Enum apple_codesign::ExecutionPolicy

pub enum ExecutionPolicy {
    DeveloperIdSigned,
    DeveloperIdNotarizedExecutable,
    DeveloperIdNotarizedInstaller,
}

Defines well-known execution policies for signed code.

Instances can be obtained from a human-readable string for convenience. Those strings are:

• developer-id-signed
• developer-id-notarized-executable
• developer-id-notarized-installer

Variants

DeveloperIdSigned

Code is signed by a certificate authorized for signing Mac applications or installers and that certificate was issued by crate::apple_certificates::KnownCertificate::DeveloperIdG1 or crate::apple_certificates::KnownCertificate::DeveloperIdG2.

This is the policy that applies when you get a Developer ID Application or Developer ID Installer certificate from Apple.

DeveloperIdNotarizedExecutable

Like Self::DeveloperIdSigned but only applies to executables (not installers) and the executable must be notarized.

If you notarize an individual executable, you effectively convert the Self::DeveloperIdSigned policy into this variant.

DeveloperIdNotarizedInstaller

Like Self::DeveloperIdSigned but only applies to installers (not executables) and the installer must be notarized.

If you notarize an individual installer, you effectively convert the Self::DeveloperIdSigned policy into this variant.

Methods from Deref<Target = CodeRequirementExpression<'static>>

pub fn write_to(&self, dest: &mut impl Write) -> Result<(), AppleCodesignError>

Write binary representation of this expression to a destination.

Examples found in repository

src/code_requirement.rs (line 818)

    pub fn write_to(&self, dest: &mut impl Write) -> Result<(), AppleCodesignError> {
        dest.iowrite_with(RequirementOpCode::from(self) as u32, scroll::BE)?;

        match self {
            Self::False => {}
            Self::True => {}
            Self::Identifier(s) => {
                write_data(dest, s.as_bytes())?;
            }
            Self::AnchorApple => {}
            Self::AnchorCertificateHash(slot, hash) => {
                dest.iowrite_with(*slot, scroll::BE)?;
                write_data(dest, hash)?;
            }
            Self::InfoKeyValueLegacy(key, value) => {
                write_data(dest, key.as_bytes())?;
                write_data(dest, value.as_bytes())?;
            }
            Self::And(a, b) => {
                a.write_to(dest)?;
                b.write_to(dest)?;
            }
            Self::Or(a, b) => {
                a.write_to(dest)?;
                b.write_to(dest)?;
            }
            Self::CodeDirectoryHash(hash) => {
                write_data(dest, hash)?;
            }
            Self::Not(expr) => {
                expr.write_to(dest)?;
            }
            Self::InfoPlistKeyField(key, m) => {
                write_data(dest, key.as_bytes())?;
                m.write_to(dest)?;
            }
            Self::CertificateField(slot, field, m) => {
                dest.iowrite_with(*slot, scroll::BE)?;
                write_data(dest, field.as_bytes())?;
                m.write_to(dest)?;
            }
            Self::CertificateTrusted(slot) => {
                dest.iowrite_with(*slot, scroll::BE)?;
            }
            Self::AnchorTrusted => {}
            Self::CertificateGeneric(slot, oid, m) => {
                dest.iowrite_with(*slot, scroll::BE)?;
                write_data(dest, oid.as_ref())?;
                m.write_to(dest)?;
            }
            Self::AnchorAppleGeneric => {}
            Self::EntitlementsKey(key, m) => {
                write_data(dest, key.as_bytes())?;
                m.write_to(dest)?;
            }
            Self::CertificatePolicy(slot, oid, m) => {
                dest.iowrite_with(*slot, scroll::BE)?;
                write_data(dest, oid.as_ref())?;
                m.write_to(dest)?;
            }
            Self::NamedAnchor(value) => {
                write_data(dest, value.as_bytes())?;
            }
            Self::NamedCode(value) => {
                write_data(dest, value.as_bytes())?;
            }
            Self::Platform(value) => {
                dest.iowrite_with(*value, scroll::BE)?;
            }
            Self::Notarized => {}
            Self::CertificateFieldDate(slot, oid, m) => {
                dest.iowrite_with(*slot, scroll::BE)?;
                write_data(dest, oid.as_ref())?;
                m.write_to(dest)?;
            }
            Self::LegacyDeveloperId => {}
        }

        Ok(())
    }

    /// Produce the binary serialization of this expression.
    ///
    /// The blob header/magic is not included.
    pub fn to_bytes(&self) -> Result<Vec<u8>, AppleCodesignError> {
        let mut res = vec![];

        self.write_to(&mut res)?;

        Ok(res)
    }
}

/// A code requirement match expression type.
#[derive(Clone, Copy, Debug, PartialEq)]
#[repr(u32)]
enum MatchType {
    Exists = 0,
    Equal = 1,
    Contains = 2,
    BeginsWith = 3,
    EndsWith = 4,
    LessThan = 5,
    GreaterThan = 6,
    LessThanEqual = 7,
    GreaterThanEqual = 8,
    On = 9,
    Before = 10,
    After = 11,
    OnOrBefore = 12,
    OnOrAfter = 13,
    Absent = 14,
}

impl TryFrom<u32> for MatchType {
    type Error = AppleCodesignError;

    fn try_from(v: u32) -> Result<Self, Self::Error> {
        match v {
            0 => Ok(Self::Exists),
            1 => Ok(Self::Equal),
            2 => Ok(Self::Contains),
            3 => Ok(Self::BeginsWith),
            4 => Ok(Self::EndsWith),
            5 => Ok(Self::LessThan),
            6 => Ok(Self::GreaterThan),
            7 => Ok(Self::LessThanEqual),
            8 => Ok(Self::GreaterThanEqual),
            9 => Ok(Self::On),
            10 => Ok(Self::Before),
            11 => Ok(Self::After),
            12 => Ok(Self::OnOrBefore),
            13 => Ok(Self::OnOrAfter),
            14 => Ok(Self::Absent),
            _ => Err(AppleCodesignError::RequirementUnknownMatchExpression(v)),
        }
    }
}

impl MatchType {
    /// Parse the payload of a match expression.
    pub fn parse_payload<'a>(
        &self,
        data: &'a [u8],
    ) -> Result<(CodeRequirementMatchExpression<'a>, &'a [u8]), AppleCodesignError> {
        match self {
            Self::Exists => Ok((CodeRequirementMatchExpression::Exists, data)),
            Self::Equal => {
                let (value, data) = read_data(data)?;

                Ok((CodeRequirementMatchExpression::Equal(value.into()), data))
            }
            Self::Contains => {
                let (value, data) = read_data(data)?;

                Ok((CodeRequirementMatchExpression::Contains(value.into()), data))
            }
            Self::BeginsWith => {
                let (value, data) = read_data(data)?;

                Ok((
                    CodeRequirementMatchExpression::BeginsWith(value.into()),
                    data,
                ))
            }
            Self::EndsWith => {
                let (value, data) = read_data(data)?;

                Ok((CodeRequirementMatchExpression::EndsWith(value.into()), data))
            }
            Self::LessThan => {
                let (value, data) = read_data(data)?;

                Ok((CodeRequirementMatchExpression::LessThan(value.into()), data))
            }
            Self::GreaterThan => {
                let (value, data) = read_data(data)?;

                Ok((
                    CodeRequirementMatchExpression::GreaterThan(value.into()),
                    data,
                ))
            }
            Self::LessThanEqual => {
                let (value, data) = read_data(data)?;

                Ok((
                    CodeRequirementMatchExpression::LessThanEqual(value.into()),
                    data,
                ))
            }
            Self::GreaterThanEqual => {
                let (value, data) = read_data(data)?;

                Ok((
                    CodeRequirementMatchExpression::GreaterThanEqual(value.into()),
                    data,
                ))
            }
            Self::On => {
                let value = data.pread_with::<i64>(0, scroll::BE)?;

                Ok((
                    CodeRequirementMatchExpression::On(
                        chrono::Utc
                            .timestamp_opt(value, 0)
                            .single()
                            .ok_or(AppleCodesignError::BadTime)?,
                    ),
                    &data[8..],
                ))
            }
            Self::Before => {
                let value = data.pread_with::<i64>(0, scroll::BE)?;

                Ok((
                    CodeRequirementMatchExpression::Before(
                        chrono::Utc
                            .timestamp_opt(value, 0)
                            .single()
                            .ok_or(AppleCodesignError::BadTime)?,
                    ),
                    &data[8..],
                ))
            }
            Self::After => {
                let value = data.pread_with::<i64>(0, scroll::BE)?;

                Ok((
                    CodeRequirementMatchExpression::After(
                        chrono::Utc
                            .timestamp_opt(value, 0)
                            .single()
                            .ok_or(AppleCodesignError::BadTime)?,
                    ),
                    &data[8..],
                ))
            }
            Self::OnOrBefore => {
                let value = data.pread_with::<i64>(0, scroll::BE)?;

                Ok((
                    CodeRequirementMatchExpression::OnOrBefore(
                        chrono::Utc
                            .timestamp_opt(value, 0)
                            .single()
                            .ok_or(AppleCodesignError::BadTime)?,
                    ),
                    &data[8..],
                ))
            }
            Self::OnOrAfter => {
                let value = data.pread_with::<i64>(0, scroll::BE)?;

                Ok((
                    CodeRequirementMatchExpression::OnOrAfter(
                        chrono::Utc
                            .timestamp_opt(value, 0)
                            .single()
                            .ok_or(AppleCodesignError::BadTime)?,
                    ),
                    &data[8..],
                ))
            }
            Self::Absent => Ok((CodeRequirementMatchExpression::Absent, data)),
        }
    }
}

/// An instance of a match expression in a [CodeRequirementExpression].
#[derive(Clone, Debug, Eq, PartialEq)]
pub enum CodeRequirementMatchExpression<'a> {
    /// Entity exists.
    ///
    /// `exists`
    ///
    /// No payload.
    Exists,

    /// Equality.
    ///
    /// `= <value>`
    ///
    /// 4 bytes length, raw data.
    Equal(CodeRequirementValue<'a>),

    /// Contains.
    ///
    /// `~ <value>`
    ///
    /// 4 bytes length, raw data.
    Contains(CodeRequirementValue<'a>),

    /// Begins with.
    ///
    /// `= <value>*`
    ///
    /// 4 bytes length, raw data.
    BeginsWith(CodeRequirementValue<'a>),

    /// Ends with.
    ///
    /// `= *<value>`
    ///
    /// 4 bytes length, raw data.
    EndsWith(CodeRequirementValue<'a>),

    /// Less than.
    ///
    /// `< <value>`
    ///
    /// 4 bytes length, raw data.
    LessThan(CodeRequirementValue<'a>),

    /// Greater than.
    ///
    /// `> <value>`
    GreaterThan(CodeRequirementValue<'a>),

    /// Less than or equal to.
    ///
    /// `<= <value>`
    ///
    /// 4 bytes length, raw data.
    LessThanEqual(CodeRequirementValue<'a>),

    /// Greater than or equal to.
    ///
    /// `>= <value>`
    ///
    /// 4 bytes length, raw data.
    GreaterThanEqual(CodeRequirementValue<'a>),

    /// Timestamp value equivalent.
    ///
    /// `= timestamp "<timestamp>"`
    On(chrono::DateTime<chrono::Utc>),

    /// Timestamp value before.
    ///
    /// `< timestamp "<timestamp>"`
    Before(chrono::DateTime<chrono::Utc>),

    /// Timestamp value after.
    ///
    /// `> timestamp "<timestamp>"`
    After(chrono::DateTime<chrono::Utc>),

    /// Timestamp value equivalent or before.
    ///
    /// `<= timestamp "<timestamp>"`
    OnOrBefore(chrono::DateTime<chrono::Utc>),

    /// Timestamp value equivalent or after.
    ///
    /// `>= timestamp "<timestamp>"`
    OnOrAfter(chrono::DateTime<chrono::Utc>),

    /// Value is absent.
    ///
    /// `<empty>`
    ///
    /// No payload.
    Absent,
}

impl<'a> Display for CodeRequirementMatchExpression<'a> {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            Self::Exists => f.write_str("/* exists */"),
            Self::Equal(value) => f.write_fmt(format_args!("= \"{value}\"")),
            Self::Contains(value) => f.write_fmt(format_args!("~ \"{value}\"")),
            Self::BeginsWith(value) => f.write_fmt(format_args!("= \"{value}*\"")),
            Self::EndsWith(value) => f.write_fmt(format_args!("= \"*{value}\"")),
            Self::LessThan(value) => f.write_fmt(format_args!("< \"{value}\"")),
            Self::GreaterThan(value) => f.write_fmt(format_args!("> \"{value}\"")),
            Self::LessThanEqual(value) => f.write_fmt(format_args!("<= \"{value}\"")),
            Self::GreaterThanEqual(value) => f.write_fmt(format_args!(">= \"{value}\"")),
            Self::On(value) => f.write_fmt(format_args!("= \"{value}\"")),
            Self::Before(value) => f.write_fmt(format_args!("< \"{value}\"")),
            Self::After(value) => f.write_fmt(format_args!("> \"{value}\"")),
            Self::OnOrBefore(value) => f.write_fmt(format_args!("<= \"{value}\"")),
            Self::OnOrAfter(value) => f.write_fmt(format_args!(">= \"{value}\"")),
            Self::Absent => f.write_str("absent"),
        }
    }
}

impl<'a> From<&CodeRequirementMatchExpression<'a>> for MatchType {
    fn from(m: &CodeRequirementMatchExpression<'a>) -> Self {
        match m {
            CodeRequirementMatchExpression::Exists => MatchType::Exists,
            CodeRequirementMatchExpression::Equal(_) => MatchType::Equal,
            CodeRequirementMatchExpression::Contains(_) => MatchType::Contains,
            CodeRequirementMatchExpression::BeginsWith(_) => MatchType::BeginsWith,
            CodeRequirementMatchExpression::EndsWith(_) => MatchType::EndsWith,
            CodeRequirementMatchExpression::LessThan(_) => MatchType::LessThan,
            CodeRequirementMatchExpression::GreaterThan(_) => MatchType::GreaterThan,
            CodeRequirementMatchExpression::LessThanEqual(_) => MatchType::LessThanEqual,
            CodeRequirementMatchExpression::GreaterThanEqual(_) => MatchType::GreaterThanEqual,
            CodeRequirementMatchExpression::On(_) => MatchType::On,
            CodeRequirementMatchExpression::Before(_) => MatchType::Before,
            CodeRequirementMatchExpression::After(_) => MatchType::After,
            CodeRequirementMatchExpression::OnOrBefore(_) => MatchType::OnOrBefore,
            CodeRequirementMatchExpression::OnOrAfter(_) => MatchType::OnOrAfter,
            CodeRequirementMatchExpression::Absent => MatchType::Absent,
        }
    }
}

impl<'a> CodeRequirementMatchExpression<'a> {
    /// Parse a match expression from bytes.
    ///
    /// The slice should begin with the match type u32.
    pub fn from_bytes(data: &'a [u8]) -> Result<(Self, &'a [u8]), AppleCodesignError> {
        let typ = data.pread_with::<u32>(0, scroll::BE)?;

        let typ = MatchType::try_from(typ)?;

        typ.parse_payload(&data[4..])
    }

    /// Write binary representation of this match expression to a destination.
    pub fn write_to(&self, dest: &mut impl Write) -> Result<(), AppleCodesignError> {
        dest.iowrite_with(MatchType::from(self) as u32, scroll::BE)?;

        match self {
            Self::Exists => {}
            Self::Equal(value) => value.write_encoded(dest)?,
            Self::Contains(value) => value.write_encoded(dest)?,
            Self::BeginsWith(value) => value.write_encoded(dest)?,
            Self::EndsWith(value) => value.write_encoded(dest)?,
            Self::LessThan(value) => value.write_encoded(dest)?,
            Self::GreaterThan(value) => value.write_encoded(dest)?,
            Self::LessThanEqual(value) => value.write_encoded(dest)?,
            Self::GreaterThanEqual(value) => value.write_encoded(dest)?,
            Self::On(value) => dest.iowrite_with(value.timestamp(), scroll::BE)?,
            Self::Before(value) => dest.iowrite_with(value.timestamp(), scroll::BE)?,
            Self::After(value) => dest.iowrite_with(value.timestamp(), scroll::BE)?,
            Self::OnOrBefore(value) => dest.iowrite_with(value.timestamp(), scroll::BE)?,
            Self::OnOrAfter(value) => dest.iowrite_with(value.timestamp(), scroll::BE)?,
            Self::Absent => {}
        }

        Ok(())
    }
}

/// Represents a series of [CodeRequirementExpression].
#[derive(Clone, Debug, Default, PartialEq)]
pub struct CodeRequirements<'a>(Vec<CodeRequirementExpression<'a>>);

impl<'a> Deref for CodeRequirements<'a> {
    type Target = Vec<CodeRequirementExpression<'a>>;

    fn deref(&self) -> &Self::Target {
        &self.0
    }
}

impl<'a> DerefMut for CodeRequirements<'a> {
    fn deref_mut(&mut self) -> &mut Self::Target {
        &mut self.0
    }
}

impl<'a> Display for CodeRequirements<'a> {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        for (i, expr) in self.0.iter().enumerate() {
            f.write_fmt(format_args!("{i}: {expr};"))?;
        }

        Ok(())
    }
}

impl<'a> From<Vec<CodeRequirementExpression<'a>>> for CodeRequirements<'a> {
    fn from(v: Vec<CodeRequirementExpression<'a>>) -> Self {
        Self(v)
    }
}

impl<'a> CodeRequirements<'a> {
    /// Parse the binary serialization of code requirements.
    ///
    /// This parses the data that follows the requirement blob header/magic that
    /// usually accompanies the binary representation of code requirements.
    pub fn parse_binary(data: &'a [u8]) -> Result<(Self, &'a [u8]), AppleCodesignError> {
        let count = data.pread_with::<u32>(0, scroll::BE)?;
        let mut data = &data[4..];

        let mut elements = Vec::with_capacity(count as usize);

        for _ in 0..count {
            let res = CodeRequirementExpression::from_bytes(data)?;

            elements.push(res.0);
            data = res.1;
        }

        Ok((Self(elements), data))
    }

    /// Parse a code requirement blob, which begins with header magic.
    ///
    /// This can be used to parse the output generated by `csreq -b`.
    pub fn parse_blob(data: &'a [u8]) -> Result<(Self, &'a [u8]), AppleCodesignError> {
        let data = read_and_validate_blob_header(
            data,
            u32::from(CodeSigningMagic::Requirement),
            "code requirement blob",
        )
        .map_err(|_| AppleCodesignError::RequirementMalformed("blob header"))?;

        Self::parse_binary(data)
    }

    /// Write binary representation of these expressions to a destination.
    ///
    /// The blob header/magic is not written.
    pub fn write_to(&self, dest: &mut impl Write) -> Result<(), AppleCodesignError> {
        dest.iowrite_with(self.0.len() as u32, scroll::BE)?;
        for e in &self.0 {
            e.write_to(dest)?;
        }

        Ok(())
    }

pub fn to_bytes(&self) -> Result<Vec<u8>, AppleCodesignError>

Produce the binary serialization of this expression.

The blob header/magic is not included.

Examples found in repository

src/signing_settings.rs (line 536)

    pub fn set_designated_requirement_expression(
        &mut self,
        scope: SettingsScope,
        expr: &CodeRequirementExpression,
    ) -> Result<(), AppleCodesignError> {
        self.designated_requirement.insert(
            scope,
            DesignatedRequirementMode::Explicit(vec![expr.to_bytes()?]),
        );

        Ok(())
    }

    /// Set the designated requirement expression for a Mach-O binary given serialized bytes.
    ///
    /// This is like [SigningSettings::set_designated_requirement_expression] except the
    /// designated requirement expression is given as serialized bytes. The bytes passed are
    /// the value that would be produced by compiling a code requirement expression via
    /// `csreq -b`.
    pub fn set_designated_requirement_bytes(
        &mut self,
        scope: SettingsScope,
        data: impl AsRef<[u8]>,
    ) -> Result<(), AppleCodesignError> {
        let blob = RequirementBlob::from_blob_bytes(data.as_ref())?;

        self.designated_requirement.insert(
            scope,
            DesignatedRequirementMode::Explicit(
                blob.parse_expressions()?
                    .iter()
                    .map(|x| x.to_bytes())
                    .collect::<Result<Vec<_>, AppleCodesignError>>()?,
            ),
        );

        Ok(())
    }

Trait Implementations

impl Deref for ExecutionPolicy

type Target = CodeRequirementExpression<'static>

The resulting type after dereferencing.

fn deref(&self) -> &Self::Target

Dereferences the value.

impl TryFrom<&str> for ExecutionPolicy

type Error = AppleCodesignError

The type returned in the event of a conversion error.

fn try_from(s: &str) -> Result<Self, Self::Error>

Performs the conversion.