apple_codesign/
reader.rs

1// This Source Code Form is subject to the terms of the Mozilla Public
2// License, v. 2.0. If a copy of the MPL was not distributed with this
3// file, You can obtain one at https://mozilla.org/MPL/2.0/.
4
5//! Functionality for reading signature data from files.
6
7use {
8    crate::{
9        certificate::AppleCertificate,
10        code_directory::CodeDirectoryBlob,
11        cryptography::DigestType,
12        dmg::{path_is_dmg, DmgReader},
13        embedded_signature::{BlobEntry, EmbeddedSignature},
14        embedded_signature_builder::{CD_DIGESTS_OID, CD_DIGESTS_PLIST_OID},
15        error::{AppleCodesignError, Result},
16        macho::{MachFile, MachOBinary},
17    },
18    apple_bundles::{DirectoryBundle, DirectoryBundleFile},
19    apple_xar::{
20        reader::XarReader,
21        table_of_contents::{
22            ChecksumType as XarChecksumType, File as XarTocFile, Signature as XarTocSignature,
23        },
24    },
25    cryptographic_message_syntax::{SignedData, SignerInfo},
26    goblin::mach::{fat::FAT_MAGIC, parse_magic_and_ctx},
27    serde::Serialize,
28    std::{
29        fmt::Debug,
30        fs::File,
31        io::{BufWriter, Cursor, Read, Seek},
32        ops::Deref,
33        path::{Path, PathBuf},
34    },
35    x509_certificate::{CapturedX509Certificate, DigestAlgorithm},
36};
37
38enum MachOType {
39    Mach,
40    MachO,
41}
42
43impl MachOType {
44    pub fn from_path(path: impl AsRef<Path>) -> Result<Option<Self>, AppleCodesignError> {
45        let mut fh = File::open(path.as_ref())?;
46
47        let mut header = vec![0u8; 4];
48        let count = fh.read(&mut header)?;
49
50        if count < 4 {
51            return Ok(None);
52        }
53
54        let magic = goblin::mach::peek(&header, 0)?;
55
56        if magic == FAT_MAGIC {
57            Ok(Some(Self::Mach))
58        } else if let Ok((_, Some(_))) = parse_magic_and_ctx(&header, 0) {
59            Ok(Some(Self::MachO))
60        } else {
61            Ok(None)
62        }
63    }
64}
65
66/// Test whether a given path is likely a XAR file.
67pub fn path_is_xar(path: impl AsRef<Path>) -> Result<bool, AppleCodesignError> {
68    let mut fh = File::open(path.as_ref())?;
69
70    let mut header = [0u8; 4];
71
72    let count = fh.read(&mut header)?;
73    if count < 4 {
74        Ok(false)
75    } else {
76        Ok(header.as_ref() == b"xar!")
77    }
78}
79
80/// Test whether a given path is likely a ZIP file.
81pub fn path_is_zip(path: impl AsRef<Path>) -> Result<bool, AppleCodesignError> {
82    let mut fh = File::open(path.as_ref())?;
83
84    let mut header = [0u8; 4];
85
86    let count = fh.read(&mut header)?;
87    if count < 4 {
88        Ok(false)
89    } else {
90        Ok(header.as_ref() == [0x50, 0x4b, 0x03, 0x04])
91    }
92}
93
94/// Whether the specified filesystem path is a Mach-O binary.
95pub fn path_is_macho(path: impl AsRef<Path>) -> Result<bool, AppleCodesignError> {
96    Ok(MachOType::from_path(path)?.is_some())
97}
98
99/// Describes the type of entity at a path.
100///
101/// This represents a best guess.
102#[derive(Clone, Copy, Debug, Eq, PartialEq)]
103pub enum PathType {
104    MachO,
105    Dmg,
106    Bundle,
107    Xar,
108    Zip,
109    Other,
110}
111
112impl PathType {
113    /// Attempt to classify the type of signable entity based on a filesystem path.
114    pub fn from_path(path: impl AsRef<Path>) -> Result<Self, AppleCodesignError> {
115        let path = path.as_ref();
116
117        if path.is_file() {
118            if path_is_dmg(path)? {
119                Ok(Self::Dmg)
120            } else if path_is_xar(path)? {
121                Ok(Self::Xar)
122            } else if path_is_zip(path)? {
123                Ok(Self::Zip)
124            } else if path_is_macho(path)? {
125                Ok(Self::MachO)
126            } else {
127                Ok(Self::Other)
128            }
129        } else if path.is_dir() {
130            Ok(Self::Bundle)
131        } else {
132            Ok(Self::Other)
133        }
134    }
135}
136
137fn format_integer<T: std::fmt::Display + std::fmt::LowerHex>(v: T) -> String {
138    format!("{} / 0x{:x}", v, v)
139}
140
141fn pretty_print_xml(xml: &[u8]) -> Result<Vec<u8>, AppleCodesignError> {
142    let mut reader = xml::reader::EventReader::new(Cursor::new(xml));
143    let mut emitter = xml::EmitterConfig::new()
144        .perform_indent(true)
145        .create_writer(BufWriter::new(Vec::with_capacity(xml.len() * 2)));
146
147    while let Ok(event) = reader.next() {
148        match event {
149            xml::reader::XmlEvent::EndDocument => {
150                break;
151            }
152            xml::reader::XmlEvent::Whitespace(_) => {}
153            event => {
154                if let Some(event) = event.as_writer_event() {
155                    emitter.write(event).map_err(AppleCodesignError::XmlWrite)?;
156                }
157            }
158        }
159    }
160
161    let xml = emitter.into_inner().into_inner().map_err(|e| {
162        AppleCodesignError::Io(std::io::Error::new(std::io::ErrorKind::BrokenPipe, e))
163    })?;
164
165    Ok(xml)
166}
167
168/// Pretty print XML and turn into a Vec of lines.
169fn pretty_print_xml_lines(xml: &[u8]) -> Result<Vec<String>> {
170    Ok(String::from_utf8_lossy(pretty_print_xml(xml)?.as_ref())
171        .lines()
172        .map(|x| x.to_string())
173        .collect::<Vec<_>>())
174}
175
176#[derive(Clone, Debug, Serialize)]
177pub struct BlobDescription {
178    pub slot: String,
179    pub magic: String,
180    pub length: u32,
181    pub sha1: String,
182    pub sha256: String,
183}
184
185impl<'a> From<&BlobEntry<'a>> for BlobDescription {
186    fn from(entry: &BlobEntry<'a>) -> Self {
187        Self {
188            slot: format!("{:?}", entry.slot),
189            magic: format!("{:x}", u32::from(entry.magic)),
190            length: entry.length as _,
191            sha1: hex::encode(
192                entry
193                    .digest_with(DigestType::Sha1)
194                    .expect("sha-1 digest should always work"),
195            ),
196            sha256: hex::encode(
197                entry
198                    .digest_with(DigestType::Sha256)
199                    .expect("sha-256 digest should always work"),
200            ),
201        }
202    }
203}
204
205#[derive(Clone, Debug, Serialize)]
206pub struct CertificateInfo {
207    pub subject: String,
208    pub issuer: String,
209    #[serde(skip_serializing_if = "Option::is_none")]
210    pub key_algorithm: Option<String>,
211    #[serde(skip_serializing_if = "Option::is_none")]
212    pub signature_algorithm: Option<String>,
213    #[serde(skip_serializing_if = "Option::is_none")]
214    pub signed_with_algorithm: Option<String>,
215    pub is_apple_root_ca: bool,
216    pub is_apple_intermediate_ca: bool,
217    pub chains_to_apple_root_ca: bool,
218    #[serde(skip_serializing_if = "Vec::is_empty")]
219    pub apple_ca_extensions: Vec<String>,
220    #[serde(skip_serializing_if = "Vec::is_empty")]
221    pub apple_extended_key_usages: Vec<String>,
222    #[serde(skip_serializing_if = "Vec::is_empty")]
223    pub apple_code_signing_extensions: Vec<String>,
224    #[serde(skip_serializing_if = "Option::is_none")]
225    pub apple_certificate_profile: Option<String>,
226    #[serde(skip_serializing_if = "Option::is_none")]
227    pub apple_team_id: Option<String>,
228}
229
230impl TryFrom<&CapturedX509Certificate> for CertificateInfo {
231    type Error = AppleCodesignError;
232
233    fn try_from(cert: &CapturedX509Certificate) -> Result<Self, Self::Error> {
234        Ok(Self {
235            subject: cert
236                .subject_name()
237                .user_friendly_str()
238                .map_err(AppleCodesignError::CertificateDecode)?,
239            issuer: cert
240                .issuer_name()
241                .user_friendly_str()
242                .map_err(AppleCodesignError::CertificateDecode)?,
243            key_algorithm: cert.key_algorithm().map(|x| x.to_string()),
244            signature_algorithm: cert.signature_algorithm().map(|x| x.to_string()),
245            signed_with_algorithm: cert.signature_signature_algorithm().map(|x| x.to_string()),
246            is_apple_root_ca: cert.is_apple_root_ca(),
247            is_apple_intermediate_ca: cert.is_apple_intermediate_ca(),
248            chains_to_apple_root_ca: cert.chains_to_apple_root_ca(),
249            apple_ca_extensions: cert
250                .apple_ca_extensions()
251                .into_iter()
252                .map(|x| x.to_string())
253                .collect::<Vec<_>>(),
254            apple_extended_key_usages: cert
255                .apple_extended_key_usage_purposes()
256                .into_iter()
257                .map(|x| x.to_string())
258                .collect::<Vec<_>>(),
259            apple_code_signing_extensions: cert
260                .apple_code_signing_extensions()
261                .into_iter()
262                .map(|x| x.to_string())
263                .collect::<Vec<_>>(),
264            apple_certificate_profile: cert.apple_guess_profile().map(|x| x.to_string()),
265            apple_team_id: cert.apple_team_id(),
266        })
267    }
268}
269
270#[derive(Clone, Debug, Serialize)]
271pub struct CmsSigner {
272    pub issuer: String,
273    pub digest_algorithm: String,
274    pub signature_algorithm: String,
275    #[serde(skip_serializing_if = "Vec::is_empty")]
276    pub attributes: Vec<String>,
277    #[serde(skip_serializing_if = "Option::is_none")]
278    pub content_type: Option<String>,
279    #[serde(skip_serializing_if = "Option::is_none")]
280    pub message_digest: Option<String>,
281    #[serde(skip_serializing_if = "Option::is_none")]
282    pub signing_time: Option<chrono::DateTime<chrono::Utc>>,
283    #[serde(skip_serializing_if = "Vec::is_empty")]
284    pub cdhash_plist: Vec<String>,
285    #[serde(skip_serializing_if = "Vec::is_empty")]
286    pub cdhash_digests: Vec<(String, String)>,
287    pub signature_verifies: bool,
288    #[serde(skip_serializing_if = "Option::is_none")]
289    pub time_stamp_token: Option<CmsSignature>,
290}
291
292impl CmsSigner {
293    pub fn from_signer_info_and_signed_data(
294        signer_info: &SignerInfo,
295        signed_data: &SignedData,
296    ) -> Result<Self, AppleCodesignError> {
297        let mut attributes = vec![];
298        let mut content_type = None;
299        let mut message_digest = None;
300        let mut signing_time = None;
301        let mut time_stamp_token = None;
302        let mut cdhash_plist = vec![];
303        let mut cdhash_digests = vec![];
304
305        if let Some(sa) = signer_info.signed_attributes() {
306            content_type = Some(sa.content_type().to_string());
307            message_digest = Some(hex::encode(sa.message_digest()));
308            if let Some(t) = sa.signing_time() {
309                signing_time = Some(*t);
310            }
311
312            for attr in sa.attributes().iter() {
313                attributes.push(format!("{}", attr.typ));
314
315                if attr.typ == CD_DIGESTS_PLIST_OID {
316                    if let Some(data) = attr.values.get(0) {
317                        let data = data.deref().clone();
318
319                        let plist = data
320                            .decode(|cons| {
321                                let v = bcder::OctetString::take_from(cons)?;
322
323                                Ok(v.into_bytes())
324                            })
325                            .map_err(|e| AppleCodesignError::Cms(e.into()))?;
326
327                        cdhash_plist = pretty_print_xml_lines(&plist)?;
328                    }
329                } else if attr.typ == CD_DIGESTS_OID {
330                    for value in &attr.values {
331                        // Each value is a SEQUENECE of (OID, OctetString).
332                        let data = value.deref().clone();
333
334                        data.decode(|cons| {
335                            loop {
336                                let res = cons.take_opt_sequence(|cons| {
337                                    let oid = bcder::Oid::take_from(cons)?;
338                                    let value = bcder::OctetString::take_from(cons)?;
339
340                                    cdhash_digests
341                                        .push((format!("{oid}"), hex::encode(value.into_bytes())));
342
343                                    Ok(())
344                                })?;
345
346                                if res.is_none() {
347                                    break;
348                                }
349                            }
350
351                            Ok(())
352                        })
353                        .map_err(|e| AppleCodesignError::Cms(e.into()))?;
354                    }
355                }
356            }
357        }
358
359        // The order should matter per RFC 5652 but Apple's CMS implementation doesn't
360        // conform to spec.
361        attributes.sort();
362
363        if let Some(tsk) = signer_info.time_stamp_token_signed_data()? {
364            time_stamp_token = Some(tsk.try_into()?);
365        }
366
367        Ok(Self {
368            issuer: signer_info
369                .certificate_issuer_and_serial()
370                .expect("issuer should always be set")
371                .0
372                .user_friendly_str()
373                .map_err(AppleCodesignError::CertificateDecode)?,
374            digest_algorithm: signer_info.digest_algorithm().to_string(),
375            signature_algorithm: signer_info.signature_algorithm().to_string(),
376            attributes,
377            content_type,
378            message_digest,
379            signing_time,
380            cdhash_plist,
381            cdhash_digests,
382            signature_verifies: signer_info
383                .verify_signature_with_signed_data(signed_data)
384                .is_ok(),
385
386            time_stamp_token,
387        })
388    }
389}
390
391/// High-level representation of a CMS signature.
392#[derive(Clone, Debug, Serialize)]
393pub struct CmsSignature {
394    #[serde(skip_serializing_if = "Vec::is_empty")]
395    pub certificates: Vec<CertificateInfo>,
396    #[serde(skip_serializing_if = "Vec::is_empty")]
397    pub signers: Vec<CmsSigner>,
398}
399
400impl TryFrom<SignedData> for CmsSignature {
401    type Error = AppleCodesignError;
402
403    fn try_from(signed_data: SignedData) -> Result<Self, Self::Error> {
404        let certificates = signed_data
405            .certificates()
406            .map(|x| x.try_into())
407            .collect::<Result<Vec<_>, _>>()?;
408
409        let signers = signed_data
410            .signers()
411            .map(|x| CmsSigner::from_signer_info_and_signed_data(x, &signed_data))
412            .collect::<Result<Vec<_>, _>>()?;
413
414        Ok(Self {
415            certificates,
416            signers,
417        })
418    }
419}
420
421#[derive(Clone, Debug, Serialize)]
422pub struct CodeDirectory {
423    pub version: String,
424    pub flags: String,
425    pub identifier: String,
426    #[serde(skip_serializing_if = "Option::is_none")]
427    pub team_name: Option<String>,
428    pub digest_type: String,
429    pub platform: u8,
430    pub signed_entity_size: u64,
431    #[serde(skip_serializing_if = "Option::is_none")]
432    pub executable_segment_flags: Option<String>,
433    #[serde(skip_serializing_if = "Option::is_none")]
434    pub runtime_version: Option<String>,
435    pub code_digests_count: usize,
436    #[serde(skip_serializing_if = "Vec::is_empty")]
437    slot_digests: Vec<String>,
438}
439
440impl<'a> TryFrom<CodeDirectoryBlob<'a>> for CodeDirectory {
441    type Error = AppleCodesignError;
442
443    fn try_from(cd: CodeDirectoryBlob<'a>) -> Result<Self, Self::Error> {
444        let mut temp = cd
445            .slot_digests()
446            .iter()
447            .map(|(slot, digest)| (slot, digest.as_hex()))
448            .collect::<Vec<_>>();
449        temp.sort_by(|(a, _), (b, _)| a.cmp(b));
450
451        let slot_digests = temp
452            .into_iter()
453            .map(|(slot, digest)| format!("{slot:?}: {digest}"))
454            .collect::<Vec<_>>();
455
456        Ok(Self {
457            version: format!("0x{:X}", cd.version),
458            flags: format!("{:?}", cd.flags),
459            identifier: cd.ident.to_string(),
460            team_name: cd.team_name.map(|x| x.to_string()),
461            signed_entity_size: cd.code_limit as _,
462            digest_type: format!("{}", cd.digest_type),
463            platform: cd.platform,
464            executable_segment_flags: cd.exec_seg_flags.map(|x| format!("{x:?}")),
465            runtime_version: cd
466                .runtime
467                .map(|x| format!("{}", crate::macho::parse_version_nibbles(x))),
468            code_digests_count: cd.code_digests.len(),
469            slot_digests,
470        })
471    }
472}
473
474/// High level representation of a code signature.
475#[derive(Clone, Debug, Serialize)]
476pub struct CodeSignature {
477    /// Length of the code signature data.
478    pub superblob_length: String,
479    pub blob_count: u32,
480    pub blobs: Vec<BlobDescription>,
481    #[serde(skip_serializing_if = "Option::is_none")]
482    pub code_directory: Option<CodeDirectory>,
483    #[serde(skip_serializing_if = "Vec::is_empty")]
484    pub alternative_code_directories: Vec<(String, CodeDirectory)>,
485    #[serde(skip_serializing_if = "Vec::is_empty")]
486    pub entitlements_plist: Vec<String>,
487    #[serde(skip_serializing_if = "Vec::is_empty")]
488    pub entitlements_der_plist: Vec<String>,
489    #[serde(skip_serializing_if = "Vec::is_empty")]
490    pub launch_constraints_self: Vec<String>,
491    #[serde(skip_serializing_if = "Vec::is_empty")]
492    pub launch_constraints_parent: Vec<String>,
493    #[serde(skip_serializing_if = "Vec::is_empty")]
494    pub launch_constraints_responsible: Vec<String>,
495    #[serde(skip_serializing_if = "Vec::is_empty")]
496    pub library_constraints: Vec<String>,
497    #[serde(skip_serializing_if = "Vec::is_empty")]
498    pub code_requirements: Vec<String>,
499    pub cms: Option<CmsSignature>,
500}
501
502impl<'a> TryFrom<EmbeddedSignature<'a>> for CodeSignature {
503    type Error = AppleCodesignError;
504
505    fn try_from(sig: EmbeddedSignature<'a>) -> Result<Self, Self::Error> {
506        let mut entitlements_plist = vec![];
507        let mut entitlements_der_plist = vec![];
508        let mut launch_constraints_self = vec![];
509        let mut launch_constraints_parent = vec![];
510        let mut launch_constraints_responsible = vec![];
511        let mut library_constraints = vec![];
512        let mut code_requirements = vec![];
513        let mut cms = None;
514
515        let code_directory = if let Some(cd) = sig.code_directory()? {
516            Some(CodeDirectory::try_from(*cd)?)
517        } else {
518            None
519        };
520
521        let alternative_code_directories = sig
522            .alternate_code_directories()?
523            .into_iter()
524            .map(|(slot, cd)| Ok((format!("{slot:?}"), CodeDirectory::try_from(*cd)?)))
525            .collect::<Result<Vec<_>, AppleCodesignError>>()?;
526
527        if let Some(blob) = sig.entitlements()? {
528            entitlements_plist = blob
529                .as_str()
530                .lines()
531                .map(|x| x.replace('\t', "  "))
532                .collect::<Vec<_>>();
533        }
534
535        if let Some(blob) = sig.entitlements_der()? {
536            let xml = blob.plist_xml()?;
537
538            entitlements_der_plist = pretty_print_xml_lines(&xml)?;
539        }
540
541        if let Some(blob) = sig.launch_constraints_self()? {
542            launch_constraints_self = pretty_print_xml_lines(&blob.plist_xml()?)?;
543        }
544
545        if let Some(blob) = sig.launch_constraints_parent()? {
546            launch_constraints_parent = pretty_print_xml_lines(&blob.plist_xml()?)?;
547        }
548
549        if let Some(blob) = sig.launch_constraints_responsible()? {
550            launch_constraints_responsible = pretty_print_xml_lines(&blob.plist_xml()?)?;
551        }
552
553        if let Some(blob) = sig.library_constraints()? {
554            library_constraints = pretty_print_xml_lines(&blob.plist_xml()?)?;
555        }
556
557        if let Some(req) = sig.code_requirements()? {
558            let mut temp = vec![];
559
560            for (req, blob) in req.requirements {
561                let reqs = blob.parse_expressions()?;
562                temp.push((req, format!("{reqs}")));
563            }
564
565            temp.sort_by(|(a, _), (b, _)| a.cmp(b));
566
567            code_requirements = temp
568                .into_iter()
569                .map(|(req, value)| format!("{req}: {value}"))
570                .collect::<Vec<_>>();
571        }
572
573        if let Some(signed_data) = sig.signed_data()? {
574            cms = Some(signed_data.try_into()?);
575        }
576
577        Ok(Self {
578            superblob_length: format_integer(sig.length),
579            blob_count: sig.count,
580            blobs: sig
581                .blobs
582                .iter()
583                .map(BlobDescription::from)
584                .collect::<Vec<_>>(),
585            code_directory,
586            alternative_code_directories,
587            entitlements_plist,
588            entitlements_der_plist,
589            launch_constraints_self,
590            launch_constraints_parent,
591            launch_constraints_responsible,
592            library_constraints,
593            code_requirements,
594            cms,
595        })
596    }
597}
598
599#[derive(Clone, Debug, Default, Serialize)]
600pub struct MachOEntity {
601    pub macho_linkedit_start_offset: Option<String>,
602    pub macho_signature_start_offset: Option<String>,
603    pub macho_signature_end_offset: Option<String>,
604    pub macho_linkedit_end_offset: Option<String>,
605    pub macho_end_offset: Option<String>,
606    pub linkedit_signature_start_offset: Option<String>,
607    pub linkedit_signature_end_offset: Option<String>,
608    pub linkedit_bytes_after_signature: Option<String>,
609    pub signature: Option<CodeSignature>,
610}
611
612#[derive(Clone, Debug, Serialize)]
613pub struct DmgEntity {
614    pub code_signature_offset: u64,
615    pub code_signature_size: u64,
616    pub signature: Option<CodeSignature>,
617}
618
619#[derive(Clone, Debug, Serialize)]
620pub enum CodeSignatureFile {
621    ResourcesXml(Vec<String>),
622    NotarizationTicket,
623    Other,
624}
625
626#[derive(Clone, Debug, Serialize)]
627pub struct XarTableOfContents {
628    pub toc_length_compressed: u64,
629    pub toc_length_uncompressed: u64,
630    pub checksum_offset: u64,
631    pub checksum_size: u64,
632    pub checksum_type: String,
633    pub toc_start_offset: u16,
634    pub heap_start_offset: u64,
635    pub creation_time: String,
636    pub toc_checksum_reported: String,
637    pub toc_checksum_reported_sha1_digest: String,
638    pub toc_checksum_reported_sha256_digest: String,
639    pub toc_checksum_actual_sha1: String,
640    pub toc_checksum_actual_sha256: String,
641    pub checksum_verifies: bool,
642    #[serde(skip_serializing_if = "Option::is_none")]
643    pub signature: Option<XarSignature>,
644    #[serde(skip_serializing_if = "Option::is_none")]
645    pub x_signature: Option<XarSignature>,
646    #[serde(skip_serializing_if = "Vec::is_empty")]
647    pub xml: Vec<String>,
648    #[serde(skip_serializing_if = "Option::is_none")]
649    pub rsa_signature: Option<String>,
650    #[serde(skip_serializing_if = "Option::is_none")]
651    pub rsa_signature_verifies: Option<bool>,
652    #[serde(skip_serializing_if = "Option::is_none")]
653    pub cms_signature: Option<CmsSignature>,
654    #[serde(skip_serializing_if = "Option::is_none")]
655    pub cms_signature_verifies: Option<bool>,
656}
657
658impl XarTableOfContents {
659    pub fn from_xar<R: Read + Seek + Sized + Debug>(
660        xar: &mut XarReader<R>,
661    ) -> Result<Self, AppleCodesignError> {
662        let (digest_type, digest) = xar.checksum()?;
663        let _xml = xar.table_of_contents_decoded_data()?;
664
665        let (rsa_signature, rsa_signature_verifies) = if let Some(sig) = xar.rsa_signature()? {
666            (
667                Some(hex::encode(sig.0)),
668                Some(xar.verify_rsa_checksum_signature().unwrap_or(false)),
669            )
670        } else {
671            (None, None)
672        };
673        let (cms_signature, cms_signature_verifies) =
674            if let Some(signed_data) = xar.cms_signature()? {
675                (
676                    Some(CmsSignature::try_from(signed_data)?),
677                    Some(xar.verify_cms_signature().unwrap_or(false)),
678                )
679            } else {
680                (None, None)
681            };
682
683        let toc_checksum_actual_sha1 = xar.digest_table_of_contents_with(XarChecksumType::Sha1)?;
684        let toc_checksum_actual_sha256 =
685            xar.digest_table_of_contents_with(XarChecksumType::Sha256)?;
686
687        let checksum_verifies = xar.verify_table_of_contents_checksum().unwrap_or(false);
688
689        let header = xar.header();
690        let toc = xar.table_of_contents();
691        let checksum_offset = toc.checksum.offset;
692        let checksum_size = toc.checksum.size;
693
694        // This can be useful for debugging.
695        //let xml = pretty_print_xml_lines(&xml)?;
696        let xml = vec![];
697
698        Ok(Self {
699            toc_length_compressed: header.toc_length_compressed,
700            toc_length_uncompressed: header.toc_length_uncompressed,
701            checksum_offset,
702            checksum_size,
703            checksum_type: apple_xar::format::XarChecksum::from(header.checksum_algorithm_id)
704                .to_string(),
705            toc_start_offset: header.size,
706            heap_start_offset: xar.heap_start_offset(),
707            creation_time: toc.creation_time.clone(),
708            toc_checksum_reported: format!("{}:{}", digest_type, hex::encode(&digest)),
709            toc_checksum_reported_sha1_digest: hex::encode(DigestType::Sha1.digest_data(&digest)?),
710            toc_checksum_reported_sha256_digest: hex::encode(
711                DigestType::Sha256.digest_data(&digest)?,
712            ),
713            toc_checksum_actual_sha1: hex::encode(toc_checksum_actual_sha1),
714            toc_checksum_actual_sha256: hex::encode(toc_checksum_actual_sha256),
715            checksum_verifies,
716            signature: if let Some(sig) = &toc.signature {
717                Some(sig.try_into()?)
718            } else {
719                None
720            },
721            x_signature: if let Some(sig) = &toc.x_signature {
722                Some(sig.try_into()?)
723            } else {
724                None
725            },
726            xml,
727            rsa_signature,
728            rsa_signature_verifies,
729            cms_signature,
730            cms_signature_verifies,
731        })
732    }
733}
734
735#[derive(Clone, Debug, Serialize)]
736pub struct XarSignature {
737    pub style: String,
738    pub offset: u64,
739    pub size: u64,
740    pub end_offset: u64,
741    #[serde(skip_serializing_if = "Vec::is_empty")]
742    pub certificates: Vec<CertificateInfo>,
743}
744
745impl TryFrom<&XarTocSignature> for XarSignature {
746    type Error = AppleCodesignError;
747
748    fn try_from(sig: &XarTocSignature) -> Result<Self, Self::Error> {
749        Ok(Self {
750            style: sig.style.to_string(),
751            offset: sig.offset,
752            size: sig.size,
753            end_offset: sig.offset + sig.size,
754            certificates: sig
755                .x509_certificates()?
756                .into_iter()
757                .map(|cert| CertificateInfo::try_from(&cert))
758                .collect::<Result<Vec<_>, AppleCodesignError>>()?,
759        })
760    }
761}
762
763#[derive(Clone, Debug, Default, Serialize)]
764pub struct XarFile {
765    pub id: u64,
766    pub file_type: String,
767    pub data_size: Option<u64>,
768    pub data_length: Option<u64>,
769    pub data_extracted_checksum: Option<String>,
770    pub data_archived_checksum: Option<String>,
771    pub data_encoding: Option<String>,
772}
773
774impl TryFrom<&XarTocFile> for XarFile {
775    type Error = AppleCodesignError;
776
777    fn try_from(file: &XarTocFile) -> Result<Self, Self::Error> {
778        let mut v = Self {
779            id: file.id,
780            file_type: file.file_type.to_string(),
781            ..Default::default()
782        };
783
784        if let Some(data) = &file.data {
785            v.populate_data(data);
786        }
787
788        Ok(v)
789    }
790}
791
792impl XarFile {
793    pub fn populate_data(&mut self, data: &apple_xar::table_of_contents::FileData) {
794        self.data_size = Some(data.size);
795        self.data_length = Some(data.length);
796        self.data_extracted_checksum = Some(format!(
797            "{}:{}",
798            data.extracted_checksum.style, data.extracted_checksum.checksum
799        ));
800        self.data_archived_checksum = Some(format!(
801            "{}:{}",
802            data.archived_checksum.style, data.archived_checksum.checksum
803        ));
804        self.data_encoding = Some(data.encoding.style.clone());
805    }
806}
807
808#[derive(Clone, Debug, Serialize)]
809#[serde(rename_all = "snake_case")]
810pub enum SignatureEntity {
811    MachO(MachOEntity),
812    Dmg(DmgEntity),
813    BundleCodeSignatureFile(CodeSignatureFile),
814    XarTableOfContents(XarTableOfContents),
815    XarMember(XarFile),
816    Other,
817}
818
819#[derive(Clone, Debug, Serialize)]
820pub struct FileEntity {
821    pub path: PathBuf,
822    #[serde(skip_serializing_if = "Option::is_none")]
823    pub file_size: Option<u64>,
824    #[serde(skip_serializing_if = "Option::is_none")]
825    pub file_sha256: Option<String>,
826    #[serde(skip_serializing_if = "Option::is_none")]
827    pub symlink_target: Option<PathBuf>,
828    #[serde(skip_serializing_if = "Option::is_none")]
829    pub sub_path: Option<String>,
830    #[serde(with = "serde_yaml::with::singleton_map")]
831    pub entity: SignatureEntity,
832}
833
834impl FileEntity {
835    /// Construct an instance from a [Path].
836    pub fn from_path(path: &Path, report_path: Option<&Path>) -> Result<Self, AppleCodesignError> {
837        let metadata = std::fs::symlink_metadata(path)?;
838
839        let report_path = if let Some(p) = report_path {
840            p.to_path_buf()
841        } else {
842            path.to_path_buf()
843        };
844
845        let (file_size, file_sha256, symlink_target) = if metadata.is_symlink() {
846            (None, None, Some(std::fs::read_link(path)?))
847        } else {
848            (
849                Some(metadata.len()),
850                Some(hex::encode(DigestAlgorithm::Sha256.digest_path(path)?)),
851                None,
852            )
853        };
854
855        Ok(Self {
856            path: report_path,
857            file_size,
858            file_sha256,
859            symlink_target,
860            sub_path: None,
861            entity: SignatureEntity::Other,
862        })
863    }
864}
865
866/// Entity for reading Apple code signature data.
867pub enum SignatureReader {
868    Dmg(PathBuf, Box<DmgReader>),
869    MachO(PathBuf, Vec<u8>),
870    Bundle(Box<DirectoryBundle>),
871    FlatPackage(PathBuf),
872}
873
874impl SignatureReader {
875    /// Construct a signature reader from a path.
876    pub fn from_path(path: impl AsRef<Path>) -> Result<Self, AppleCodesignError> {
877        let path = path.as_ref();
878        match PathType::from_path(path)? {
879            PathType::Bundle => Ok(Self::Bundle(Box::new(
880                DirectoryBundle::new_from_path(path)
881                    .map_err(AppleCodesignError::DirectoryBundle)?,
882            ))),
883            PathType::Dmg => {
884                let mut fh = File::open(path)?;
885                Ok(Self::Dmg(
886                    path.to_path_buf(),
887                    Box::new(DmgReader::new(&mut fh)?),
888                ))
889            }
890            PathType::MachO => {
891                let data = std::fs::read(path)?;
892                MachFile::parse(&data)?;
893
894                Ok(Self::MachO(path.to_path_buf(), data))
895            }
896            PathType::Xar => Ok(Self::FlatPackage(path.to_path_buf())),
897            PathType::Zip | PathType::Other => Err(AppleCodesignError::UnrecognizedPathType),
898        }
899    }
900
901    /// Obtain entities that are possibly relevant to code signing.
902    pub fn entities(&self) -> Result<Vec<FileEntity>, AppleCodesignError> {
903        match self {
904            Self::Dmg(path, dmg) => {
905                let mut entity = FileEntity::from_path(path, None)?;
906                entity.entity = SignatureEntity::Dmg(Self::resolve_dmg_entity(dmg)?);
907
908                Ok(vec![entity])
909            }
910            Self::MachO(path, data) => Self::resolve_macho_entities_from_data(path, data, None),
911            Self::Bundle(bundle) => Self::resolve_bundle_entities(bundle),
912            Self::FlatPackage(path) => Self::resolve_flat_package_entities(path),
913        }
914    }
915
916    fn resolve_dmg_entity(dmg: &DmgReader) -> Result<DmgEntity, AppleCodesignError> {
917        let signature = if let Some(sig) = dmg.embedded_signature()? {
918            Some(sig.try_into()?)
919        } else {
920            None
921        };
922
923        Ok(DmgEntity {
924            code_signature_offset: dmg.koly().code_signature_offset,
925            code_signature_size: dmg.koly().code_signature_size,
926            signature,
927        })
928    }
929
930    fn resolve_macho_entities_from_data(
931        path: &Path,
932        data: &[u8],
933        report_path: Option<&Path>,
934    ) -> Result<Vec<FileEntity>, AppleCodesignError> {
935        let mut entities = vec![];
936
937        let entity = FileEntity::from_path(path, report_path)?;
938
939        for macho in MachFile::parse(data)?.into_iter() {
940            let mut entity = entity.clone();
941
942            if let Some(index) = macho.index {
943                entity.sub_path = Some(format!("macho-index:{index}"));
944            }
945
946            entity.entity = SignatureEntity::MachO(Self::resolve_macho_entity(macho)?);
947
948            entities.push(entity);
949        }
950
951        Ok(entities)
952    }
953
954    fn resolve_macho_entity(macho: MachOBinary) -> Result<MachOEntity, AppleCodesignError> {
955        let mut entity = MachOEntity::default();
956
957        entity.macho_end_offset = Some(format_integer(macho.data.len()));
958
959        if let Some(sig) = macho.find_signature_data()? {
960            entity.macho_linkedit_start_offset =
961                Some(format_integer(sig.linkedit_segment_start_offset));
962            entity.macho_linkedit_end_offset =
963                Some(format_integer(sig.linkedit_segment_end_offset));
964            entity.macho_signature_start_offset =
965                Some(format_integer(sig.signature_file_start_offset));
966            entity.linkedit_signature_start_offset =
967                Some(format_integer(sig.signature_segment_start_offset));
968        }
969
970        if let Some(sig) = macho.code_signature()? {
971            if let Some(sig_info) = macho.find_signature_data()? {
972                entity.macho_signature_end_offset = Some(format_integer(
973                    sig_info.signature_file_start_offset + sig.length as usize,
974                ));
975                entity.linkedit_signature_end_offset = Some(format_integer(
976                    sig_info.signature_segment_start_offset + sig.length as usize,
977                ));
978
979                let mut linkedit_remaining =
980                    sig_info.linkedit_segment_end_offset - sig_info.linkedit_segment_start_offset;
981                linkedit_remaining -= sig_info.signature_segment_start_offset;
982                linkedit_remaining -= sig.length as usize;
983                entity.linkedit_bytes_after_signature = Some(format_integer(linkedit_remaining));
984            }
985
986            entity.signature = Some(sig.try_into()?);
987        }
988
989        Ok(entity)
990    }
991
992    fn resolve_bundle_entities(
993        bundle: &DirectoryBundle,
994    ) -> Result<Vec<FileEntity>, AppleCodesignError> {
995        let mut entities = vec![];
996
997        for file in bundle
998            .files(true)
999            .map_err(AppleCodesignError::DirectoryBundle)?
1000        {
1001            entities.extend(
1002                Self::resolve_bundle_file_entity(bundle.root_dir().to_path_buf(), file)?
1003                    .into_iter(),
1004            );
1005        }
1006
1007        Ok(entities)
1008    }
1009
1010    fn resolve_bundle_file_entity(
1011        base_path: PathBuf,
1012        file: DirectoryBundleFile,
1013    ) -> Result<Vec<FileEntity>, AppleCodesignError> {
1014        let main_relative_path = match file.absolute_path().strip_prefix(&base_path) {
1015            Ok(path) => path.to_path_buf(),
1016            Err(_) => file.absolute_path().to_path_buf(),
1017        };
1018
1019        let mut entities = vec![];
1020
1021        let mut default_entity =
1022            FileEntity::from_path(file.absolute_path(), Some(&main_relative_path))?;
1023
1024        let file_name = file
1025            .absolute_path()
1026            .file_name()
1027            .expect("path should have file name")
1028            .to_string_lossy();
1029        let parent_dir = file
1030            .absolute_path()
1031            .parent()
1032            .expect("path should have parent directory");
1033
1034        // There may be bugs in the code identifying the role of files in bundles.
1035        // So rely on our own heuristics to detect and report on the file type.
1036        if default_entity.symlink_target.is_some() {
1037            entities.push(default_entity);
1038        } else if parent_dir.ends_with("_CodeSignature") {
1039            if file_name == "CodeResources" {
1040                let data = std::fs::read(file.absolute_path())?;
1041
1042                default_entity.entity =
1043                    SignatureEntity::BundleCodeSignatureFile(CodeSignatureFile::ResourcesXml(
1044                        String::from_utf8_lossy(&data)
1045                            .split('\n')
1046                            .map(|x| x.replace('\t', "  "))
1047                            .collect::<Vec<_>>(),
1048                    ));
1049
1050                entities.push(default_entity);
1051            } else {
1052                default_entity.entity =
1053                    SignatureEntity::BundleCodeSignatureFile(CodeSignatureFile::Other);
1054
1055                entities.push(default_entity);
1056            }
1057        } else if file_name == "CodeResources" {
1058            default_entity.entity =
1059                SignatureEntity::BundleCodeSignatureFile(CodeSignatureFile::NotarizationTicket);
1060
1061            entities.push(default_entity);
1062        } else {
1063            let data = std::fs::read(file.absolute_path())?;
1064
1065            match Self::resolve_macho_entities_from_data(
1066                file.absolute_path(),
1067                &data,
1068                Some(&main_relative_path),
1069            ) {
1070                Ok(extra) => {
1071                    entities.extend(extra);
1072                }
1073                Err(_) => {
1074                    // Just some extra file.
1075                    entities.push(default_entity);
1076                }
1077            }
1078        }
1079
1080        Ok(entities)
1081    }
1082
1083    fn resolve_flat_package_entities(path: &Path) -> Result<Vec<FileEntity>, AppleCodesignError> {
1084        let mut xar = XarReader::new(File::open(path)?)?;
1085
1086        let default_entity = FileEntity::from_path(path, None)?;
1087
1088        let mut entities = vec![];
1089
1090        let mut entity = default_entity.clone();
1091        entity.sub_path = Some("toc".to_string());
1092        entity.entity =
1093            SignatureEntity::XarTableOfContents(XarTableOfContents::from_xar(&mut xar)?);
1094        entities.push(entity);
1095
1096        // Now emit entries for all files in table of contents.
1097        for (name, file) in xar.files()? {
1098            let mut entity = default_entity.clone();
1099            entity.sub_path = Some(name);
1100            entity.entity = SignatureEntity::XarMember(XarFile::try_from(&file)?);
1101            entities.push(entity);
1102        }
1103
1104        Ok(entities)
1105    }
1106}
apple_codesign/reader.rs

apple_codesign/
reader.rs
