Struct apple_codesign::remote_signing::UnjoinedSigningClient

pub struct UnjoinedSigningClient { /* private fields */ }

A client for the remote signing protocol that has not yet joined a session.

Clients can perform both the initiator and signer roles.

Implementations

impl UnjoinedSigningClient

pub fn new_initiator(
    req: impl IntoClientRequest,
    initiator: Box<dyn SessionInitiatePeer>,
    session_info_cb: Option<SessionInfoCallback>
) -> Result<InitiatorClient, RemoteSignError>

Create a new client in the initiator role.

Examples found in repository

src/cli.rs (lines 645-649)

fn collect_certificates_from_args(
    args: &ArgMatches,
    scan_smartcard: bool,
) -> Result<(Vec<Box<dyn PrivateKey>>, Vec<CapturedX509Certificate>), AppleCodesignError> {
    let mut keys: Vec<Box<dyn PrivateKey>> = vec![];
    let mut certs = vec![];

    if let Some(p12_path) = args.get_one::<String>("p12_path") {
        let p12_data = std::fs::read(p12_path)?;

        let p12_password = if let Some(password) = args.get_one::<String>("p12_password") {
            password.to_string()
        } else if let Some(path) = args.get_one::<String>("p12_password_file") {
            std::fs::read_to_string(path)?
                .lines()
                .next()
                .expect("should get a single line")
                .to_string()
        } else {
            dialoguer::Password::new()
                .with_prompt("Please enter password for p12 file")
                .interact()?
        };

        let (cert, key) = parse_pfx_data(&p12_data, &p12_password)?;

        keys.push(Box::new(key));
        certs.push(cert);
    }

    if let Some(values) = args.get_many::<String>("pem_source") {
        for pem_source in values {
            warn!("reading PEM data from {}", pem_source);
            let pem_data = std::fs::read(pem_source)?;

            for pem in pem::parse_many(pem_data).map_err(AppleCodesignError::CertificatePem)? {
                match pem.tag.as_str() {
                    "CERTIFICATE" => {
                        certs.push(CapturedX509Certificate::from_der(pem.contents)?);
                    }
                    "PRIVATE KEY" => {
                        keys.push(Box::new(InMemoryPrivateKey::from_pkcs8_der(&pem.contents)?));
                    }
                    "RSA PRIVATE KEY" => {
                        keys.push(Box::new(InMemoryPrivateKey::from_pkcs1_der(&pem.contents)?));
                    }
                    tag => warn!("(unhandled PEM tag {}; ignoring)", tag),
                }
            }
        }
    }

    if let Some(values) = args.get_many::<String>("der_source") {
        for der_source in values {
            warn!("reading DER file {}", der_source);
            let der_data = std::fs::read(der_source)?;

            certs.push(CapturedX509Certificate::from_der(der_data)?);
        }
    }

    find_certificates_in_keychain(args, &mut keys, &mut certs)?;

    if scan_smartcard {
        if let Some(slot) = args.get_one::<String>("smartcard_slot") {
            let pin_env_var = args.get_one::<String>("smartcard_pin_env");
            handle_smartcard_sign_slot(slot, pin_env_var.map(|x| &**x), &mut keys, &mut certs)?;
        }
    }

    let remote_signing_url = if args.get_flag("remote_signer") {
        args.get_one::<String>("remote_signing_url")
    } else {
        None
    };

    if let Some(remote_signing_url) = remote_signing_url {
        let initiator = get_remote_signing_initiator(args)?;

        let client = UnjoinedSigningClient::new_initiator(
            remote_signing_url,
            initiator,
            Some(print_session_join),
        )?;

        // As part of the handshake we obtained the public certificates from the signer.
        // So make them the canonical set.
        if !certs.is_empty() {
            warn!(
                "ignoring {} local certificates and using remote signer's certificate(s)",
                certs.len()
            );
        }

        certs = vec![client.signing_certificate().clone()];
        certs.extend(client.certificate_chain().iter().cloned());

        // The client implements Sign, so we just use it as the private key.
        keys = vec![Box::new(client)];
    }

    Ok((keys, certs))
}

pub fn new_signer(
    joiner: Box<dyn SessionJoinPeerPreJoin>,
    signing_key: &dyn KeyInfoSigner,
    signing_cert: CapturedX509Certificate,
    certificates: Vec<CapturedX509Certificate>,
    default_server_url: String
) -> Result<SigningClient<'_>, RemoteSignError>

Create a new client in the signer role.

Examples found in repository

src/cli.rs (lines 2085-2091)

fn command_remote_sign(args: &ArgMatches) -> Result<(), AppleCodesignError> {
    let remote_url = args
        .get_one::<String>("remote_signing_url")
        .expect("remote signing URL should always be present");

    let session_join_string = if args.get_flag("session_join_string_editor") {
        let mut value = None;

        for _ in 0..3 {
            if let Some(content) = dialoguer::Editor::new()
                .require_save(true)
                .edit("# Please enter the -----BEGIN SESSION JOIN STRING---- content below.\n# Remember to save the file!")?
            {
                value = Some(content);
                break;
            }
        }

        value.ok_or_else(|| {
            AppleCodesignError::CliGeneralError("session join string not entered in editor".into())
        })?
    } else if let Some(path) = args.get_one::<String>("session_join_string_path") {
        std::fs::read_to_string(path)?
    } else if let Some(value) = args.get_one::<String>("session_join_string") {
        value.to_string()
    } else {
        return Err(AppleCodesignError::CliGeneralError(
            "session join string argument parsing failure".into(),
        ));
    };

    let mut joiner = create_session_joiner(session_join_string)?;

    if let Some(env) = args.get_one::<String>("remote_shared_secret_env") {
        let secret = std::env::var(env).map_err(|_| AppleCodesignError::CliBadArgument)?;
        joiner.register_state(SessionJoinState::SharedSecret(secret.as_bytes().to_vec()))?;
    } else if let Some(secret) = args.get_one::<String>("remote_shared_secret") {
        joiner.register_state(SessionJoinState::SharedSecret(secret.as_bytes().to_vec()))?;
    }

    let (private_keys, mut public_certificates) = collect_certificates_from_args(args, true)?;

    let private = private_keys
        .into_iter()
        .next()
        .ok_or(AppleCodesignError::NoSigningCertificate)?;

    let cert = public_certificates.remove(0);

    let certificates = if let Some(chain) = cert.apple_root_certificate_chain() {
        // The chain starts with self.
        chain.into_iter().skip(1).collect::<Vec<_>>()
    } else {
        public_certificates
    };

    joiner.register_state(SessionJoinState::PublicKeyDecrypt(
        private.to_public_key_peer_decrypt()?,
    ))?;

    let client = UnjoinedSigningClient::new_signer(
        joiner,
        private.as_key_info_signer(),
        cert,
        certificates,
        remote_url.to_string(),
    )?;
    client.run()?;

    Ok(())
}

pub fn join_session(
    self,
    join_context: SessionJoinContext,
    signing_key: &dyn KeyInfoSigner,
    signing_cert: CapturedX509Certificate,
    certificates: Vec<CapturedX509Certificate>
) -> Result<SigningClient<'_>, RemoteSignError>

Join a signing session.

This should be called by signers once they have the session ID to join.

Examples found in repository

src/remote_signing/mod.rs (line 493)

    pub fn new_signer(
        joiner: Box<dyn SessionJoinPeerPreJoin>,
        signing_key: &dyn KeyInfoSigner,
        signing_cert: CapturedX509Certificate,
        certificates: Vec<CapturedX509Certificate>,
        default_server_url: String,
    ) -> Result<SigningClient, RemoteSignError> {
        // An error here could result in the peer hanging indefinitely because the session
        // is unjoined. Ideally we'd recover from this by attempting to join with an error.
        // However, we may not even be able to obtain the session ID since sometimes it is
        // encrypted and the error could be from a decryption failure! So for now, just let
        // the peer idle.
        let join_context = joiner.join_context()?;

        let server_url = join_context
            .server_url
            .as_ref()
            .unwrap_or(&default_server_url);

        let slf = Self::new(server_url)?;
        slf.join_session(join_context, signing_key, signing_cert, certificates)
    }