isideload_apple_codesign/
error.rs

1// This Source Code Form is subject to the terms of the Mozilla Public
2// License, v. 2.0. If a copy of the MPL was not distributed with this
3// file, You can obtain one at https://mozilla.org/MPL/2.0/.
4
5use {
6    crate::{macho_universal::UniversalMachOError, remote_signing::RemoteSignError},
7    cryptographic_message_syntax::CmsError,
8    std::path::PathBuf,
9    thiserror::Error,
10    x509_certificate::{KeyAlgorithm, X509CertificateError},
11};
12
13/// Unified error type for Apple code signing.
14#[derive(Debug, Error)]
15pub enum AppleCodesignError {
16    #[error("unknown command")]
17    CliUnknownCommand,
18
19    #[error("bad argument")]
20    CliBadArgument,
21
22    #[error("{0}")]
23    CliGeneralError(String),
24
25    #[error("I/O error: {0}")]
26    Io(#[from] std::io::Error),
27
28    #[error("CLI error: {0}")]
29    CliDialoguer(#[from] dialoguer::Error),
30
31    #[error("binary parsing error: {0}")]
32    Goblin(#[from] goblin::error::Error),
33
34    #[error("invalid Mach-O binary: {0}")]
35    InvalidBinary(String),
36
37    #[error("invalid binary index within Mach-O: {0}")]
38    InvalidMachOIndex(usize),
39
40    #[error("binary does not have code signature data")]
41    BinaryNoCodeSignature,
42
43    #[error("binary does not have code directory blob")]
44    BinaryNoCodeDirectory,
45
46    #[error("X.509 certificate handler error: {0}")]
47    X509(#[from] X509CertificateError),
48
49    #[error("CMS error: {0}")]
50    Cms(#[from] CmsError),
51
52    #[error("JSON serialization error: {0}")]
53    SerdeJson(#[from] serde_json::Error),
54
55    #[error("YAML serialization error: {0}")]
56    SerdeYaml(#[from] serde_yaml::Error),
57
58    #[error("glob error: {0}")]
59    GlobPattern(#[from] glob::PatternError),
60
61    #[error("problems reported during verification")]
62    VerificationProblems,
63
64    #[error("certificate error: {0}")]
65    CertificateGeneric(String),
66
67    #[error("certificate decode error: {0}")]
68    CertificateDecode(bcder::decode::DecodeError<std::convert::Infallible>),
69
70    #[error("PEM error: {0}")]
71    CertificatePem(pem::PemError),
72
73    #[error("X.509 certificate parsing error: {0}")]
74    X509Parse(String),
75
76    #[error("unsupported key algorithm in certificate: {0:?}")]
77    CertificateUnsupportedKeyAlgorithm(KeyAlgorithm),
78
79    #[error("unspecified cryptography error in certificate")]
80    CertificateRing(aws_lc_rs::error::Unspecified),
81
82    #[error("bad string value in certificate: {0:?}")]
83    CertificateCharset(bcder::string::CharSetError),
84
85    #[error("DER: {0}")]
86    Der(#[from] der::Error),
87
88    #[error("error parsing version string: {0}")]
89    VersionParse(#[from] semver::Error),
90
91    #[error("XAR error: {0}")]
92    Xar(#[from] apple_xar::Error),
93
94    #[error("Apple flat package error: {0}")]
95    FlatPackage(#[from] apple_flat_package::Error),
96
97    #[error("unable to locate __TEXT segment")]
98    MissingText,
99
100    #[error("unable to locate __LINKEDIT segment")]
101    MissingLinkedit,
102
103    #[error("bad header magic in {0}")]
104    BadMagic(&'static str),
105
106    #[error("data structure parse error: {0}")]
107    Scroll(#[from] scroll::Error),
108
109    #[error("error parsing plist XML: {0}")]
110    PlistParseXml(plist::Error),
111
112    #[error("error serializing plist to XML: {0}")]
113    PlistSerializeXml(plist::Error),
114
115    #[error("malformed identifier string in code directory")]
116    CodeDirectoryMalformedIdentifier,
117
118    #[error("malformed team name string in code directory")]
119    CodeDirectoryMalformedTeam,
120
121    #[error("plist error in code directory: {0}")]
122    CodeDirectoryPlist(plist::Error),
123
124    #[error("SuperBlob data is malformed")]
125    SuperblobMalformed,
126
127    #[error("specified path is not of a recognized type")]
128    UnrecognizedPathType,
129
130    #[error("functionality not implemented: {0}")]
131    Unimplemented(&'static str),
132
133    #[error("unknown code signature flag: {0}")]
134    CodeSignatureUnknownFlag(String),
135
136    #[error("entitlements data not valid UTF-8: {0}")]
137    EntitlementsBadUtf8(std::str::Utf8Error),
138
139    #[error("error with plist DER encoding: {0}")]
140    PlistDer(String),
141
142    #[error("unknown executable segment flag: {0}")]
143    ExecutableSegmentUnknownFlag(String),
144
145    #[error("unknown code requirement opcode: {0}")]
146    RequirementUnknownOpcode(u32),
147
148    #[error("unknown code requirement match expression: {0}")]
149    RequirementUnknownMatchExpression(u32),
150
151    #[error("code requirement data malformed: {0}")]
152    RequirementMalformed(&'static str),
153
154    #[error("plist error in code resources: {0}")]
155    ResourcesPlist(plist::Error),
156
157    #[error("base64 error in code resources: {0}")]
158    ResourcesBase64(base64::DecodeError),
159
160    #[error("plist parse error in code resources: {0}")]
161    ResourcesPlistParse(String),
162
163    #[error("bad regular expression in code resources: {0}; {1}")]
164    ResourcesBadRegex(String, regex::Error),
165
166    #[error("__LINKEDIT isn't final Mach-O segment")]
167    LinkeditNotLast,
168
169    #[error("__LINKEDIT segment contains data after signature")]
170    DataAfterSignature,
171
172    #[error("insufficient room to write code signature load command")]
173    LoadCommandNoRoom,
174
175    #[error("error writing Mach-O: {0}")]
176    MachOWrite(String),
177
178    #[error("no identifier string provided")]
179    NoIdentifier,
180
181    #[error("no signing certificate")]
182    NoSigningCertificate,
183
184    #[error("signature data too large (please report this issue)")]
185    SignatureDataTooLarge,
186
187    #[error("invalid builder operation: {0}")]
188    SignatureBuilder(&'static str),
189
190    #[error("unknown digest algorithm")]
191    DigestUnknownAlgorithm,
192
193    #[error("unsupported digest algorithm")]
194    DigestUnsupportedAlgorithm,
195
196    #[error("unspecified digest error")]
197    DigestUnspecified,
198
199    #[error("deriving identifier from path: {0}")]
200    PathIdentifier(String),
201
202    #[error("error interfacing with directory-based bundle: {0}")]
203    DirectoryBundle(anyhow::Error),
204
205    #[error("nested bundle does not exist: {0}")]
206    BundleUnknown(String),
207
208    #[error("bundle Info.plist does not define CFBundleIdentifier: {0}")]
209    BundleNoIdentifier(PathBuf),
210
211    #[error("bundle Info.plist does not define CFBundleExecutable: {0}")]
212    BundleNoMainExecutable(PathBuf),
213
214    #[error(
215        "unexpected resource rule evaluation when signing nested bundle (please report this issue)"
216    )]
217    BundleUnexpectedResourceRuleResult,
218
219    #[error("unable to parse settings scope: {0}")]
220    ParseSettingsScope(String),
221
222    #[error("incorrect password given when decrypting PFX data")]
223    PfxBadPassword,
224
225    #[error("error parsing PFX data: {0}")]
226    PfxParseError(String),
227
228    #[cfg(target_os = "macos")]
229    #[error("SecurityFramework error: {0}")]
230    SecurityFramework(#[from] security_framework::base::Error),
231
232    #[error("error interfacing with macOS keychain: {0}")]
233    KeychainError(String),
234
235    #[error("error interfacing with Windows certificate store: {0}")]
236    WindowsStoreError(String),
237
238    #[error("failed to find certificate satisfying requirements: {0}")]
239    CertificateNotFound(String),
240
241    #[error("the given OID does not match a recognized Apple certificate authority extension")]
242    OidIsntCertificateAuthority,
243
244    #[error("the given OID does not match a recognized Apple extended key usage extension")]
245    OidIsntExtendedKeyUsage,
246
247    #[error("the given OID does not match a recognized Apple code signing extension")]
248    OidIsntCodeSigningExtension,
249
250    #[error("error building certificate: {0}")]
251    CertificateBuildError(String),
252
253    #[error("unknown certificate profile: {0}")]
254    UnknownCertificateProfile(String),
255
256    #[error("unknown code execution policy: {0}")]
257    UnknownPolicy(String),
258
259    #[error("unable to generate code requirement policy: {0}")]
260    PolicyFormulationError(String),
261
262    #[error("error producing universal Mach-O binary: {0}")]
263    UniversalMachO(#[from] UniversalMachOError),
264
265    #[error("walkdir error: {0}")]
266    WalkDir(#[from] walkdir::Error),
267
268    #[error("zip error: {0}")]
269    ZipError(#[from] zip::result::ZipError),
270
271    #[error("error writing app metadata XML: {0}")]
272    AppMetadataXml(xml::writer::Error),
273
274    #[error("error writing XML: {0}")]
275    XmlWrite(xml::writer::Error),
276
277    #[error("signing XAR archives requires a signing certificate")]
278    XarNoAdhoc,
279
280    #[error("App Store Connect API Key error: {0}")]
281    AppStoreConnectApiKey(String),
282
283    #[error("Could not find App Store Connect API key in default search locations")]
284    AppStoreConnectApiKeyNotFound,
285
286    #[error("signing settings are not compatible with notarization")]
287    ForNotarizationInvalidSettings,
288
289    #[error("do not know how to notarize {0}")]
290    NotarizeUnsupportedPath(PathBuf),
291
292    #[error("no authentication credentials to perform notarization request")]
293    NotarizeNoAuthCredentials,
294
295    #[error("reached time limit waiting for notarization to complete")]
296    NotarizeWaitLimitReached,
297
298    #[error("error interacting with Notary API")]
299    NotarizeServerError,
300
301    #[error("notarization rejected: StatusCode={0}; StatusMessage={1}")]
302    NotarizeRejected(i64, String),
303
304    #[error("notarization is incomplete (no status code and message)")]
305    NotarizeIncomplete,
306
307    #[error("notarization package is invalid")]
308    NotarizeInvalid,
309
310    #[error("notarization record not in response: {0}")]
311    NotarizationRecordNotInResponse(String),
312
313    #[error("signed ticket data not found in ticket lookup response (this should not happen)")]
314    NotarizationRecordNoSignedTicket,
315
316    #[error("signedTicket in notarization ticket lookup response is not BYTES: {0}")]
317    NotarizationRecordSignedTicketNotBytes(String),
318
319    #[error("notarization ticket lookup failure: {0}: {1}")]
320    NotarizationLookupFailure(String, String),
321
322    #[error("error decoding base64 in notarization ticket: {0}")]
323    NotarizationRecordDecodeFailure(base64::DecodeError),
324
325    #[error("unable to determine app platform from bundle")]
326    BundleUnknownAppPlatform,
327
328    #[error("do not support stapling {0:?} bundles")]
329    StapleUnsupportedBundleType(apple_bundles::BundlePackageType),
330
331    #[error("XAR file is malformed; cannot staple")]
332    StapleMalformedXar,
333
334    #[error("failed to find main executable in bundle")]
335    StapleMainExecutableNotFound,
336
337    #[error("do not know how to staple {0}")]
338    StapleUnsupportedPath(PathBuf),
339
340    #[error("bad header magic in DMG; not a DMG file?")]
341    DmgBadMagic,
342
343    #[error("cannot notarize DMG without an embedded signature")]
344    DmgNotarizeNoSignature,
345
346    #[error("cannot staple DMG without an embedded signature")]
347    DmgStapleNoSignature,
348
349    #[error("failed to find certificate in smartcard slot {0}")]
350    SmartcardNoCertificate(String),
351
352    #[error("failed to authenticate with smartcard device")]
353    SmartcardFailedAuthentication,
354
355    #[cfg(feature = "yubikey")]
356    #[error("YubiKey error: {0}")]
357    YubiKey(#[from] yubikey::Error),
358
359    #[error("poisoned lock")]
360    PoisonedLock,
361
362    #[error("internal API / logic error: {0}")]
363    LogicError(String),
364
365    #[error("zip structs error: {0}")]
366    ZipStructs(#[from] zip_structs::zip_error::ZipReadError),
367
368    #[error("remote signing error: {0}")]
369    RemoteSign(#[from] RemoteSignError),
370
371    #[error("bad time value")]
372    BadTime,
373
374    #[error("{0}")]
375    Anyhow(#[from] anyhow::Error),
376
377    #[error("plist: {0}")]
378    Plist(#[from] plist::Error),
379
380    #[error("config error: {0:?}")]
381    Figment(#[from] figment::Error),
382
383    #[error("environment constraints: {0}")]
384    EnvironmentConstraint(String),
385}
386
387/// Result type for this library.
388pub type Result<T, E = AppleCodesignError> = std::result::Result<T, E>;
isideload_apple_codesign/error.rs

isideload_apple_codesign/
error.rs
