Validating Xcode to Eradicate XcodeGhost

The news has been full of concern about XcodeGhost, a counterfeit version of Apple's Xcode development environment that injected malicious code into apps created with it. As a result, Apple had to remove over 5,000 from App Stores around the world. 

Today, the company sent an email to developers reminding them to download Xcode directly from the Mac App Store or the Apple Developer website, and to also leave Gatekeeper enabled on all systems to protect against tampered software. 

In a developer note, Apple also provided a method of verifying the installed version of Xcode as genuine. It's easy enough; launch Terminal, and then type in the following command:

spctl --assess --verbose /Applications/

For developers who have installed Xcode in another directory, just replace /Applications/ with the correct path to the Xcode app. The command takes a few minutes to run, after which it returns with a message as seen in this screenshot:

If the result is anything other than "accepted" and the source is anything other than "Mac App Store", "Apple" or "Apple System", the installed copy of Xcode should be removed completely and replaced with a valid copy.