apple_codesign/
ticket_lookup.rs

1// This Source Code Form is subject to the terms of the Mozilla Public
2// License, v. 2.0. If a copy of the MPL was not distributed with this
3// file, You can obtain one at https://mozilla.org/MPL/2.0/.
4
5/*! Support for retrieving notarization tickets and stapling artifacts. */
6
7use {
8    crate::AppleCodesignError,
9    base64::{engine::general_purpose::STANDARD as STANDARD_ENGINE, Engine},
10    log::warn,
11    reqwest::blocking::{Client, ClientBuilder},
12    serde::{Deserialize, Serialize},
13    std::collections::HashMap,
14};
15
16/// URL of HTTP service where Apple publishes stapling tickets.
17pub const APPLE_TICKET_LOOKUP_URL: &str = "https://api.apple-cloudkit.com/database/1/com.apple.gk.ticket-delivery/production/public/records/lookup";
18
19/// Main JSON request object for ticket lookup requests.
20#[derive(Clone, Debug, Serialize)]
21pub struct TicketLookupRequest {
22    pub records: Vec<TicketLookupRequestRecord>,
23}
24
25/// Represents a single record to look up in a ticket lookup request.
26#[derive(Clone, Debug, Serialize)]
27#[serde(rename_all = "camelCase")]
28pub struct TicketLookupRequestRecord {
29    pub record_name: String,
30}
31
32/// Main JSON response object to ticket lookup requests.
33#[derive(Clone, Debug, Deserialize)]
34pub struct TicketLookupResponse {
35    pub records: Vec<TicketLookupResponseRecord>,
36}
37
38impl TicketLookupResponse {
39    /// Obtain the signed ticket for a given record name.
40    ///
41    /// `record_name` is of the form `2/<digest_type>/<digest>`. e.g.
42    /// `2/2/deadbeefdeadbeef....`.
43    ///
44    /// Returns an `Err` if a signed ticket could not be found.
45    pub fn signed_ticket(&self, record_name: &str) -> Result<Vec<u8>, AppleCodesignError> {
46        let record = self
47            .records
48            .iter()
49            .find(|r| r.record_name() == record_name)
50            .ok_or_else(|| {
51                AppleCodesignError::NotarizationRecordNotInResponse(record_name.to_string())
52            })?;
53
54        match record {
55            TicketLookupResponseRecord::Success(r) => r
56                .signed_ticket_data()
57                .ok_or(AppleCodesignError::NotarizationRecordNoSignedTicket)?,
58            TicketLookupResponseRecord::Failure(r) => {
59                Err(AppleCodesignError::NotarizationLookupFailure(
60                    r.server_error_code.clone(),
61                    r.reason.clone(),
62                ))
63            }
64        }
65    }
66}
67
68/// Describes the results of a ticket lookup for a specific record.
69#[derive(Clone, Debug, Deserialize)]
70#[serde(untagged)]
71pub enum TicketLookupResponseRecord {
72    /// Ticket was found.
73    Success(TicketLookupResponseRecordSuccess),
74
75    /// Some error occurred.
76    Failure(TicketLookupResponseRecordFailure),
77}
78
79impl TicketLookupResponseRecord {
80    /// Obtain the record name associated with this record.
81    pub fn record_name(&self) -> &str {
82        match self {
83            Self::Success(r) => &r.record_name,
84            Self::Failure(r) => &r.record_name,
85        }
86    }
87}
88
89/// Represents a successful ticket lookup response record.
90#[derive(Clone, Debug, Deserialize)]
91#[serde(rename_all = "camelCase")]
92pub struct TicketLookupResponseRecordSuccess {
93    /// Name of record that was looked up.
94    pub record_name: String,
95
96    pub created: TicketRecordEvent,
97    pub deleted: bool,
98    /// Holds data.
99    ///
100    /// The `signedTicket` key holds the ticket.
101    pub fields: HashMap<String, Field>,
102    pub modified: TicketRecordEvent,
103    // TODO pluginFields
104    pub record_change_tag: String,
105
106    /// A value like `DeveloperIDTicket`.
107    ///
108    /// We could potentially turn this into an enumeration...
109    pub record_type: String,
110}
111
112impl TicketLookupResponseRecordSuccess {
113    /// Obtain the raw signed ticket data in this record.
114    ///
115    /// Evaluates to `Some` if there appears to be a signed ticket and `None`
116    /// otherwise.
117    ///
118    /// There can be an inner `Err` if we don't know how to decode the response data
119    /// or there was an error decoding.
120    pub fn signed_ticket_data(&self) -> Option<Result<Vec<u8>, AppleCodesignError>> {
121        match self.fields.get("signedTicket") {
122            Some(field) => {
123                if field.typ == "BYTES" {
124                    Some(
125                        STANDARD_ENGINE
126                            .decode(&field.value)
127                            .map_err(AppleCodesignError::NotarizationRecordDecodeFailure),
128                    )
129                } else {
130                    Some(Err(
131                        AppleCodesignError::NotarizationRecordSignedTicketNotBytes(
132                            field.typ.clone(),
133                        ),
134                    ))
135                }
136            }
137            None => None,
138        }
139    }
140}
141
142#[derive(Clone, Debug, Deserialize)]
143#[serde(rename_all = "camelCase")]
144pub struct TicketLookupResponseRecordFailure {
145    pub record_name: String,
146    pub reason: String,
147    pub server_error_code: String,
148}
149
150/// Represents an event in a ticket record.
151#[derive(Clone, Debug, Deserialize)]
152#[serde(rename_all = "camelCase")]
153pub struct TicketRecordEvent {
154    #[serde(rename = "deviceID")]
155    pub device_id: String,
156    pub timestamp: u64,
157    pub user_record_name: String,
158}
159
160#[derive(Clone, Debug, Deserialize)]
161pub struct Field {
162    #[serde(rename = "type")]
163    pub typ: String,
164    pub value: String,
165}
166
167/// Obtain the default [Client] to use for HTTP requests.
168pub fn default_client() -> Result<Client, AppleCodesignError> {
169    Ok(ClientBuilder::default()
170        .user_agent("apple-codesign crate (https://crates.io/crates/apple-codesign)")
171        .build()?)
172}
173
174/// Look up a notarization ticket given an HTTP client and an iterable of record names.
175///
176/// The record name is of the form `2/<digest_type>/<code_directory_digest>`.
177pub fn lookup_notarization_tickets<'a>(
178    client: &Client,
179    record_names: impl Iterator<Item = &'a str>,
180) -> Result<TicketLookupResponse, AppleCodesignError> {
181    let body = TicketLookupRequest {
182        records: record_names
183            .map(|x| {
184                warn!("looking up notarization ticket for {}", x);
185                TicketLookupRequestRecord {
186                    record_name: x.to_string(),
187                }
188            })
189            .collect::<Vec<_>>(),
190    };
191
192    let req = client
193        .post(APPLE_TICKET_LOOKUP_URL)
194        .header("Accept", "application/json")
195        .header("Content-Type", "application/json")
196        .json(&body);
197
198    let response = req.send()?;
199
200    let body = response.bytes()?;
201
202    let response = serde_json::from_slice::<TicketLookupResponse>(&body)?;
203
204    Ok(response)
205}
206
207/// Look up a single notarization ticket.
208///
209/// This is just a convenience wrapper around [lookup_notarization_tickets()].
210pub fn lookup_notarization_ticket(
211    client: &Client,
212    record_name: &str,
213) -> Result<TicketLookupResponse, AppleCodesignError> {
214    lookup_notarization_tickets(client, std::iter::once(record_name))
215}
216
217#[cfg(test)]
218mod test {
219    use super::*;
220
221    const PYOXIDIZER_APP_RECORD: &str = "2/2/1b747faf223750de74febed7929f14a73af8c933";
222    const DEADBEEF: &str = "2/2/deadbeefdeadbeefdeadbeefdeadbeefdeadbeef";
223
224    #[test]
225    fn lookup_ticket() -> Result<(), AppleCodesignError> {
226        let client = default_client()?;
227
228        let res = lookup_notarization_ticket(&client, PYOXIDIZER_APP_RECORD)?;
229
230        assert!(matches!(
231            &res.records[0],
232            TicketLookupResponseRecord::Success(_)
233        ));
234
235        let ticket = res.signed_ticket(PYOXIDIZER_APP_RECORD)?;
236        assert_eq!(&ticket[0..4], b"s8ch");
237
238        let res = lookup_notarization_ticket(&client, DEADBEEF)?;
239        assert!(matches!(
240            &res.records[0],
241            TicketLookupResponseRecord::Failure(_)
242        ));
243        assert!(matches!(
244            res.signed_ticket(DEADBEEF),
245            Err(AppleCodesignError::NotarizationLookupFailure(_, _))
246        ));
247
248        Ok(())
249    }
250}
apple_codesign/ticket_lookup.rs

apple_codesign/
ticket_lookup.rs
