If you use `codesign -v --verbose /Applications/Xcode.app` you may see: file added: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctool

If you use `codesign -v --verbose /Applications/Xcode.app` you may see: file added: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/share/man/whatis file added: /Applications/Xcode.app/Contents/Developer/usr/share/man/whatis That should be safe. It's a bit of a shock that Apple: 1) is modifying sealed containers post-install (it's the weekly periodic job that rebuilds whatis database from installed man pages) 2) doesn't realize this and has put out instructions that will cause lots of false positives