
    local revoked_certs=()
    local untrusted_certs=()
    
    # Check system keychain for enterprise certificates
    security find-certificate -a -p /Library/Keychains/System.keychain | \
    while IFS= read -r cert_line; do
        if [[ "$cert_line" == "-----BEGIN CERTIFICATE-----" ]]; then
            # Process certificate
            echo "Checking enterprise certificate..."
        fi
    done
    
    echo "✓ Enterprise certificate validation completed"
}

validate_enterprise_certificates "strict"

Compliance Reporting

#!/bin/bash

# Generate compliance report for regulatory requirements
generate_compliance_report() {
    local compliance_type="${1:-general}"
    local output_file="$REPORT_DIR/compliance_${compliance_type}_$(date +%Y%m%d_%H%M%S).json"
    
    echo "=== Generating Compliance Report: $compliance_type ==="
    
    local total_apps=0
    local compliant_apps=0
    local non_compliant_apps=0
    
    # Scan applications for compliance
    while IFS= read -r -d '' app_path; do
        ((total_apps++))
        
        case "$compliance_type" in
            "hipaa")
                check_hipaa_compliance "$app_path" compliant_apps non_compliant_apps
                ;;
            "sox")
                check_sox_compliance "$app_path" compliant_apps non_compliant_apps
                ;;
            "pci_dss")
                check_pci_compliance "$app_path" compliant_apps non_compliant_apps
                ;;
            *)
                check_general_compliance "$app_path" compliant_apps non_compliant_apps
                ;;
        esac
    done < <(find /Applications -name "*.app" -type d -print0 2>/dev/null)
    
    # Generate report
    local compliance_percentage=$(( compliant_apps * 100 / total_apps ))
    
    cat > "$output_file" << EOF
{
    "compliance_report": {
        "type": "$compliance_type",
        "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
        "hostname": "$(hostname)",
        "summary": {
            "total_applications": $total_apps,
            "compliant_applications": $compliant_apps,
            "non_compliant_applications": $non_compliant_apps,
            "compliance_percentage": $compliance_percentage
        }
    }
}
EOF
    
    echo "Compliance report generated: $output_file"
    echo "Compliance rate: $compliance_percentage%"
}

generate_compliance_report "general"

Important Notes

• Code signatures verify application authenticity and integrity
• Code requirements specify constraints for application validation
• Enterprise policies should balance security with operational needs
• Regular monitoring helps detect unauthorized applications
• Compliance requirements vary by industry and regulatory framework
• Notarization provides additional security validation from Apple
• Certificate management is crucial for enterprise security
• Fleet-wide analysis enables proactive security management