Struct EmbeddedSignature

pub struct EmbeddedSignature<'a> {
    pub magic: CodeSigningMagic,
    pub length: u32,
    pub count: u32,
    pub data: &'a [u8],
    pub blobs: Vec<BlobEntry<'a>>,
}

Represents Apple’s common embedded code signature data structures.

This type represents a lightly parsed SuperBlob with CodeSigningMagic::EmbeddedSignature. It is the most common embedded signature data format you are likely to encounter.

Fields

magic: CodeSigningMagic

Magic value from header.

length: u32

Length of this super blob.

count: u32

Number of blobs in this super blob.

data: &'a [u8]

Raw data backing this super blob.

blobs: Vec<BlobEntry<'a>>

All the blobs within this super blob.

Implementations

impl<'a> EmbeddedSignature<'a>

pub fn from_bytes(data: &'a [u8]) -> Result<Self, AppleCodesignError>

Attempt to parse an embedded signature super blob from data.

The argument to this function is likely the subset of the __LINKEDIT Mach-O section that the LC_CODE_SIGNATURE load instructions points it.

pub fn find_slot(&self, slot: CodeSigningSlot) -> Option<&BlobEntry<'a>>

Find the first occurrence of the specified slot.

pub fn find_slot_parsed( &self, slot: CodeSigningSlot, ) -> Result<Option<ParsedBlob<'a>>, AppleCodesignError>

pub fn code_directory( &self, ) -> Result<Option<Box<CodeDirectoryBlob<'a>>>, AppleCodesignError>

Attempt to resolve the primary CodeDirectoryBlob for this signature data.

Returns Err on data parsing error or if the blob slot didn’t contain a code directory.

Returns Ok(None) if there is no code directory slot.

pub fn alternate_code_directories( &self, ) -> Result<Vec<(CodeSigningSlot, Box<CodeDirectoryBlob<'a>>)>, AppleCodesignError>

Obtain code directories occupying alternative slots.

Embedded signatures set aside a few slots for alternate code directory data structures. This method will resolve any that are present.

pub fn all_code_directories( &self, ) -> Result<Vec<(CodeSigningSlot, Box<CodeDirectoryBlob<'a>>)>, AppleCodesignError>

Resolve all code directories in this signature.

pub fn code_directory_for_digest( &self, digest: DigestType, ) -> Result<Option<Box<CodeDirectoryBlob<'a>>>, AppleCodesignError>

Attempt to resolve a code directory containing digests of the specified type.

pub fn preferred_code_directory( &self, ) -> Result<Box<CodeDirectoryBlob<'a>>, AppleCodesignError>

Attempt to resolve the preferred code directory for this binary.

Attempts to resolve the SHA-256 variant first, falling back to SHA-1 on failure, and falling back to the primary CD slot before erroring if no CD is present.

pub fn entitlements( &self, ) -> Result<Option<Box<EntitlementsBlob<'a>>>, AppleCodesignError>

Attempt to resolve a parsed EntitlementsBlob for this signature data.

Returns Err on data parsing error or if the blob slot didn’t contain an entitlments blob.

Returns Ok(None) if there is no entitlements slot.

pub fn entitlements_der( &self, ) -> Result<Option<Box<EntitlementsDerBlob<'a>>>, AppleCodesignError>

Attempt to resolve a parsed EntitlementsDerBlob for this signature.

pub fn code_requirements( &self, ) -> Result<Option<Box<RequirementSetBlob<'a>>>, AppleCodesignError>

Attempt to resolve a parsed RequirementSetBlob for this signature data.

Returns Err on data parsing error or if the blob slot didn’t contain a requirements blob.

Returns Ok(None) if there is no requirements slot.

pub fn launch_constraints_self( &self, ) -> Result<Option<Box<ConstraintsDerBlob<'a>>>>

Obtain the launch constraints on self blob.

pub fn launch_constraints_parent( &self, ) -> Result<Option<Box<ConstraintsDerBlob<'a>>>>

Obtain the launch constraints on parent blob.

pub fn launch_constraints_responsible( &self, ) -> Result<Option<Box<ConstraintsDerBlob<'a>>>>

Obtain the launch constraints on responsible process blob.

pub fn library_constraints(&self) -> Result<Option<Box<ConstraintsDerBlob<'a>>>>

Obtain the library constraints blob.

pub fn signature_data(&self) -> Result<Option<&'a [u8]>, AppleCodesignError>

Attempt to resolve raw CMS signature data.

The returned data is likely DER PKCS#7 with the root object pkcs7-signedData (1.2.840.113549.1.7.2).

pub fn signed_data(&self) -> Result<Option<SignedData>, AppleCodesignError>

Obtain the parsed CMS SignedData.

Trait Implementations

impl<'a> Debug for EmbeddedSignature<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a> TryFrom<EmbeddedSignature<'a>> for CodeSignature

type Error = AppleCodesignError

The type returned in the event of a conversion error.

fn try_from(sig: EmbeddedSignature<'a>) -> Result<Self, Self::Error>

Performs the conversion.