Struct apple_codesign::CodeResources

pub struct CodeResources { /* private fields */ }

Represents a _CodeSignature/CodeResources XML plist.

This file/type represents a collection of file-based resources whose content is digested and captured in this file.

Implementations

impl CodeResources

pub fn from_xml(xml: &[u8]) -> Result<Self, AppleCodesignError>

Construct an instance by parsing an XML plist.

pub fn to_writer_xml(&self, writer: impl Write) -> Result<(), AppleCodesignError>

Serialize an instance to XML.

Examples found in repository

src/code_resources.rs (line 1349)

    pub fn write_code_resources(&self, writer: impl Write) -> Result<(), AppleCodesignError> {
        self.resources.to_writer_xml(writer)
    }

pub fn add_rule(&mut self, rule: CodeResourcesRule)

Add a rule to this instance in the <rules> section.

Examples found in repository

src/code_resources.rs (line 1060)

    pub fn add_rule(&mut self, rule: CodeResourcesRule) {
        self.rules.push(rule.clone());
        self.rules.sort();
        self.resources.add_rule(rule);
    }

pub fn add_rule2(&mut self, rule: CodeResourcesRule)

Add a rule to this instance in the <rules2> section.

Examples found in repository

src/code_resources.rs (line 1067)

    pub fn add_rule2(&mut self, rule: CodeResourcesRule) {
        self.rules2.push(rule.clone());
        self.rules2.sort();
        self.resources.add_rule2(rule);
    }

pub fn seal_regular_file(
    &mut self,
    files_flavor: FilesFlavor,
    path: impl ToString,
    content: impl AsRef<[u8]>,
    optional: bool
) -> Result<(), AppleCodesignError>

Seal a regular file.

This will digest the content specified and record that digest in the files or files2 list.

To seal a symlink, call CodeResources::seal_symlink instead. If the file is a Mach-O file, call CodeResources::seal_macho instead.

Examples found in repository

src/code_resources.rs (line 1246)

    fn process_file_rules2(
        &mut self,
        file: &DirectoryBundleFile,
        file_handler: &dyn BundleFileHandler,
    ) -> Result<(), AppleCodesignError> {
        match Self::evaluate_rules(
            &self.rules2,
            file.relative_path(),
            file.symlink_target()
                .map_err(AppleCodesignError::DirectoryBundle)?,
        )? {
            RulesEvaluation::Exclude => {
                // Excluded files are hard ignored. These files are likely handled out-of-band
                // from this builder.
                Ok(())
            }
            RulesEvaluation::Omit => {
                // Omitted files aren't sealed. But they are installed.
                file_handler.install_file(file)
            }
            RulesEvaluation::NoRule => {
                // No rule match is assumed to mean full ignore.
                Ok(())
            }
            RulesEvaluation::SealSymlink(relative_path, target) => {
                info!("sealing symlink {} -> {}", relative_path, target);
                self.resources.seal_symlink(relative_path, target);
                file_handler.install_file(file)
            }
            RulesEvaluation::SealNested(relative_path, optional) => {
                // The assumption that a nested match means Mach-O may not be correct.
                info!("sealing Mach-O file {}", relative_path);
                let macho_info = file_handler.sign_and_install_macho(file)?;

                self.resources
                    .seal_macho(relative_path, &macho_info, optional)
            }
            RulesEvaluation::SealRegularFile(relative_path, optional) => {
                info!("sealing regular file {}", relative_path);
                let data = std::fs::read(file.absolute_path())?;

                let flavor = if self.digests.contains(&DigestType::Sha1) {
                    FilesFlavor::Rules2WithSha1
                } else {
                    FilesFlavor::Rules2
                };

                self.resources
                    .seal_regular_file(flavor, relative_path, data, optional)?;
                file_handler.install_file(file)
            }
        }
    }

    /// Process the `<rules>` set for a given file.
    ///
    /// Since `<rules2>` handling actually does the file installs, the only role of this
    /// handler is to record the SHA-1 seals in `<files>`. Keep in mind that `<files>` can't
    /// handle symlinks or nested Mach-O binaries. So we only care about regular files here.
    fn process_file_rules(&mut self, file: &DirectoryBundleFile) -> Result<(), AppleCodesignError> {
        match Self::evaluate_rules(
            &self.rules,
            file.relative_path(),
            file.symlink_target()
                .map_err(AppleCodesignError::DirectoryBundle)?,
        )? {
            RulesEvaluation::Exclude
            | RulesEvaluation::Omit
            | RulesEvaluation::NoRule
            | RulesEvaluation::SealSymlink(..)
            | RulesEvaluation::SealNested(..) => Ok(()),
            RulesEvaluation::SealRegularFile(relative_path, optional) => {
                let data = std::fs::read(file.absolute_path())?;

                self.resources
                    .seal_regular_file(FilesFlavor::Rules, relative_path, data, optional)
            }
        }
    }

pub fn seal_symlink(&mut self, path: impl ToString, target: impl ToString)

Seal a symlink file.

path is the path of the symlink and target is the path it points to.

Examples found in repository

src/code_resources.rs (line 1224)

    fn process_file_rules2(
        &mut self,
        file: &DirectoryBundleFile,
        file_handler: &dyn BundleFileHandler,
    ) -> Result<(), AppleCodesignError> {
        match Self::evaluate_rules(
            &self.rules2,
            file.relative_path(),
            file.symlink_target()
                .map_err(AppleCodesignError::DirectoryBundle)?,
        )? {
            RulesEvaluation::Exclude => {
                // Excluded files are hard ignored. These files are likely handled out-of-band
                // from this builder.
                Ok(())
            }
            RulesEvaluation::Omit => {
                // Omitted files aren't sealed. But they are installed.
                file_handler.install_file(file)
            }
            RulesEvaluation::NoRule => {
                // No rule match is assumed to mean full ignore.
                Ok(())
            }
            RulesEvaluation::SealSymlink(relative_path, target) => {
                info!("sealing symlink {} -> {}", relative_path, target);
                self.resources.seal_symlink(relative_path, target);
                file_handler.install_file(file)
            }
            RulesEvaluation::SealNested(relative_path, optional) => {
                // The assumption that a nested match means Mach-O may not be correct.
                info!("sealing Mach-O file {}", relative_path);
                let macho_info = file_handler.sign_and_install_macho(file)?;

                self.resources
                    .seal_macho(relative_path, &macho_info, optional)
            }
            RulesEvaluation::SealRegularFile(relative_path, optional) => {
                info!("sealing regular file {}", relative_path);
                let data = std::fs::read(file.absolute_path())?;

                let flavor = if self.digests.contains(&DigestType::Sha1) {
                    FilesFlavor::Rules2WithSha1
                } else {
                    FilesFlavor::Rules2
                };

                self.resources
                    .seal_regular_file(flavor, relative_path, data, optional)?;
                file_handler.install_file(file)
            }
        }
    }

pub fn seal_macho(
    &mut self,
    path: impl ToString,
    info: &SignedMachOInfo,
    optional: bool
) -> Result<(), AppleCodesignError>

Record metadata of a previously signed Mach-O binary.

If sealing a fat/universal binary, pass in metadata for the first Mach-O within in.

Examples found in repository

src/code_resources.rs (line 1233)

    fn process_file_rules2(
        &mut self,
        file: &DirectoryBundleFile,
        file_handler: &dyn BundleFileHandler,
    ) -> Result<(), AppleCodesignError> {
        match Self::evaluate_rules(
            &self.rules2,
            file.relative_path(),
            file.symlink_target()
                .map_err(AppleCodesignError::DirectoryBundle)?,
        )? {
            RulesEvaluation::Exclude => {
                // Excluded files are hard ignored. These files are likely handled out-of-band
                // from this builder.
                Ok(())
            }
            RulesEvaluation::Omit => {
                // Omitted files aren't sealed. But they are installed.
                file_handler.install_file(file)
            }
            RulesEvaluation::NoRule => {
                // No rule match is assumed to mean full ignore.
                Ok(())
            }
            RulesEvaluation::SealSymlink(relative_path, target) => {
                info!("sealing symlink {} -> {}", relative_path, target);
                self.resources.seal_symlink(relative_path, target);
                file_handler.install_file(file)
            }
            RulesEvaluation::SealNested(relative_path, optional) => {
                // The assumption that a nested match means Mach-O may not be correct.
                info!("sealing Mach-O file {}", relative_path);
                let macho_info = file_handler.sign_and_install_macho(file)?;

                self.resources
                    .seal_macho(relative_path, &macho_info, optional)
            }
            RulesEvaluation::SealRegularFile(relative_path, optional) => {
                info!("sealing regular file {}", relative_path);
                let data = std::fs::read(file.absolute_path())?;

                let flavor = if self.digests.contains(&DigestType::Sha1) {
                    FilesFlavor::Rules2WithSha1
                } else {
                    FilesFlavor::Rules2
                };

                self.resources
                    .seal_regular_file(flavor, relative_path, data, optional)?;
                file_handler.install_file(file)
            }
        }
    }

    /// Process the `<rules>` set for a given file.
    ///
    /// Since `<rules2>` handling actually does the file installs, the only role of this
    /// handler is to record the SHA-1 seals in `<files>`. Keep in mind that `<files>` can't
    /// handle symlinks or nested Mach-O binaries. So we only care about regular files here.
    fn process_file_rules(&mut self, file: &DirectoryBundleFile) -> Result<(), AppleCodesignError> {
        match Self::evaluate_rules(
            &self.rules,
            file.relative_path(),
            file.symlink_target()
                .map_err(AppleCodesignError::DirectoryBundle)?,
        )? {
            RulesEvaluation::Exclude
            | RulesEvaluation::Omit
            | RulesEvaluation::NoRule
            | RulesEvaluation::SealSymlink(..)
            | RulesEvaluation::SealNested(..) => Ok(()),
            RulesEvaluation::SealRegularFile(relative_path, optional) => {
                let data = std::fs::read(file.absolute_path())?;

                self.resources
                    .seal_regular_file(FilesFlavor::Rules, relative_path, data, optional)
            }
        }
    }

    /// Process a file for resource handling.
    ///
    /// This determines whether a file is relevant for inclusion in the CodeResources
    /// file and takes actions to process it, if necessary.
    pub fn process_file(
        &mut self,
        file: &DirectoryBundleFile,
        file_handler: &dyn BundleFileHandler,
    ) -> Result<(), AppleCodesignError> {
        self.process_file_rules2(file, file_handler)?;
        self.process_file_rules(file)
    }

    /// Process a nested bundle for inclusion in resource handling.
    ///
    /// This will attempt to seal the main digest of the bundle into this resources file.
    pub fn process_nested_bundle(
        &mut self,
        relative_path: &str,
        bundle: &DirectoryBundle,
    ) -> Result<(), AppleCodesignError> {
        let main_exe = match bundle
            .files(false)
            .map_err(AppleCodesignError::DirectoryBundle)?
            .into_iter()
            .find(|file| matches!(file.is_main_executable(), Ok(true)))
        {
            Some(path) => path,
            None => {
                warn!(
                    "nested bundle at {} does not have main executable; nothing to seal",
                    relative_path
                );
                return Ok(());
            }
        };

        let (relative_path, optional) =
            match Self::evaluate_rules(&self.rules2, relative_path, None)? {
                RulesEvaluation::SealRegularFile(relative_path, optional) => {
                    (relative_path, optional)
                }
                RulesEvaluation::SealNested(relative_path, optional) => (relative_path, optional),
                RulesEvaluation::Exclude => {
                    info!(
                        "excluding signing nested bundle {} because of matched resources rule",
                        relative_path
                    );
                    return Ok(());
                }
                res => {
                    warn!(
                        "unexpected resource rules evaluation result for nested bundle {}: {:?}",
                        relative_path, res
                    );
                    return Err(AppleCodesignError::BundleUnexpectedResourceRuleResult);
                }
            };

        let macho_data = std::fs::read(main_exe.absolute_path())?;
        let macho_info = SignedMachOInfo::parse_data(&macho_data)?;

        info!("sealing nested bundle at {}", relative_path);
        self.resources
            .seal_macho(relative_path, &macho_info, optional)?;

        Ok(())
    }

Trait Implementations

impl Clone for CodeResources

fn clone(&self) -> CodeResources

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CodeResources

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CodeResources

fn default() -> CodeResources

Returns the “default value” for a type.

impl From<&CodeResources> for Value

fn from(cr: &CodeResources) -> Self

Converts to this type from the input type.

impl PartialEq<CodeResources> for CodeResources

fn eq(&self, other: &CodeResources) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for CodeResources