I should emphasize that all I really want to do is verify that the MAS-downloaded application is running as a valid purchase. I tried Quinn's example app from https://developer.apple.com/forums/thread/764537?page=2 (which, as it turns out, is pretty much exactly what I did). In that case, with the simple example app, I get an error response: Received error that does not have a corresponding StoreKit Error: Error Domain=AMSErrorDomain Code=301 "Invalid Status Code The response has an invalid status code" UserInfo={AMSFailureReason=The response has an invalid status code, AMSURL=https://mzstorekit-sb.itunes.apple.com/inApps/v1/receipts/createAppReceipt?REDACTED, AMSStatusCode=500, AMSServerPayload={ errorCode = 500318; }, AMSDescription=Invalid Status Code, NSDebugDescription=Invalid Status Code The response has an invalid status code} which I'm going to assume has to do with the fact that there is no matching app/configuration on the App Store? Maybe? (Guessing, because there's no documentation on that, either.) So I can produce an error with the example code, or (always) a success/purchased result in my own app, but so far I've been unable to produce a not-purchased/validated result, which is kind of the whole thing I want to check for.

I'm not sure that's what I'm looking for. I don't necessarily need to know that a given copy of the application hasn't somehow been fiddled with. That may be beyond the scope of what I'm trying to do. What I want to know is if User B is running a copy of Mac App Store purchased software that User A purchased legitimately and threw up on an FTP server or something for them to download. As it is, the part of the Apple sample code, above, that says "StoreKit verified that the user purchased this app" doesn't seem to be doing that. Or, maybe, to clarify: what is it that AppTransaction.shared is actually verifying? Is it that the current Apple ID has a purchase for com.whatever.software on file in the Mac App Store? (Because that's really all I'm looking for.)

See, I've tried changing users, logging out of the App Store, logging in to the App Store with a different user — and I always get the .verified result. So it seems like it's allowing exactly the thing I'm trying to check for (and which the Apple example code seems to be saying it's checking for). Also, is there any explanation as to what the error code in my implementation of Quinn's example means, above? I don't get that with my application, only when testing the example. Is it related to (not) having a record with that application with that signature on the App Store? I need to figure out how/if I'm going to handle it.