Struct EmbeddedSignatureBuilder

pub struct EmbeddedSignatureBuilder<'a> { /* private fields */ }

An entity for producing and writing EmbeddedSignature.

This entity can be used to incrementally build up super blob data.

Implementations

impl<'a> EmbeddedSignatureBuilder<'a>

pub fn new_for_stapling( signature: EmbeddedSignature<'a>, ) -> Result<Self, AppleCodesignError>

Create a new instance suitable for stapling a notarization ticket.

This starts with an existing EmbeddedSignature / superblob because stapling a notarization ticket just adds a new ticket slot without modifying existing slots.

pub fn code_directory(&self) -> Option<&CodeDirectoryBlob<'_>>

Obtain the code directory registered with this instance.

pub fn add_blob( &mut self, slot: CodeSigningSlot, blob: BlobData<'a>, ) -> Result<(), AppleCodesignError>

Register a blob into a slot.

There can only be a single blob per slot. Last write wins.

The code directory and embedded signature cannot be added using this method.

Blobs cannot be registered after a code directory or signature are added, as this would invalidate the signature.

pub fn add_code_directory( &mut self, cd_slot: CodeSigningSlot, cd: CodeDirectoryBlob<'a>, ) -> Result<&CodeDirectoryBlob<'_>, AppleCodesignError>

Register a CodeDirectoryBlob with this builder.

This is the recommended mechanism to register a Code Directory with this instance.

When a code directory is registered, this method will automatically ensure digests of previously registered blobs/slots are present in the code directory. This removes the burden from callers of having to keep the code directory in sync with other registered blobs.

This function accepts the slot to add the code directory to because alternative slots can be registered.

pub fn add_alternative_code_directory( &mut self, cd: CodeDirectoryBlob<'a>, ) -> Result<&CodeDirectoryBlob<'_>, AppleCodesignError>

Add an alternative code directory.

This is a wrapper for Self::add_code_directory() that has logic for determining the appropriate slot for the code directory.

pub fn create_cms_signature( &mut self, signing_key: &dyn KeyInfoSigner, signing_cert: &CapturedX509Certificate, time_stamp_url: Option<&Url>, certificates: impl Iterator<Item = CapturedX509Certificate>, signing_time: Option<DateTime<Utc>>, ) -> Result<(), AppleCodesignError>

The a CMS signature and register its signature blob.

signing_key and signing_cert denote the keypair being used to produce a cryptographic signature.

time_stamp_url is an optional time-stamp protocol server to use to record the signature in.

certificates are extra X.509 certificates to register in the signing chain.

signing_time defines the signing time to use. If not defined, the current time is used.

This method errors if called before a code directory is registered.

pub fn create_empty_cms_signature(&mut self) -> Result<(), AppleCodesignError>

pub fn add_notarization_ticket( &mut self, ticket_data: Vec<u8>, ) -> Result<(), AppleCodesignError>

Add notarization ticket data.

This will register a new ticket slot holding the notarization ticket data.

pub fn create_superblob(&self) -> Result<Vec<u8>, AppleCodesignError>

Create the embedded signature “superblob” data.

Trait Implementations

impl<'a> Debug for EmbeddedSignatureBuilder<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a> Default for EmbeddedSignatureBuilder<'a>

fn default() -> EmbeddedSignatureBuilder<'a>

Returns the “default value” for a type.