Struct apple_codesign::embedded_signature::EntitlementsDerBlob

pub struct EntitlementsDerBlob<'a> { /* private fields */ }

Implementations

impl<'a> EntitlementsDerBlob<'a>

pub fn from_plist(v: &Value) -> Result<Self, AppleCodesignError>

Construct an instance from a plist::Value.

Not all plists can be encoded to this blob as not all plist value types can be encoded to DER. If a plist with an illegal value is passed in, this function will error, as DER encoding is performed immediately.

The outermost plist value should be a dictionary.

Examples found in repository

src/macho_signing.rs (line 658)

    pub fn create_special_blobs(
        &self,
        settings: &SigningSettings,
        is_executable: bool,
    ) -> Result<Vec<(CodeSigningSlot, BlobData<'static>)>, AppleCodesignError> {
        let mut res = Vec::new();

        let mut requirements = CodeRequirements::default();

        match settings.designated_requirement(SettingsScope::Main) {
            DesignatedRequirementMode::Auto => {
                // If we are using an Apple-issued cert, this should automatically
                // derive appropriate designated requirements.
                if let Some((_, cert)) = settings.signing_key() {
                    info!("attempting to derive code requirements from signing certificate");
                    let identifier = Some(
                        settings
                            .binary_identifier(SettingsScope::Main)
                            .ok_or(AppleCodesignError::NoIdentifier)?
                            .to_string(),
                    );

                    if let Some(expr) = derive_designated_requirements(cert, identifier)? {
                        requirements.push(expr);
                    }
                }
            }
            DesignatedRequirementMode::Explicit(exprs) => {
                info!("using provided code requirements");
                for expr in exprs {
                    requirements.push(CodeRequirementExpression::from_bytes(expr)?.0);
                }
            }
        }

        // Always emit a RequirementSet blob, even if empty. Without it, validation fails
        // with `the sealed resource directory is invalid`.
        let mut blob = RequirementSetBlob::default();

        if !requirements.is_empty() {
            info!("code requirements: {}", requirements);
            requirements.add_to_requirement_set(&mut blob, RequirementType::Designated)?;
        }

        res.push((CodeSigningSlot::RequirementSet, blob.into()));

        if let Some(entitlements) = settings.entitlements_xml(SettingsScope::Main)? {
            info!("adding entitlements XML");
            let blob = EntitlementsBlob::from_string(&entitlements);

            res.push((CodeSigningSlot::Entitlements, blob.into()));
        }

        // The DER encoded entitlements weren't always present in the signature. The feature
        // appears to have been introduced in macOS 10.14 and is the default behavior as of
        // macOS 12 "when signing for all platforms." `codesign` appears to add the DER
        // representation whenever entitlements are present, but only if the current binary is
        // an executable (.filetype == MH_EXECUTE).
        if is_executable {
            if let Some(value) = settings.entitlements_plist(SettingsScope::Main) {
                info!("adding entitlements DER");
                let blob = EntitlementsDerBlob::from_plist(value)?;

                res.push((CodeSigningSlot::EntitlementsDer, blob.into()));
            }
        }

        Ok(res)
    }

Trait Implementations

impl<'a> Blob<'a> for EntitlementsDerBlob<'a>

fn magic() -> u32

The header magic that identifies this format.

fn from_blob_bytes(data: &'a [u8]) -> Result<Self, AppleCodesignError>

Attempt to construct an instance by parsing a bytes slice.

fn serialize_payload(&self) -> Result<Vec<u8>, AppleCodesignError>

Serialize the payload of this blob to bytes.

fn to_blob_bytes(&self) -> Result<Vec<u8>, AppleCodesignError>

Serialize this blob to bytes.

fn digest_with(
    &self,
    hash_type: DigestType
) -> Result<Vec<u8>, AppleCodesignError>

Obtain the digest of the blob using the specified hasher.

impl<'a> Debug for EntitlementsDerBlob<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a> From<EntitlementsDerBlob<'a>> for BlobData<'a>

fn from(b: EntitlementsDerBlob<'a>) -> Self

Converts to this type from the input type.