A secure timestamp is a signed time record from Apple's timestamp service that gets embedded in a Mac code signature. Notarization requires it. Xcode adds it during archive and export, but custom signing scripts must request it, and you can check a binary with the code signing tool's verbose display.
Definitions
A timestamp in code signing records that the signature was made at a given time. Without one, a signature is judged against the current date. The Apple notarization requirements list a secure timestamp as mandatory for software distributed with Developer ID.
This post covers the Apple side. Windows has its own version of the idea, covered in a separate post on Authenticode timestamps at /resources/blog/authenticode-timestamp-why-always-timestamp-windows-releases.
When Xcode adds it for you
Apple's resolving-issues page says that by default Xcode does not include a secure timestamp during the build. It adds one during the archive step, as of Xcode 10.2, and during export workflows.
If you build with the standard Distribute App flow in Xcode, you are covered. The trouble starts when a script signs the app itself, or a build tool re-signs a framework after export.
When you must add it yourself
For a custom export process, Apple says to add the secure timestamp option to the code signing flags build setting, or to pass the option directly to the signing tool if you sign by hand. Notarization fails with a message about the missing timestamp if you do not.
Two practical points from the same page:
- Generating a secure timestamp needs internet access.
- macOS accepts one secure timestamp server, which Apple publishes with its address ranges.
So a build agent behind a strict firewall needs a rule that allows Apple's timestamp service. Without it, signing can fail or produce a signature that notarization then rejects.
How to check a binary
Apple describes a check using the code signing tool's display mode with elevated verbosity. For a binary with a secure timestamp, the output includes a timestamp value with a date. If the output shows the timestamp as none, the binary does not have one.
codesign -dvv MyApp.app 2>&1 | grep -i timestamp
Run this on the final artifact, and on nested items such as frameworks and helper tools too, since Apple's requirements apply to every executable you distribute.
Why this matters beyond the notary service
A timestamp lets a signature stay meaningful after the signing certificate itself has expired, because the time of signing is proven. That is the reason release teams treat it as non-optional, even for platforms that do not force it.
A short pipeline checklist
- Confirm your signing step passes the timestamp option.
- Allow the build agent to reach Apple's timestamp service.
- Check the timestamp on the final app and on nested code.
- Fail the build if any executable shows no timestamp.
Where Safeguard fits
Timestamps prove when a build was signed, not what was inside it. Safeguard scans dependencies and records SBOMs per release, with a free scan at gold.safeguard.sh/scan.
Quick check
Does Xcode always add a secure timestamp?
No. Apple says it adds one during archive and export, not during an ordinary build. Custom scripts must add it themselves.
Can I sign without internet access?
A secure timestamp needs internet access, so an offline build agent cannot produce one. Allow the agent to reach Apple's timestamp service.
Sources
- Apple Developer: Resolving common notarization issues
- Apple Developer: Notarizing macOS software before distribution
Last reviewed: 19 October 2026.
