Enum apple_codesign::CertificateProfile

pub enum CertificateProfile {
    MacInstallerDistribution,
    AppleDistribution,
    AppleDevelopment,
    DeveloperIdApplication,
    DeveloperIdInstaller,
}

Describes combinations of certificate extensions for Apple code signing certificates.

Code signing certificates contain various X.509 extensions denoting them for code signing.

This type represents various common extensions as used on Apple platforms.

Typically, you’ll want to apply at most one of these extensions to a new certificate in order to mark it as compatible for code signing.

This type essentially encapsulates the logic for handling of different “profiles” attached to the different code signing certificates that Apple issues.

Variants

MacInstallerDistribution

Mac Installer Distribution.

In Keychain Access.app, this might render as 3rd Party Mac Developer Installer.

Certificates are marked for EKU with 3rd Party Developer Installer Package Signing.

They also have the Apple Mac App Signing (Submission) extension.

Typically issued by Apple Worldwide Developer Relations Certificate Authority.

AppleDistribution

Apple Distribution.

Certificates are marked for EKU with Code Signing. They also have extensions Apple Mac App Signing (Development) and Apple Developer Certificate (Submission).

Typically issued by Apple Worldwide Developer Relations Certificate Authority.

AppleDevelopment

Apple Development.

Certificates are marked for EKU with Code Signing. They also have extensions Apple Developer Certificate (Development) and Mac Developer.

Typically issued by Apple Worldwide Developer Relations Certificate Authority.

DeveloperIdApplication

Developer ID Application.

Certificates are marked for EKU with Code Signing. They also have extensions for Developer ID Application and Developer ID Date.

DeveloperIdInstaller

Developer ID Installer.

Certificates are marked for EKU with Developer ID Application. They also have extensions Developer ID Installer and Developer ID Date.

Implementations

impl CertificateProfile

pub fn all() -> &'static [Self]

pub fn str_names() -> [&'static str; 5]

Obtain the string values that variants are recognized as.

Examples found in repository

src/cli.rs (line 2659)

pub fn main_impl() -> Result<(), AppleCodesignError> {
    let app = Command::new("Cross platform Apple code signing in pure Rust")
        .version(env!("CARGO_PKG_VERSION"))
        .author("Gregory Szorc <gregory.szorc@gmail.com>")
        .about("Sign and notarize Apple programs. See https://gregoryszorc.com/docs/apple-codesign/main/ for more docs.")
        .arg_required_else_help(true)
        .arg(
            Arg::new("verbose")
                .long("verbose")
                .short('v')
                .global(true)
                .action(ArgAction::Count)
                .help("Increase logging verbosity. Can be specified multiple times."),
        );

    let app = app.subcommand(add_certificate_source_args(
        Command::new("analyze-certificate")
            .about("Analyze an X.509 certificate for Apple code signing properties")
            .long_about(ANALYZE_CERTIFICATE_ABOUT),
    ));

    let app = app.subcommand(
        Command::new("compute-code-hashes")
            .about("Compute code hashes for a binary")
            .arg(
                Arg::new("path")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("path to Mach-O binary to examine"),
            )
            .arg(
                Arg::new("hash")
                    .long("hash")
                    .action(ArgAction::Set)
                    .value_parser(SUPPORTED_HASHES)
                    .default_value("sha256")
                    .help("Hashing algorithm to use"),
            )
            .arg(
                Arg::new("page_size")
                    .long("page-size")
                    .action(ArgAction::Set)
                    .default_value("4096")
                    .help("Chunk size to digest over"),
            )
            .arg(
                Arg::new("universal_index")
                    .long("universal-index")
                    .action(ArgAction::Set)
                    .default_value("0")
                    .help("Index of Mach-O binary to operate on within a universal/fat binary"),
            ),
    );

    let app = app.subcommand(
        Command::new("diff-signatures")
            .about("Print a diff between the signature content of two paths")
            .arg(
                Arg::new("path0")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("The first path to compare"),
            )
            .arg(
                Arg::new("path1")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("The second path to compare"),
            ),
    );

    let app = app.subcommand(
        Command::new("encode-app-store-connect-api-key")
            .about("Encode App Store Connect API Key metadata to a single file")
            .long_about(ENCODE_APP_STORE_CONNECT_API_KEY_ABOUT)
            .arg(
                Arg::new("output_path")
                    .short('o')
                    .long("output-path")
                    .action(ArgAction::Set)
                    .value_parser(value_parser!(PathBuf))
                    .help("Path to a JSON file to create the output to"),
            )
            .arg(
                Arg::new("issuer_id")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("The issuer of the API Token. Likely a UUID"),
            )
            .arg(
                Arg::new("key_id")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("The Key ID. A short alphanumeric string like DEADBEEF42"),
            )
            .arg(
                Arg::new("private_key_path")
                    .action(ArgAction::Set)
                    .required(true)
                    .value_parser(value_parser!(PathBuf))
                    .help("Path to a file containing the private key downloaded from Apple"),
            ),
    );

    let app = app.subcommand(
        Command::new("extract")
            .about("Extracts code signature data from a Mach-O binary")
            .long_about(EXTRACT_ABOUT)
            .arg(
                Arg::new("path")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("Path to Mach-O binary to examine"),
            )
            .arg(
                Arg::new("data")
                    .long("data")
                    .action(ArgAction::Set)
                    .value_parser([
                        "blobs",
                        "cms-info",
                        "cms-pem",
                        "cms-raw",
                        "cms",
                        "code-directory-raw",
                        "code-directory-serialized-raw",
                        "code-directory-serialized",
                        "code-directory",
                        "linkedit-info",
                        "linkedit-segment-raw",
                        "macho-load-commands",
                        "macho-segments",
                        "macho-target",
                        "requirements-raw",
                        "requirements-rust",
                        "requirements-serialized-raw",
                        "requirements-serialized",
                        "requirements",
                        "signature-raw",
                        "superblob",
                    ])
                    .default_value("linkedit-info")
                    .help("Which data to extract and how to format it"),
            )
            .arg(
                Arg::new("universal_index")
                    .long("universal-index")
                    .action(ArgAction::Set)
                    .default_value("0")
                    .help("Index of Mach-O binary to operate on within a universal/fat binary"),
            ),
    );

    let app = app.subcommand(
        add_certificate_source_args(Command::new("generate-certificate-signing-request")
            .about("Generates a certificate signing request that can be sent to Apple and exchanged for a signing certificate")
            .arg(
                Arg::new("csr_pem_path")
                    .long("csr-pem-path")
                    .action(ArgAction::Set)
                    .help("Path to file to write PEM encoded CSR to")
            )
    ));

    let app = app.subcommand(
        Command::new("generate-self-signed-certificate")
            .about("Generate a self-signed certificate for code signing")
            .long_about(GENERATE_SELF_SIGNED_CERTIFICATE_ABOUT)
            .arg(
                Arg::new("algorithm")
                    .long("algorithm")
                    .action(ArgAction::Set)
                    .value_parser(["ecdsa", "ed25519"])
                    .default_value("ecdsa")
                    .help("Which key type to use"),
            )
            .arg(
                Arg::new("profile")
                    .long("profile")
                    .action(ArgAction::Set)
                    .value_parser(CertificateProfile::str_names())
                    .default_value("apple-development"),
            )
            .arg(
                Arg::new("team_id")
                    .long("team-id")
                    .action(ArgAction::Set)
                    .default_value("unset")
                    .help(
                        "Team ID (this is a short string attached to your Apple Developer account)",
                    ),
            )
            .arg(
                Arg::new("person_name")
                    .long("person-name")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("The name of the person this certificate is for"),
            )
            .arg(
                Arg::new("country_name")
                    .long("country-name")
                    .action(ArgAction::Set)
                    .default_value("XX")
                    .help("Country Name (C) value for certificate identifier"),
            )
            .arg(
                Arg::new("validity_days")
                    .long("validity-days")
                    .action(ArgAction::Set)
                    .default_value("365")
                    .help("How many days the certificate should be valid for"),
            )
            .arg(
                Arg::new("pem_filename")
                    .long("pem-filename")
                    .action(ArgAction::Set)
                    .help("Base name of files to write PEM encoded certificate to"),
            ),
    );

    let app = app.
        subcommand(Command::new("keychain-export-certificate-chain")
            .about("Export Apple CA certificates from the macOS Keychain")
            .arg(
                Arg::new("domain")
                    .long("domain")
                    .action(ArgAction::Set)
                    .value_parser(["user", "system", "common", "dynamic"])
                    .default_value("user")
                    .help("Keychain domain to operate on")
            )
            .arg(
                Arg::new("password")
                    .long("--password")
                    .action(ArgAction::Set)
                    .help("Password to unlock the Keychain")
            )
            .arg(
                Arg::new("password_file")
                    .long("--password-file")
                    .action(ArgAction::Set)
                    .conflicts_with("password")
                    .help("File containing password to use to unlock the Keychain")
            )
           .arg(
                Arg::new("no_print_self")
                    .long("--no-print-self")
                    .action(ArgAction::SetTrue)
                    .help("Print only the issuing certificate chain, not the subject certificate")
           )
           .arg(
               Arg::new("user_id")
                    .long("--user-id")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("User ID value of code signing certificate to find and whose CA chain to export")
           ),
        );

    let app = app.subcommand(
        Command::new("keychain-print-certificates")
            .about("Print information about certificates in the macOS keychain")
            .arg(
                Arg::new("domain")
                    .long("--domain")
                    .action(ArgAction::Set)
                    .value_parser(["user", "system", "common", "dynamic"])
                    .default_value("user")
                    .help("Keychain domain to operate on"),
            ),
    );

    let app = app.subcommand(add_notary_api_args(
        Command::new("notary-log")
            .about("Fetch the notarization log for a previous submission")
            .arg(
                Arg::new("submission_id")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("The ID of the previous submission to wait on"),
            ),
    ));

    let app = app.subcommand(add_notary_api_args(
        Command::new("notary-submit")
            .about("Upload an asset to Apple for notarization and possibly staple it")
            .long_about(NOTARIZE_ABOUT)
            .alias("notarize")
            .arg(
                Arg::new("wait")
                    .long("wait")
                    .action(ArgAction::SetTrue)
                    .help("Whether to wait for upload processing to complete"),
            )
            .arg(
                Arg::new("max_wait_seconds")
                    .long("max-wait-seconds")
                    .action(ArgAction::Set)
                    .default_value("600")
                    .help("Maximum time in seconds to wait for the upload result"),
            )
            .arg(
                Arg::new("staple")
                    .long("staple")
                    .action(ArgAction::SetTrue)
                    .help(
                        "Staple the notarization ticket after successful upload (implies --wait)",
                    ),
            )
            .arg(
                Arg::new("path")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("Path to asset to upload"),
            ),
    ));

    let app = app.subcommand(add_notary_api_args(
        Command::new("notary-wait")
            .about("Wait for completion of a previous submission")
            .arg(
                Arg::new("max_wait_seconds")
                    .long("max-wait-seconds")
                    .action(ArgAction::Set)
                    .default_value("600")
                    .help("Maximum time in seconds to wait for the upload result"),
            )
            .arg(
                Arg::new("submission_id")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("The ID of the previous submission to wait on"),
            ),
    ));

    let app = app.subcommand(
        Command::new("parse-code-signing-requirement")
            .about("Parse binary Code Signing Requirement data into a human readable string")
            .long_about(PARSE_CODE_SIGNING_REQUIREMENT_ABOUT)
            .arg(
                Arg::new("format")
                    .long("--format")
                    .action(ArgAction::Set)
                    .required(true)
                    .value_parser(["csrl", "expression-tree"])
                    .default_value("csrl")
                    .help("Output format"),
            )
            .arg(
                Arg::new("input_path")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("Path to file to parse"),
            ),
    );

    let app = app.subcommand(
        Command::new("print-signature-info")
            .about("Print signature information for a filesystem path")
            .arg(
                Arg::new("path")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("Filesystem path to entity whose info to print"),
            ),
    );

    let app = app.subcommand(
        Command::new("smartcard-scan")
            .about("Show information about available smartcard (SC) devices"),
    );

    let app = app.subcommand(add_yubikey_policy_args(
        Command::new("smartcard-generate-key")
            .about("Generate a new private key on a smartcard")
            .arg(
                Arg::new("smartcard_slot")
                    .long("smartcard-slot")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("Smartcard slot number to store key in (9c is common)"),
            ),
    ));

    let app = app.subcommand(add_yubikey_policy_args(add_certificate_source_args(
        Command::new("smartcard-import")
            .about("Import a code signing certificate and key into a smartcard")
            .arg(
                Arg::new("existing_key")
                    .long("existing-key")
                    .action(ArgAction::SetTrue)
                    .help("Re-use the existing private key in the smartcard slot"),
            )
            .arg(
                Arg::new("dry_run")
                    .long("dry-run")
                    .action(ArgAction::SetTrue)
                    .help("Don't actually perform the import"),
            ),
    )));

    let app = app.subcommand(add_certificate_source_args(
        Command::new("remote-sign")
            .about("Create signatures initiated from a remote signing operation")
            .arg(
                Arg::new("session_join_string_editor")
                    .long("editor")
                    .action(ArgAction::SetTrue)
                    .help("Open an editor to input the session join string"),
            )
            .arg(
                Arg::new("session_join_string_path")
                    .long("sjs-path")
                    .action(ArgAction::Set)
                    .help("Path to file containing session join string"),
            )
            .arg(
                Arg::new("session_join_string")
                    .action(ArgAction::Set)
                    .help("Session join string (provided by the signing initiator)"),
            )
            .group(
                ArgGroup::new("session_join_string_source")
                    .arg("session_join_string_editor")
                    .arg("session_join_string_path")
                    .arg("session_join_string")
                    .required(true),
            ),
    ));

    let app = app
        .subcommand(
            add_certificate_source_args(Command::new("sign")
                .about("Sign a Mach-O binary or bundle")
                .long_about(SIGN_ABOUT)
                .arg(
                    Arg::new("binary_identifier")
                        .long("binary-identifier")
                        .action(ArgAction::Append)
                        .help("Identifier string for binary. The value normally used by CFBundleIdentifier")
                )
                .arg(
                    Arg::new("code_requirements_path")
                        .long("code-requirements-path")
                        .action(ArgAction::Append)
                        .help("Path to a file containing binary code requirements data to be used as designated requirements")
                )
                .arg(
                    Arg::new("code_resources")
                        .long("code-resources-path")
                        .action(ArgAction::Append)
                        .help("Path to an XML plist file containing code resources"),
                )
                .arg(
                    Arg::new("code_signature_flags_set")
                        .long("code-signature-flags")
                        .action(ArgAction::Append)
                        .value_parser(CodeSignatureFlags::all_user_configurable())
                        .help("Code signature flags to set")
                )
                .arg(
                    Arg::new("digest")
                        .long("digest")
                        .action(ArgAction::Set)
                        .value_parser(SUPPORTED_HASHES)
                        .default_value("sha256")
                        .help("Digest algorithm to use")
                )
                .arg(Arg::new("extra_digest")
                    .long("extra-digest")
                    .action(ArgAction::Append)
                    .value_parser(SUPPORTED_HASHES)
                    .help("Extra digests to include in signatures")
                )
                .arg(
                    Arg::new("entitlements_xml_path")
                        .long("entitlements-xml-path")
                        .short('e')
                        .action(ArgAction::Append)
                        .help("Path to a plist file containing entitlements"),
                )
                .arg(
                    Arg::new("runtime_version")
                        .long("runtime-version")
                        .action(ArgAction::Append)
                        .help("Hardened runtime version to use (defaults to SDK version used to build binary)"))
                .arg(
                    Arg::new("info_plist_path")
                        .long("info-plist-path")
                        .action(ArgAction::Append)
                        .help("Path to an Info.plist file whose digest to include in Mach-O signature")
                )
                .arg(
                    Arg::new(
                        "team_name")
                        .long("team-name")
                        .action(ArgAction::Set)
                        .help("Team name/identifier to include in code signature"
                    )
                )
                .arg(
                    Arg::new("timestamp_url")
                        .long("timestamp-url")
                        .action(ArgAction::Set)
                        .default_value(APPLE_TIMESTAMP_URL)
                        .help(
                            "URL of timestamp server to use to obtain a token of the CMS signature",
                        ),
                )
                .arg(
                    Arg::new("exclude")
                        .long("exclude")
                        .action(ArgAction::Append)
                        .help("Glob expression of paths to exclude from signing")
                )
                .arg(
                    Arg::new("smartcard_pin_env")
                        .long("smartcard-pin-env")
                        .conflicts_with_all(remote_initialization_args(Some(
                            "smartcard_pin_env",
                        )))
                        .action(ArgAction::Set)
                        .help("Environment variable holding the smartcard PIN"),
                )
                .arg(
                    Arg::new("input_path")
                        .action(ArgAction::Set)
                        .required(true)
                        .help("Path to Mach-O binary to sign"),
                )
                .arg(
                    Arg::new("output_path")
                        .action(ArgAction::Set)
                        .help("Path to signed Mach-O binary to write"),
                ),
        ));

    let app = app.subcommand(
        Command::new("staple")
            .about("Staples a notarization ticket to an entity")
            .arg(
                Arg::new("path")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("Path to entity to attempt to staple"),
            ),
    );

    let app = app.subcommand(
        Command::new("verify")
            .about("Verifies code signature data")
            .arg(
                Arg::new("path")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("Path of Mach-O binary to examine"),
            ),
    );

    let app = app.subcommand(
        Command::new("x509-oids")
            .about("Print information about X.509 OIDs related to Apple code signing"),
    );

    let matches = app.get_matches();

    // TODO make default log level warn once we audit logging sites.
    let log_level = match matches.get_count("verbose") {
        0 => LevelFilter::Info,
        1 => LevelFilter::Debug,
        _ => LevelFilter::Trace,
    };

    let mut builder = env_logger::Builder::from_env(
        env_logger::Env::default().default_filter_or(log_level.as_str()),
    );

    // Disable log context except at higher log levels.
    if log_level <= LevelFilter::Info {
        builder
            .format_timestamp(None)
            .format_level(false)
            .format_target(false);
    }

    // This spews unwanted output at default level. Nerf it by default.
    if log_level == LevelFilter::Info {
        builder.filter_module("rustls", LevelFilter::Error);
    }

    builder.init();

    match matches.subcommand() {
        Some(("analyze-certificate", args)) => command_analyze_certificate(args),
        Some(("compute-code-hashes", args)) => command_compute_code_hashes(args),
        Some(("diff-signatures", args)) => command_diff_signatures(args),
        Some(("encode-app-store-connect-api-key", args)) => {
            command_encode_app_store_connect_api_key(args)
        }
        Some(("extract", args)) => command_extract(args),
        Some(("generate-certificate-signing-request", args)) => {
            command_generate_certificate_signing_request(args)
        }
        Some(("generate-self-signed-certificate", args)) => {
            command_generate_self_signed_certificate(args)
        }
        Some(("keychain-export-certificate-chain", args)) => {
            command_keychain_export_certificate_chain(args)
        }
        Some(("keychain-print-certificates", args)) => command_keychain_print_certificates(args),
        Some(("notary-log", args)) => command_notary_log(args),
        Some(("notary-submit", args)) => command_notary_submit(args),
        Some(("notary-wait", args)) => command_notary_wait(args),
        Some(("parse-code-signing-requirement", args)) => {
            command_parse_code_signing_requirement(args)
        }
        Some(("print-signature-info", args)) => command_print_signature_info(args),
        Some(("remote-sign", args)) => command_remote_sign(args),
        Some(("sign", args)) => command_sign(args),
        Some(("smartcard-generate-key", args)) => command_smartcard_generate_key(args),
        Some(("smartcard-import", args)) => command_smartcard_import(args),
        Some(("smartcard-scan", args)) => command_smartcard_scan(args),
        Some(("staple", args)) => command_staple(args),
        Some(("verify", args)) => command_verify(args),
        Some(("x509-oids", args)) => command_x509_oids(args),
        _ => Err(AppleCodesignError::CliUnknownCommand),
    }
}

Trait Implementations

impl Clone for CertificateProfile

fn clone(&self) -> CertificateProfile

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CertificateProfile

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for CertificateProfile

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl FromStr for CertificateProfile

type Err = AppleCodesignError

The associated error which can be returned from parsing.

fn from_str(s: &str) -> Result<Self, Self::Err>

Parses a string s to return a value of this type.

impl PartialEq<CertificateProfile> for CertificateProfile

fn eq(&self, other: &CertificateProfile) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Copy for CertificateProfile

impl Eq for CertificateProfile

impl StructuralEq for CertificateProfile

impl StructuralPartialEq for CertificateProfile