Struct apple_codesign::CodeSignatureFlags

pub struct CodeSignatureFlags { /* private fields */ }

Code signature flags.

These flags are embedded in the Code Directory and govern use of the embedded signature.

Implementations

impl CodeSignatureFlags

pub const HOST: Self = _

Code may act as a host that controls and supervises guest code.

pub const ADHOC: Self = _

The code has been sealed without a signing identity.

pub const FORCE_HARD: Self = _

Set the “hard” status bit for the code when it starts running.

pub const FORCE_KILL: Self = _

Implicitly set the “kill” status bit for the code when it starts running.

pub const FORCE_EXPIRATION: Self = _

Force certificate expiration checks.

pub const RESTRICT: Self = _

Restrict dyld loading.

pub const ENFORCEMENT: Self = _

Enforce code signing.

pub const LIBRARY_VALIDATION: Self = _

Library validation required.

pub const RUNTIME: Self = _

Apply runtime hardening policies.

pub const LINKER_SIGNED: Self = _

The code was automatically signed by the linker.

This signature should be ignored in any new signing operation.

pub const fn empty() -> Self

Returns an empty set of flags.

Examples found in repository

src/code_directory.rs (line 88)

    pub fn from_strs(s: &[&str]) -> Result<CodeSignatureFlags, AppleCodesignError> {
        let mut flags = CodeSignatureFlags::empty();

        for s in s {
            flags |= Self::from_str(s)?;
        }

        Ok(flags)
    }

src/macho_signing.rs (line 426)

    pub fn create_code_directory(
        &self,
        settings: &SigningSettings,
        macho: &MachOBinary,
    ) -> Result<CodeDirectoryBlob<'static>, AppleCodesignError> {
        // TODO support defining or filling in proper values for fields with
        // static values.

        let target = macho.find_targeting()?;

        if let Some(target) = &target {
            info!(
                "binary targets {} >= {} with SDK {}",
                target.platform, target.minimum_os_version, target.sdk_version,
            );
        }

        let mut flags = CodeSignatureFlags::empty();

        if let Some(additional) = settings.code_signature_flags(SettingsScope::Main) {
            info!(
                "adding code signature flags from signing settings: {:?}",
                additional
            );
            flags |= additional;
        }

        // The adhoc flag is set when there is no CMS signature.
        if settings.signing_key().is_none() {
            info!("creating ad-hoc signature");
            flags |= CodeSignatureFlags::ADHOC;
        } else if flags.contains(CodeSignatureFlags::ADHOC) {
            info!("removing ad-hoc code signature flag");
            flags -= CodeSignatureFlags::ADHOC;
        }

        // Remove linker signed flag because we're not a linker.
        if flags.contains(CodeSignatureFlags::LINKER_SIGNED) {
            info!("removing linker signed flag from code signature (we're not a linker)");
            flags -= CodeSignatureFlags::LINKER_SIGNED;
        }

        // Code limit fields hold the file offset at which code digests stop. This
        // is the file offset in the `__LINKEDIT` segment when the embedded signature
        // SuperBlob begins.
        let (code_limit, code_limit_64) = match macho.code_limit_binary_offset()? {
            x if x > u32::MAX as u64 => (0, Some(x)),
            x => (x as u32, None),
        };

        let platform = 0;
        let page_size = 4096u32;

        let (exec_seg_base, exec_seg_limit) = macho.executable_segment_boundary()?;
        let (exec_seg_base, exec_seg_limit) = (Some(exec_seg_base), Some(exec_seg_limit));

        // Executable segment flags are wonky.
        //
        // Foremost, these flags are only present if the Mach-O binary is an executable. So not
        // matter what the settings say, we don't set these flags unless the Mach-O file type
        // is proper.
        //
        // Executable segment flags are also derived from an associated entitlements plist.
        let exec_seg_flags = if macho.is_executable() {
            if let Some(entitlements) = settings.entitlements_plist(SettingsScope::Main) {
                let flags = plist_to_executable_segment_flags(entitlements);

                if !flags.is_empty() {
                    info!("entitlements imply executable segment flags: {:?}", flags);
                }

                Some(flags | ExecutableSegmentFlags::MAIN_BINARY)
            } else {
                Some(ExecutableSegmentFlags::MAIN_BINARY)
            }
        } else {
            None
        };

        // The runtime version is the SDK version from the targeting loader commands. Same
        // u32 with nibbles encoding the version.
        //
        // If the runtime code signature flag is set, we also need to set the runtime version
        // or else the activation of the hardened runtime is incomplete.

        // If the settings defines a runtime version override, use it.
        let runtime = match settings.runtime_version(SettingsScope::Main) {
            Some(version) => {
                info!(
                    "using hardened runtime version {} from signing settings",
                    version
                );
                Some(semver_to_macho_target_version(version))
            }
            None => None,
        };

        // If we still don't have a runtime but need one, derive from the target SDK.
        let runtime = if runtime.is_none() && flags.contains(CodeSignatureFlags::RUNTIME) {
            if let Some(target) = &target {
                info!(
                    "using hardened runtime version {} derived from SDK version",
                    target.sdk_version
                );
                Some(semver_to_macho_target_version(&target.sdk_version))
            } else {
                warn!("hardened runtime version required but unable to derive suitable version; signature will likely fail Apple checks");
                None
            }
        } else {
            runtime
        };

        let code_hashes = macho
            .code_digests(*settings.digest_type(), page_size as _)?
            .into_iter()
            .map(|v| Digest { data: v.into() })
            .collect::<Vec<_>>();

        let mut special_hashes = HashMap::new();

        // There is no corresponding blob for the info plist data since it is provided
        // externally to the embedded signature.
        if let Some(data) = settings.info_plist_data(SettingsScope::Main) {
            special_hashes.insert(
                CodeSigningSlot::Info,
                Digest {
                    data: settings.digest_type().digest_data(data)?.into(),
                },
            );
        }

        // There is no corresponding blob for resources data since it is provided
        // externally to the embedded signature.
        if let Some(data) = settings.code_resources_data(SettingsScope::Main) {
            special_hashes.insert(
                CodeSigningSlot::ResourceDir,
                Digest {
                    data: settings.digest_type().digest_data(data)?.into(),
                }
                .to_owned(),
            );
        }

        let ident = Cow::Owned(
            settings
                .binary_identifier(SettingsScope::Main)
                .ok_or(AppleCodesignError::NoIdentifier)?
                .to_string(),
        );

        let team_name = settings.team_id().map(|x| Cow::Owned(x.to_string()));

        let mut cd = CodeDirectoryBlob {
            flags,
            code_limit,
            digest_size: settings.digest_type().hash_len()? as u8,
            digest_type: *settings.digest_type(),
            platform,
            page_size,
            code_limit_64,
            exec_seg_base,
            exec_seg_limit,
            exec_seg_flags,
            runtime,
            ident,
            team_name,
            code_digests: code_hashes,
            ..Default::default()
        };

        for (slot, digest) in special_hashes {
            cd.set_slot_digest(slot, digest)?;
        }

        cd.adjust_version(target);
        cd.clear_newer_fields();

        Ok(cd)
    }

pub const fn all() -> Self

Returns the set containing all flags.

pub const fn bits(&self) -> u32

Returns the raw value of the flags currently stored.

pub const fn from_bits(bits: u32) -> Option<Self>

Convert from underlying bit representation, unless that representation contains bits that do not correspond to a flag.

pub const fn from_bits_truncate(bits: u32) -> Self

Convert from underlying bit representation, dropping any bits that do not correspond to flags.

pub const unsafe fn from_bits_unchecked(bits: u32) -> Self

Convert from underlying bit representation, preserving all bits (even those not corresponding to a defined flag).

Safety

The caller of the bitflags! macro can chose to allow or disallow extra bits for their bitflags type.

The caller of from_bits_unchecked() has to ensure that all bits correspond to a defined flag or that extra bits are valid for this bitflags type.

Examples found in repository

src/code_directory.rs (line 248)

    fn from_blob_bytes(data: &'a [u8]) -> Result<Self, AppleCodesignError> {
        read_and_validate_blob_header(data, Self::magic(), "code directory blob")?;

        let offset = &mut 8;

        let version = data.gread_with(offset, scroll::BE)?;
        let flags = data.gread_with::<u32>(offset, scroll::BE)?;
        let flags = unsafe { CodeSignatureFlags::from_bits_unchecked(flags) };
        assert_eq!(*offset, 0x10);
        let digest_offset = data.gread_with::<u32>(offset, scroll::BE)?;
        let ident_offset = data.gread_with::<u32>(offset, scroll::BE)?;
        let n_special_slots = data.gread_with::<u32>(offset, scroll::BE)?;
        let n_code_slots = data.gread_with::<u32>(offset, scroll::BE)?;
        assert_eq!(*offset, 0x20);
        let code_limit = data.gread_with(offset, scroll::BE)?;
        let digest_size = data.gread_with(offset, scroll::BE)?;
        let digest_type = data.gread_with::<u8>(offset, scroll::BE)?.into();
        let platform = data.gread_with(offset, scroll::BE)?;
        let page_size = data.gread_with::<u8>(offset, scroll::BE)?;
        let page_size = 2u32.pow(page_size as u32);
        let spare2 = data.gread_with(offset, scroll::BE)?;

        let scatter_offset = if version >= CodeDirectoryVersion::SupportsScatter as u32 {
            let v = data.gread_with(offset, scroll::BE)?;

            if v != 0 {
                Some(v)
            } else {
                None
            }
        } else {
            None
        };
        let team_offset = if version >= CodeDirectoryVersion::SupportsTeamId as u32 {
            assert_eq!(*offset, 0x30);
            let v = data.gread_with::<u32>(offset, scroll::BE)?;

            if v != 0 {
                Some(v)
            } else {
                None
            }
        } else {
            None
        };

        let (spare3, code_limit_64) = if version >= CodeDirectoryVersion::SupportsCodeLimit64 as u32
        {
            (
                Some(data.gread_with(offset, scroll::BE)?),
                Some(data.gread_with(offset, scroll::BE)?),
            )
        } else {
            (None, None)
        };

        let (exec_seg_base, exec_seg_limit, exec_seg_flags) =
            if version >= CodeDirectoryVersion::SupportsExecutableSegment as u32 {
                assert_eq!(*offset, 0x40);
                (
                    Some(data.gread_with(offset, scroll::BE)?),
                    Some(data.gread_with(offset, scroll::BE)?),
                    Some(data.gread_with::<u64>(offset, scroll::BE)?),
                )
            } else {
                (None, None, None)
            };

        let exec_seg_flags = exec_seg_flags
            .map(|flags| unsafe { ExecutableSegmentFlags::from_bits_unchecked(flags) });

        let (runtime, pre_encrypt_offset) =
            if version >= CodeDirectoryVersion::SupportsRuntime as u32 {
                assert_eq!(*offset, 0x58);
                (
                    Some(data.gread_with(offset, scroll::BE)?),
                    Some(data.gread_with(offset, scroll::BE)?),
                )
            } else {
                (None, None)
            };

        let (linkage_hash_type, linkage_truncated, spare4, linkage_offset, linkage_size) =
            if version >= CodeDirectoryVersion::SupportsLinkage as u32 {
                assert_eq!(*offset, 0x60);
                (
                    Some(data.gread_with(offset, scroll::BE)?),
                    Some(data.gread_with(offset, scroll::BE)?),
                    Some(data.gread_with(offset, scroll::BE)?),
                    Some(data.gread_with(offset, scroll::BE)?),
                    Some(data.gread_with(offset, scroll::BE)?),
                )
            } else {
                (None, None, None, None, None)
            };

        // Find trailing null in identifier string.
        let ident = match data[ident_offset as usize..]
            .split(|&b| b == 0)
            .map(std::str::from_utf8)
            .next()
        {
            Some(res) => {
                Cow::from(res.map_err(|_| AppleCodesignError::CodeDirectoryMalformedIdentifier)?)
            }
            None => {
                return Err(AppleCodesignError::CodeDirectoryMalformedIdentifier);
            }
        };

        let team_name = if let Some(team_offset) = team_offset {
            match data[team_offset as usize..]
                .split(|&b| b == 0)
                .map(std::str::from_utf8)
                .next()
            {
                Some(res) => {
                    Some(Cow::from(res.map_err(|_| {
                        AppleCodesignError::CodeDirectoryMalformedTeam
                    })?))
                }
                None => {
                    return Err(AppleCodesignError::CodeDirectoryMalformedTeam);
                }
            }
        } else {
            None
        };

        let code_digests = get_hashes(
            data,
            digest_offset as usize,
            n_code_slots as usize,
            digest_size as usize,
        );

        let special_digests = get_hashes(
            data,
            (digest_offset - (digest_size as u32 * n_special_slots)) as usize,
            n_special_slots as usize,
            digest_size as usize,
        )
        .into_iter()
        .enumerate()
        .map(|(i, h)| (CodeSigningSlot::from(n_special_slots - i as u32), h))
        .collect();

        Ok(Self {
            version,
            flags,
            code_limit,
            digest_size,
            digest_type,
            platform,
            page_size,
            spare2,
            scatter_offset,
            spare3,
            code_limit_64,
            exec_seg_base,
            exec_seg_limit,
            exec_seg_flags,
            runtime,
            pre_encrypt_offset,
            linkage_hash_type,
            linkage_truncated,
            spare4,
            linkage_offset,
            linkage_size,
            ident,
            team_name,
            code_digests,
            special_digests,
        })
    }

pub const fn is_empty(&self) -> bool

Returns true if no flags are currently stored.

Examples found in repository

src/signing_settings.rs (line 821)

    pub fn import_settings_from_macho(&mut self, data: &[u8]) -> Result<(), AppleCodesignError> {
        info!("inferring default signing settings from Mach-O binary");

        for macho in MachFile::parse(data)?.into_iter() {
            let index = macho.index.unwrap_or(0);

            let scope_main = SettingsScope::Main;
            let scope_index = SettingsScope::MultiArchIndex(index);
            let scope_arch = SettingsScope::MultiArchCpuType(macho.macho.header.cputype());

            // Older operating system versions don't have support for SHA-256 in
            // signatures. If the minimum version targeting in the binary doesn't
            // support SHA-256, we automatically change the digest targeting settings
            // so the binary will be signed correctly.
            if let Some(targeting) = macho.find_targeting()? {
                let sha256_version = targeting.platform.sha256_digest_support()?;

                if !sha256_version.matches(&targeting.minimum_os_version) {
                    info!(
                        "activating SHA-1 digests because minimum OS target {} is not {}",
                        targeting.minimum_os_version, sha256_version
                    );

                    // This logic is a bit wonky. We want SHA-1 to be present on all binaries
                    // within a fat binary. So if we need SHA-1 mode, we set the setting on the
                    // main scope and then clear any overrides on fat binary scopes so our
                    // settings are canonical.
                    self.set_digest_type(DigestType::Sha1);
                    self.add_extra_digest(scope_main.clone(), DigestType::Sha256);
                    self.extra_digests.remove(&scope_arch);
                    self.extra_digests.remove(&scope_index);
                }
            }

            // The Mach-O can have embedded Info.plist data. Use it if available and not
            // already defined in settings.
            if let Some(info_plist) = macho.embedded_info_plist()? {
                if self.info_plist_data(&scope_main).is_some()
                    || self.info_plist_data(&scope_index).is_some()
                    || self.info_plist_data(&scope_arch).is_some()
                {
                    info!("using Info.plist data from settings");
                } else {
                    info!("preserving Info.plist data already present in Mach-O");
                    self.set_info_plist_data(scope_index.clone(), info_plist);
                }
            }

            if let Some(sig) = macho.code_signature()? {
                if let Some(cd) = sig.code_directory()? {
                    if self.binary_identifier(&scope_main).is_some()
                        || self.binary_identifier(&scope_index).is_some()
                        || self.binary_identifier(&scope_arch).is_some()
                    {
                        info!("using binary identifier from settings");
                    } else {
                        info!("preserving existing binary identifier in Mach-O");
                        self.set_binary_identifier(scope_index.clone(), cd.ident);
                    }

                    if self.team_id.contains_key(&scope_main)
                        || self.team_id.contains_key(&scope_index)
                        || self.team_id.contains_key(&scope_arch)
                    {
                        info!("using team ID from settings");
                    } else if let Some(team_id) = cd.team_name {
                        info!("preserving team ID in existing Mach-O signature");
                        self.team_id
                            .insert(scope_index.clone(), team_id.to_string());
                    }

                    if self.code_signature_flags(&scope_main).is_some()
                        || self.code_signature_flags(&scope_index).is_some()
                        || self.code_signature_flags(&scope_arch).is_some()
                    {
                        info!("using code signature flags from settings");
                    } else if !cd.flags.is_empty() {
                        info!("preserving code signature flags in existing Mach-O signature");
                        self.set_code_signature_flags(scope_index.clone(), cd.flags);
                    }

                    if self.runtime_version(&scope_main).is_some()
                        || self.runtime_version(&scope_index).is_some()
                        || self.runtime_version(&scope_arch).is_some()
                    {
                        info!("using runtime version from settings");
                    } else if let Some(version) = cd.runtime {
                        info!("preserving runtime version in existing Mach-O signature");
                        self.set_runtime_version(
                            scope_index.clone(),
                            parse_version_nibbles(version),
                        );
                    }
                }

                if let Some(entitlements) = sig.entitlements()? {
                    if self.entitlements_plist(&scope_main).is_some()
                        || self.entitlements_plist(&scope_index).is_some()
                        || self.entitlements_plist(&scope_arch).is_some()
                    {
                        info!("using entitlements from settings");
                    } else {
                        info!("preserving existing entitlements in Mach-O");
                        self.set_entitlements_xml(
                            SettingsScope::MultiArchIndex(index),
                            entitlements.as_str(),
                        )?;
                    }
                }
            }
        }

        Ok(())
    }

pub const fn is_all(&self) -> bool

Returns true if all flags are currently set.

pub const fn intersects(&self, other: Self) -> bool

Returns true if there are flags common to both self and other.

pub const fn contains(&self, other: Self) -> bool

Returns true if all of the flags in other are contained within self.

Examples found in repository

src/macho_signing.rs (line 440)

    pub fn create_code_directory(
        &self,
        settings: &SigningSettings,
        macho: &MachOBinary,
    ) -> Result<CodeDirectoryBlob<'static>, AppleCodesignError> {
        // TODO support defining or filling in proper values for fields with
        // static values.

        let target = macho.find_targeting()?;

        if let Some(target) = &target {
            info!(
                "binary targets {} >= {} with SDK {}",
                target.platform, target.minimum_os_version, target.sdk_version,
            );
        }

        let mut flags = CodeSignatureFlags::empty();

        if let Some(additional) = settings.code_signature_flags(SettingsScope::Main) {
            info!(
                "adding code signature flags from signing settings: {:?}",
                additional
            );
            flags |= additional;
        }

        // The adhoc flag is set when there is no CMS signature.
        if settings.signing_key().is_none() {
            info!("creating ad-hoc signature");
            flags |= CodeSignatureFlags::ADHOC;
        } else if flags.contains(CodeSignatureFlags::ADHOC) {
            info!("removing ad-hoc code signature flag");
            flags -= CodeSignatureFlags::ADHOC;
        }

        // Remove linker signed flag because we're not a linker.
        if flags.contains(CodeSignatureFlags::LINKER_SIGNED) {
            info!("removing linker signed flag from code signature (we're not a linker)");
            flags -= CodeSignatureFlags::LINKER_SIGNED;
        }

        // Code limit fields hold the file offset at which code digests stop. This
        // is the file offset in the `__LINKEDIT` segment when the embedded signature
        // SuperBlob begins.
        let (code_limit, code_limit_64) = match macho.code_limit_binary_offset()? {
            x if x > u32::MAX as u64 => (0, Some(x)),
            x => (x as u32, None),
        };

        let platform = 0;
        let page_size = 4096u32;

        let (exec_seg_base, exec_seg_limit) = macho.executable_segment_boundary()?;
        let (exec_seg_base, exec_seg_limit) = (Some(exec_seg_base), Some(exec_seg_limit));

        // Executable segment flags are wonky.
        //
        // Foremost, these flags are only present if the Mach-O binary is an executable. So not
        // matter what the settings say, we don't set these flags unless the Mach-O file type
        // is proper.
        //
        // Executable segment flags are also derived from an associated entitlements plist.
        let exec_seg_flags = if macho.is_executable() {
            if let Some(entitlements) = settings.entitlements_plist(SettingsScope::Main) {
                let flags = plist_to_executable_segment_flags(entitlements);

                if !flags.is_empty() {
                    info!("entitlements imply executable segment flags: {:?}", flags);
                }

                Some(flags | ExecutableSegmentFlags::MAIN_BINARY)
            } else {
                Some(ExecutableSegmentFlags::MAIN_BINARY)
            }
        } else {
            None
        };

        // The runtime version is the SDK version from the targeting loader commands. Same
        // u32 with nibbles encoding the version.
        //
        // If the runtime code signature flag is set, we also need to set the runtime version
        // or else the activation of the hardened runtime is incomplete.

        // If the settings defines a runtime version override, use it.
        let runtime = match settings.runtime_version(SettingsScope::Main) {
            Some(version) => {
                info!(
                    "using hardened runtime version {} from signing settings",
                    version
                );
                Some(semver_to_macho_target_version(version))
            }
            None => None,
        };

        // If we still don't have a runtime but need one, derive from the target SDK.
        let runtime = if runtime.is_none() && flags.contains(CodeSignatureFlags::RUNTIME) {
            if let Some(target) = &target {
                info!(
                    "using hardened runtime version {} derived from SDK version",
                    target.sdk_version
                );
                Some(semver_to_macho_target_version(&target.sdk_version))
            } else {
                warn!("hardened runtime version required but unable to derive suitable version; signature will likely fail Apple checks");
                None
            }
        } else {
            runtime
        };

        let code_hashes = macho
            .code_digests(*settings.digest_type(), page_size as _)?
            .into_iter()
            .map(|v| Digest { data: v.into() })
            .collect::<Vec<_>>();

        let mut special_hashes = HashMap::new();

        // There is no corresponding blob for the info plist data since it is provided
        // externally to the embedded signature.
        if let Some(data) = settings.info_plist_data(SettingsScope::Main) {
            special_hashes.insert(
                CodeSigningSlot::Info,
                Digest {
                    data: settings.digest_type().digest_data(data)?.into(),
                },
            );
        }

        // There is no corresponding blob for resources data since it is provided
        // externally to the embedded signature.
        if let Some(data) = settings.code_resources_data(SettingsScope::Main) {
            special_hashes.insert(
                CodeSigningSlot::ResourceDir,
                Digest {
                    data: settings.digest_type().digest_data(data)?.into(),
                }
                .to_owned(),
            );
        }

        let ident = Cow::Owned(
            settings
                .binary_identifier(SettingsScope::Main)
                .ok_or(AppleCodesignError::NoIdentifier)?
                .to_string(),
        );

        let team_name = settings.team_id().map(|x| Cow::Owned(x.to_string()));

        let mut cd = CodeDirectoryBlob {
            flags,
            code_limit,
            digest_size: settings.digest_type().hash_len()? as u8,
            digest_type: *settings.digest_type(),
            platform,
            page_size,
            code_limit_64,
            exec_seg_base,
            exec_seg_limit,
            exec_seg_flags,
            runtime,
            ident,
            team_name,
            code_digests: code_hashes,
            ..Default::default()
        };

        for (slot, digest) in special_hashes {
            cd.set_slot_digest(slot, digest)?;
        }

        cd.adjust_version(target);
        cd.clear_newer_fields();

        Ok(cd)
    }

pub fn insert(&mut self, other: Self)

Inserts the specified flags in-place.

pub fn remove(&mut self, other: Self)

Removes the specified flags in-place.

pub fn toggle(&mut self, other: Self)

Toggles the specified flags in-place.

pub fn set(&mut self, other: Self, value: bool)

Inserts or removes the specified flags depending on the passed value.

pub const fn intersection(self, other: Self) -> Self

Returns the intersection between the flags in self and other.

Specifically, the returned set contains only the flags which are present in both self and other.

This is equivalent to using the & operator (e.g. ops::BitAnd), as in flags & other.

pub const fn union(self, other: Self) -> Self

Returns the union of between the flags in self and other.

Specifically, the returned set contains all flags which are present in either self or other, including any which are present in both (see Self::symmetric_difference if that is undesirable).

This is equivalent to using the | operator (e.g. ops::BitOr), as in flags | other.

pub const fn difference(self, other: Self) -> Self

Returns the difference between the flags in self and other.

Specifically, the returned set contains all flags present in self, except for the ones present in other.

It is also conceptually equivalent to the “bit-clear” operation: flags & !other (and this syntax is also supported).

This is equivalent to using the - operator (e.g. ops::Sub), as in flags - other.

pub const fn symmetric_difference(self, other: Self) -> Self

Returns the symmetric difference between the flags in self and other.

Specifically, the returned set contains the flags present which are present in self or other, but that are not present in both. Equivalently, it contains the flags present in exactly one of the sets self and other.

This is equivalent to using the ^ operator (e.g. ops::BitXor), as in flags ^ other.

pub const fn complement(self) -> Self

Returns the complement of this set of flags.

Specifically, the returned set contains all the flags which are not set in self, but which are allowed for this type.

Alternatively, it can be thought of as the set difference between Self::all() and self (e.g. Self::all() - self)

This is equivalent to using the ! operator (e.g. ops::Not), as in !flags.

impl CodeSignatureFlags

pub fn all_user_configurable() -> [&'static str; 7]

Obtain all flags that can be set by the user.

Maps to variants that have a from_str() implementation.

Examples found in repository

src/cli.rs (line 2937)

pub fn main_impl() -> Result<(), AppleCodesignError> {
    let app = Command::new("Cross platform Apple code signing in pure Rust")
        .version(env!("CARGO_PKG_VERSION"))
        .author("Gregory Szorc <gregory.szorc@gmail.com>")
        .about("Sign and notarize Apple programs. See https://gregoryszorc.com/docs/apple-codesign/main/ for more docs.")
        .arg_required_else_help(true)
        .arg(
            Arg::new("verbose")
                .long("verbose")
                .short('v')
                .global(true)
                .action(ArgAction::Count)
                .help("Increase logging verbosity. Can be specified multiple times."),
        );

    let app = app.subcommand(add_certificate_source_args(
        Command::new("analyze-certificate")
            .about("Analyze an X.509 certificate for Apple code signing properties")
            .long_about(ANALYZE_CERTIFICATE_ABOUT),
    ));

    let app = app.subcommand(
        Command::new("compute-code-hashes")
            .about("Compute code hashes for a binary")
            .arg(
                Arg::new("path")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("path to Mach-O binary to examine"),
            )
            .arg(
                Arg::new("hash")
                    .long("hash")
                    .action(ArgAction::Set)
                    .value_parser(SUPPORTED_HASHES)
                    .default_value("sha256")
                    .help("Hashing algorithm to use"),
            )
            .arg(
                Arg::new("page_size")
                    .long("page-size")
                    .action(ArgAction::Set)
                    .default_value("4096")
                    .help("Chunk size to digest over"),
            )
            .arg(
                Arg::new("universal_index")
                    .long("universal-index")
                    .action(ArgAction::Set)
                    .default_value("0")
                    .help("Index of Mach-O binary to operate on within a universal/fat binary"),
            ),
    );

    let app = app.subcommand(
        Command::new("diff-signatures")
            .about("Print a diff between the signature content of two paths")
            .arg(
                Arg::new("path0")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("The first path to compare"),
            )
            .arg(
                Arg::new("path1")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("The second path to compare"),
            ),
    );

    let app = app.subcommand(
        Command::new("encode-app-store-connect-api-key")
            .about("Encode App Store Connect API Key metadata to a single file")
            .long_about(ENCODE_APP_STORE_CONNECT_API_KEY_ABOUT)
            .arg(
                Arg::new("output_path")
                    .short('o')
                    .long("output-path")
                    .action(ArgAction::Set)
                    .value_parser(value_parser!(PathBuf))
                    .help("Path to a JSON file to create the output to"),
            )
            .arg(
                Arg::new("issuer_id")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("The issuer of the API Token. Likely a UUID"),
            )
            .arg(
                Arg::new("key_id")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("The Key ID. A short alphanumeric string like DEADBEEF42"),
            )
            .arg(
                Arg::new("private_key_path")
                    .action(ArgAction::Set)
                    .required(true)
                    .value_parser(value_parser!(PathBuf))
                    .help("Path to a file containing the private key downloaded from Apple"),
            ),
    );

    let app = app.subcommand(
        Command::new("extract")
            .about("Extracts code signature data from a Mach-O binary")
            .long_about(EXTRACT_ABOUT)
            .arg(
                Arg::new("path")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("Path to Mach-O binary to examine"),
            )
            .arg(
                Arg::new("data")
                    .long("data")
                    .action(ArgAction::Set)
                    .value_parser([
                        "blobs",
                        "cms-info",
                        "cms-pem",
                        "cms-raw",
                        "cms",
                        "code-directory-raw",
                        "code-directory-serialized-raw",
                        "code-directory-serialized",
                        "code-directory",
                        "linkedit-info",
                        "linkedit-segment-raw",
                        "macho-load-commands",
                        "macho-segments",
                        "macho-target",
                        "requirements-raw",
                        "requirements-rust",
                        "requirements-serialized-raw",
                        "requirements-serialized",
                        "requirements",
                        "signature-raw",
                        "superblob",
                    ])
                    .default_value("linkedit-info")
                    .help("Which data to extract and how to format it"),
            )
            .arg(
                Arg::new("universal_index")
                    .long("universal-index")
                    .action(ArgAction::Set)
                    .default_value("0")
                    .help("Index of Mach-O binary to operate on within a universal/fat binary"),
            ),
    );

    let app = app.subcommand(
        add_certificate_source_args(Command::new("generate-certificate-signing-request")
            .about("Generates a certificate signing request that can be sent to Apple and exchanged for a signing certificate")
            .arg(
                Arg::new("csr_pem_path")
                    .long("csr-pem-path")
                    .action(ArgAction::Set)
                    .help("Path to file to write PEM encoded CSR to")
            )
    ));

    let app = app.subcommand(
        Command::new("generate-self-signed-certificate")
            .about("Generate a self-signed certificate for code signing")
            .long_about(GENERATE_SELF_SIGNED_CERTIFICATE_ABOUT)
            .arg(
                Arg::new("algorithm")
                    .long("algorithm")
                    .action(ArgAction::Set)
                    .value_parser(["ecdsa", "ed25519"])
                    .default_value("ecdsa")
                    .help("Which key type to use"),
            )
            .arg(
                Arg::new("profile")
                    .long("profile")
                    .action(ArgAction::Set)
                    .value_parser(CertificateProfile::str_names())
                    .default_value("apple-development"),
            )
            .arg(
                Arg::new("team_id")
                    .long("team-id")
                    .action(ArgAction::Set)
                    .default_value("unset")
                    .help(
                        "Team ID (this is a short string attached to your Apple Developer account)",
                    ),
            )
            .arg(
                Arg::new("person_name")
                    .long("person-name")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("The name of the person this certificate is for"),
            )
            .arg(
                Arg::new("country_name")
                    .long("country-name")
                    .action(ArgAction::Set)
                    .default_value("XX")
                    .help("Country Name (C) value for certificate identifier"),
            )
            .arg(
                Arg::new("validity_days")
                    .long("validity-days")
                    .action(ArgAction::Set)
                    .default_value("365")
                    .help("How many days the certificate should be valid for"),
            )
            .arg(
                Arg::new("pem_filename")
                    .long("pem-filename")
                    .action(ArgAction::Set)
                    .help("Base name of files to write PEM encoded certificate to"),
            ),
    );

    let app = app.
        subcommand(Command::new("keychain-export-certificate-chain")
            .about("Export Apple CA certificates from the macOS Keychain")
            .arg(
                Arg::new("domain")
                    .long("domain")
                    .action(ArgAction::Set)
                    .value_parser(["user", "system", "common", "dynamic"])
                    .default_value("user")
                    .help("Keychain domain to operate on")
            )
            .arg(
                Arg::new("password")
                    .long("--password")
                    .action(ArgAction::Set)
                    .help("Password to unlock the Keychain")
            )
            .arg(
                Arg::new("password_file")
                    .long("--password-file")
                    .action(ArgAction::Set)
                    .conflicts_with("password")
                    .help("File containing password to use to unlock the Keychain")
            )
           .arg(
                Arg::new("no_print_self")
                    .long("--no-print-self")
                    .action(ArgAction::SetTrue)
                    .help("Print only the issuing certificate chain, not the subject certificate")
           )
           .arg(
               Arg::new("user_id")
                    .long("--user-id")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("User ID value of code signing certificate to find and whose CA chain to export")
           ),
        );

    let app = app.subcommand(
        Command::new("keychain-print-certificates")
            .about("Print information about certificates in the macOS keychain")
            .arg(
                Arg::new("domain")
                    .long("--domain")
                    .action(ArgAction::Set)
                    .value_parser(["user", "system", "common", "dynamic"])
                    .default_value("user")
                    .help("Keychain domain to operate on"),
            ),
    );

    let app = app.subcommand(add_notary_api_args(
        Command::new("notary-log")
            .about("Fetch the notarization log for a previous submission")
            .arg(
                Arg::new("submission_id")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("The ID of the previous submission to wait on"),
            ),
    ));

    let app = app.subcommand(add_notary_api_args(
        Command::new("notary-submit")
            .about("Upload an asset to Apple for notarization and possibly staple it")
            .long_about(NOTARIZE_ABOUT)
            .alias("notarize")
            .arg(
                Arg::new("wait")
                    .long("wait")
                    .action(ArgAction::SetTrue)
                    .help("Whether to wait for upload processing to complete"),
            )
            .arg(
                Arg::new("max_wait_seconds")
                    .long("max-wait-seconds")
                    .action(ArgAction::Set)
                    .default_value("600")
                    .help("Maximum time in seconds to wait for the upload result"),
            )
            .arg(
                Arg::new("staple")
                    .long("staple")
                    .action(ArgAction::SetTrue)
                    .help(
                        "Staple the notarization ticket after successful upload (implies --wait)",
                    ),
            )
            .arg(
                Arg::new("path")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("Path to asset to upload"),
            ),
    ));

    let app = app.subcommand(add_notary_api_args(
        Command::new("notary-wait")
            .about("Wait for completion of a previous submission")
            .arg(
                Arg::new("max_wait_seconds")
                    .long("max-wait-seconds")
                    .action(ArgAction::Set)
                    .default_value("600")
                    .help("Maximum time in seconds to wait for the upload result"),
            )
            .arg(
                Arg::new("submission_id")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("The ID of the previous submission to wait on"),
            ),
    ));

    let app = app.subcommand(
        Command::new("parse-code-signing-requirement")
            .about("Parse binary Code Signing Requirement data into a human readable string")
            .long_about(PARSE_CODE_SIGNING_REQUIREMENT_ABOUT)
            .arg(
                Arg::new("format")
                    .long("--format")
                    .action(ArgAction::Set)
                    .required(true)
                    .value_parser(["csrl", "expression-tree"])
                    .default_value("csrl")
                    .help("Output format"),
            )
            .arg(
                Arg::new("input_path")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("Path to file to parse"),
            ),
    );

    let app = app.subcommand(
        Command::new("print-signature-info")
            .about("Print signature information for a filesystem path")
            .arg(
                Arg::new("path")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("Filesystem path to entity whose info to print"),
            ),
    );

    let app = app.subcommand(
        Command::new("smartcard-scan")
            .about("Show information about available smartcard (SC) devices"),
    );

    let app = app.subcommand(add_yubikey_policy_args(
        Command::new("smartcard-generate-key")
            .about("Generate a new private key on a smartcard")
            .arg(
                Arg::new("smartcard_slot")
                    .long("smartcard-slot")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("Smartcard slot number to store key in (9c is common)"),
            ),
    ));

    let app = app.subcommand(add_yubikey_policy_args(add_certificate_source_args(
        Command::new("smartcard-import")
            .about("Import a code signing certificate and key into a smartcard")
            .arg(
                Arg::new("existing_key")
                    .long("existing-key")
                    .action(ArgAction::SetTrue)
                    .help("Re-use the existing private key in the smartcard slot"),
            )
            .arg(
                Arg::new("dry_run")
                    .long("dry-run")
                    .action(ArgAction::SetTrue)
                    .help("Don't actually perform the import"),
            ),
    )));

    let app = app.subcommand(add_certificate_source_args(
        Command::new("remote-sign")
            .about("Create signatures initiated from a remote signing operation")
            .arg(
                Arg::new("session_join_string_editor")
                    .long("editor")
                    .action(ArgAction::SetTrue)
                    .help("Open an editor to input the session join string"),
            )
            .arg(
                Arg::new("session_join_string_path")
                    .long("sjs-path")
                    .action(ArgAction::Set)
                    .help("Path to file containing session join string"),
            )
            .arg(
                Arg::new("session_join_string")
                    .action(ArgAction::Set)
                    .help("Session join string (provided by the signing initiator)"),
            )
            .group(
                ArgGroup::new("session_join_string_source")
                    .arg("session_join_string_editor")
                    .arg("session_join_string_path")
                    .arg("session_join_string")
                    .required(true),
            ),
    ));

    let app = app
        .subcommand(
            add_certificate_source_args(Command::new("sign")
                .about("Sign a Mach-O binary or bundle")
                .long_about(SIGN_ABOUT)
                .arg(
                    Arg::new("binary_identifier")
                        .long("binary-identifier")
                        .action(ArgAction::Append)
                        .help("Identifier string for binary. The value normally used by CFBundleIdentifier")
                )
                .arg(
                    Arg::new("code_requirements_path")
                        .long("code-requirements-path")
                        .action(ArgAction::Append)
                        .help("Path to a file containing binary code requirements data to be used as designated requirements")
                )
                .arg(
                    Arg::new("code_resources")
                        .long("code-resources-path")
                        .action(ArgAction::Append)
                        .help("Path to an XML plist file containing code resources"),
                )
                .arg(
                    Arg::new("code_signature_flags_set")
                        .long("code-signature-flags")
                        .action(ArgAction::Append)
                        .value_parser(CodeSignatureFlags::all_user_configurable())
                        .help("Code signature flags to set")
                )
                .arg(
                    Arg::new("digest")
                        .long("digest")
                        .action(ArgAction::Set)
                        .value_parser(SUPPORTED_HASHES)
                        .default_value("sha256")
                        .help("Digest algorithm to use")
                )
                .arg(Arg::new("extra_digest")
                    .long("extra-digest")
                    .action(ArgAction::Append)
                    .value_parser(SUPPORTED_HASHES)
                    .help("Extra digests to include in signatures")
                )
                .arg(
                    Arg::new("entitlements_xml_path")
                        .long("entitlements-xml-path")
                        .short('e')
                        .action(ArgAction::Append)
                        .help("Path to a plist file containing entitlements"),
                )
                .arg(
                    Arg::new("runtime_version")
                        .long("runtime-version")
                        .action(ArgAction::Append)
                        .help("Hardened runtime version to use (defaults to SDK version used to build binary)"))
                .arg(
                    Arg::new("info_plist_path")
                        .long("info-plist-path")
                        .action(ArgAction::Append)
                        .help("Path to an Info.plist file whose digest to include in Mach-O signature")
                )
                .arg(
                    Arg::new(
                        "team_name")
                        .long("team-name")
                        .action(ArgAction::Set)
                        .help("Team name/identifier to include in code signature"
                    )
                )
                .arg(
                    Arg::new("timestamp_url")
                        .long("timestamp-url")
                        .action(ArgAction::Set)
                        .default_value(APPLE_TIMESTAMP_URL)
                        .help(
                            "URL of timestamp server to use to obtain a token of the CMS signature",
                        ),
                )
                .arg(
                    Arg::new("exclude")
                        .long("exclude")
                        .action(ArgAction::Append)
                        .help("Glob expression of paths to exclude from signing")
                )
                .arg(
                    Arg::new("smartcard_pin_env")
                        .long("smartcard-pin-env")
                        .conflicts_with_all(remote_initialization_args(Some(
                            "smartcard_pin_env",
                        )))
                        .action(ArgAction::Set)
                        .help("Environment variable holding the smartcard PIN"),
                )
                .arg(
                    Arg::new("input_path")
                        .action(ArgAction::Set)
                        .required(true)
                        .help("Path to Mach-O binary to sign"),
                )
                .arg(
                    Arg::new("output_path")
                        .action(ArgAction::Set)
                        .help("Path to signed Mach-O binary to write"),
                ),
        ));

    let app = app.subcommand(
        Command::new("staple")
            .about("Staples a notarization ticket to an entity")
            .arg(
                Arg::new("path")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("Path to entity to attempt to staple"),
            ),
    );

    let app = app.subcommand(
        Command::new("verify")
            .about("Verifies code signature data")
            .arg(
                Arg::new("path")
                    .action(ArgAction::Set)
                    .required(true)
                    .help("Path of Mach-O binary to examine"),
            ),
    );

    let app = app.subcommand(
        Command::new("x509-oids")
            .about("Print information about X.509 OIDs related to Apple code signing"),
    );

    let matches = app.get_matches();

    // TODO make default log level warn once we audit logging sites.
    let log_level = match matches.get_count("verbose") {
        0 => LevelFilter::Info,
        1 => LevelFilter::Debug,
        _ => LevelFilter::Trace,
    };

    let mut builder = env_logger::Builder::from_env(
        env_logger::Env::default().default_filter_or(log_level.as_str()),
    );

    // Disable log context except at higher log levels.
    if log_level <= LevelFilter::Info {
        builder
            .format_timestamp(None)
            .format_level(false)
            .format_target(false);
    }

    // This spews unwanted output at default level. Nerf it by default.
    if log_level == LevelFilter::Info {
        builder.filter_module("rustls", LevelFilter::Error);
    }

    builder.init();

    match matches.subcommand() {
        Some(("analyze-certificate", args)) => command_analyze_certificate(args),
        Some(("compute-code-hashes", args)) => command_compute_code_hashes(args),
        Some(("diff-signatures", args)) => command_diff_signatures(args),
        Some(("encode-app-store-connect-api-key", args)) => {
            command_encode_app_store_connect_api_key(args)
        }
        Some(("extract", args)) => command_extract(args),
        Some(("generate-certificate-signing-request", args)) => {
            command_generate_certificate_signing_request(args)
        }
        Some(("generate-self-signed-certificate", args)) => {
            command_generate_self_signed_certificate(args)
        }
        Some(("keychain-export-certificate-chain", args)) => {
            command_keychain_export_certificate_chain(args)
        }
        Some(("keychain-print-certificates", args)) => command_keychain_print_certificates(args),
        Some(("notary-log", args)) => command_notary_log(args),
        Some(("notary-submit", args)) => command_notary_submit(args),
        Some(("notary-wait", args)) => command_notary_wait(args),
        Some(("parse-code-signing-requirement", args)) => {
            command_parse_code_signing_requirement(args)
        }
        Some(("print-signature-info", args)) => command_print_signature_info(args),
        Some(("remote-sign", args)) => command_remote_sign(args),
        Some(("sign", args)) => command_sign(args),
        Some(("smartcard-generate-key", args)) => command_smartcard_generate_key(args),
        Some(("smartcard-import", args)) => command_smartcard_import(args),
        Some(("smartcard-scan", args)) => command_smartcard_scan(args),
        Some(("staple", args)) => command_staple(args),
        Some(("verify", args)) => command_verify(args),
        Some(("x509-oids", args)) => command_x509_oids(args),
        _ => Err(AppleCodesignError::CliUnknownCommand),
    }
}

pub fn from_strs(s: &[&str]) -> Result<CodeSignatureFlags, AppleCodesignError>

Attempt to convert a series of strings into a CodeSignatureFlags.

Trait Implementations

impl Binary for CodeSignatureFlags

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl BitAnd<CodeSignatureFlags> for CodeSignatureFlags

fn bitand(self, other: Self) -> Self

Returns the intersection between the two sets of flags.

type Output = CodeSignatureFlags

The resulting type after applying the & operator.

impl BitAndAssign<CodeSignatureFlags> for CodeSignatureFlags

fn bitand_assign(&mut self, other: Self)

Disables all flags disabled in the set.

impl BitOr<CodeSignatureFlags> for CodeSignatureFlags

fn bitor(self, other: CodeSignatureFlags) -> Self

Returns the union of the two sets of flags.

type Output = CodeSignatureFlags

The resulting type after applying the | operator.

impl BitOrAssign<CodeSignatureFlags> for CodeSignatureFlags

fn bitor_assign(&mut self, other: Self)

Adds the set of flags.

impl BitXor<CodeSignatureFlags> for CodeSignatureFlags

fn bitxor(self, other: Self) -> Self

Returns the left flags, but with all the right flags toggled.

type Output = CodeSignatureFlags

The resulting type after applying the ^ operator.

impl BitXorAssign<CodeSignatureFlags> for CodeSignatureFlags

fn bitxor_assign(&mut self, other: Self)

Toggles the set of flags.

impl Clone for CodeSignatureFlags

fn clone(&self) -> CodeSignatureFlags

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CodeSignatureFlags

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CodeSignatureFlags

fn default() -> CodeSignatureFlags

Returns the “default value” for a type.

impl Extend<CodeSignatureFlags> for CodeSignatureFlags

fn extend<T: IntoIterator<Item = Self>>(&mut self, iterator: T)

Extends a collection with the contents of an iterator.

fn extend_one(&mut self, item: A)

🔬This is a nightly-only experimental API. (extend_one)

Extends a collection with exactly one element.

fn extend_reserve(&mut self, additional: usize)

🔬This is a nightly-only experimental API. (extend_one)

Reserves capacity in a collection for the given number of additional elements.

impl FromIterator<CodeSignatureFlags> for CodeSignatureFlags

fn from_iter<T: IntoIterator<Item = Self>>(iterator: T) -> Self

Creates a value from an iterator.

impl FromStr for CodeSignatureFlags

type Err = AppleCodesignError

The associated error which can be returned from parsing.

fn from_str(s: &str) -> Result<Self, Self::Err>

Parses a string s to return a value of this type.

impl Hash for CodeSignatureFlags

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)where
    H: Hasher,
    Self: Sized,

Feeds a slice of this type into the given Hasher.

impl LowerHex for CodeSignatureFlags

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Not for CodeSignatureFlags

fn not(self) -> Self

Returns the complement of this set of flags.

type Output = CodeSignatureFlags

The resulting type after applying the ! operator.

impl Octal for CodeSignatureFlags

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Ord for CodeSignatureFlags

fn cmp(&self, other: &CodeSignatureFlags) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Selfwhere
    Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Selfwhere
    Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Selfwhere
    Self: Sized + PartialOrd<Self>,

Restrict a value to a certain interval.

impl PartialEq<CodeSignatureFlags> for CodeSignatureFlags

fn eq(&self, other: &CodeSignatureFlags) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialOrd<CodeSignatureFlags> for CodeSignatureFlags

fn partial_cmp(&self, other: &CodeSignatureFlags) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

This method tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

This method tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

This method tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

This method tests greater than or equal to (for self and other) and is used by the >= operator.

impl Sub<CodeSignatureFlags> for CodeSignatureFlags

fn sub(self, other: Self) -> Self

Returns the set difference of the two sets of flags.

type Output = CodeSignatureFlags

The resulting type after applying the - operator.

impl SubAssign<CodeSignatureFlags> for CodeSignatureFlags

fn sub_assign(&mut self, other: Self)

Disables all flags enabled in the set.

impl UpperHex for CodeSignatureFlags

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Copy for CodeSignatureFlags

impl Eq for CodeSignatureFlags

impl StructuralEq for CodeSignatureFlags

impl StructuralPartialEq for CodeSignatureFlags