Struct apple_codesign::MachOSigner

pub struct MachOSigner<'data> { /* private fields */ }

Mach-O binary signer.

This type provides a high-level interface for signing Mach-O binaries. It handles parsing and rewriting Mach-O binaries and contains most of the functionality for producing signatures for individual Mach-O binaries.

Signing of both single architecture and fat/universal binaries is supported.

Circular Dependency

There is a circular dependency between the generation of the Code Directory present in the embedded signature and the Mach-O binary. See the note in crate::specification for the gory details. The tl;dr is the Mach-O data up to the signature data needs to be digested. But that digested data contains load commands that reference the signature data and its size, which can’t be known until the Code Directory, CMS blob, and SuperBlob are all created.

Our solution to this problem is to estimate the size of the embedded signature data and then pad the unused data will 0s.

Implementations

impl<'data> MachOSigner<'data>

pub fn new(macho_data: &'data [u8]) -> Result<Self, AppleCodesignError>

Construct a new instance from unparsed data representing a Mach-O binary.

The data will be parsed as a Mach-O binary (either single arch or fat/universal) and validated that we are capable of signing it.

pub fn write_signed_binary(
    &self,
    settings: &SigningSettings<'_>,
    writer: &mut impl Write
) -> Result<(), AppleCodesignError>

Write signed Mach-O data to the given writer using signing settings.

pub fn create_superblob(
    &self,
    settings: &SigningSettings<'_>,
    macho: &MachOBinary<'_>
) -> Result<Vec<u8>, AppleCodesignError>

Create data constituting the SuperBlob to be embedded in the __LINKEDIT segment.

The superblob contains the code directory, any extra blobs, and an optional CMS structure containing a cryptographic signature.

This takes an explicit Mach-O to operate on due to a circular dependency between writing out the Mach-O and digesting its content. See the note in MachOSigner for details.

pub fn create_code_directory(
    &self,
    settings: &SigningSettings<'_>,
    macho: &MachOBinary<'_>
) -> Result<CodeDirectoryBlob<'static>, AppleCodesignError>

Create the CodeDirectory for the current configuration.

This takes an explicit Mach-O to operate on due to a circular dependency between writing out the Mach-O and digesting its content. See the note in MachOSigner for details.

pub fn create_special_blobs(
    &self,
    settings: &SigningSettings<'_>,
    is_executable: bool
) -> Result<Vec<(CodeSigningSlot, BlobData<'static>)>, AppleCodesignError>

Create blobs that need to be written given the current configuration.

This emits all blobs except CodeDirectory and Signature, which are special since they are derived from the blobs emitted here.

The goal of this function is to emit data to facilitate the creation of a CodeDirectory, which requires hashing blobs.