haven't worked in sig validation, but runs

xprotect_fetcher.py

#!/usr/bin/python
"""
Checks the MountainLion-Era version of the xprotect plist for the current
version number, compares it against version on disk.
"""


import urllib2
import sys
sys.path.append("/usr/local/munki/munkilib")
import FoundationPlist


def fetch_xversion():
    """fetches outdated URL with current version of xprotect in it"""
    try:
        response = urllib2.urlopen('http://configuration.apple.com/configurations/macosx/xprotect/3/clientConfiguration.plist')
    except urllib2.URLError as err:
        raise err
    whole = response.read()
    halves = whole.split('----- END SIGNATURE -----')
    plistobj = FoundationPlist.readPlistFromString(halves[1])
    return int(plistobj['meta']['Version'])


def look_local():
    """checks local xprotect version"""
    local_xprotect = FoundationPlist.readPlist('/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist')
    return int(local_xprotect['Version'])


def main():
    """gimme some main"""
    fetched = fetch_xversion()
    localx = look_local()
    print fetched, localx

if __name__ == '__main__':
    main()