Module index 

Table indexes: the sorted lookup structures in the trailing part of a table.

Not described by the dtformats specification, and not opaque. Two things make it impossible to treat this region as bytes to be copied:

• Every offset in it is relative to the start of the table, so inserting a record moves the index region and invalidates all of them. macOS then follows a stale offset into the middle of a record and reports errSecNoSuchAttr.
• It holds one entry per record. A record with no index entry is not findable through the Security framework.

region  := size, count, count x index offset
index   := size, id, kind, attribute count, attribute ids,
           entry count, entry offsets, record numbers, entries
entry   := payload size (excluding itself), key values
value   := four raw bytes for an integer attribute,
           else length prefix and bytes padded to four

Entries are sorted by key; the record-number array is in the same order, so together they map a sorted key to a record. tests/keychain_index.rs parses every index region in keychains written by macOS, re-serializes them byte for byte, and checks that rebuilding an index from scratch reproduces macOS’s ordering.

Structs

Index

One index over one or more attributes of a relation.

IndexBlob

The index region of one table.

IndexEntry

One indexed record: its key, and the record it points at.

Enums

IndexValue

One key value inside an index entry.