Module requirement 

Reading an application’s designated requirement out of its code signature.

Needed to name a trusted application in an item’s ACL: the ACL embeds the application’s requirement blob verbatim. Gated behind the trust-apps feature, which pulls in the macho-codesign crate; without it, a requirement can still be supplied as bytes (csreq -b output). Designated requirements for trusted-application ACLs.

An ACL entry that names a trusted application embeds that application’s designated requirement — byte for byte the blob in its own code signature, magic and length header included. There is nothing to compute: the blob is copied out of the binary.

With the trust-apps feature, crate::requirement::for_application reads it directly via macho-codesign. Without it, supply the bytes yourself — csreq -b writes the same blob — and use crate::requirement::from_blob.

Functions

for_application

Without the trust-apps feature there is no way to read a signature.

from_blob

Trust an application whose requirement blob you already have.