+ to use for signing code. This is a mandatory parameter for signing operations.
+ Its value must be either a SecIdentityRef specifying a cryptographic identity
+ valid for Code Signing, or the special value kCFNull to indicate ad-hoc signing.
+ @constant kSecCodeSignerOperation The type of operation to be performed. Valid values
+ are kSecCodeSignerOperationSign to sign code, and kSecCodeSignerOperationRemove
+ to remove any existing signature from code. The default operation is to sign code.
+ @constant kSecCodeSignerPageSize An integer value explicitly specifying the page size
+ used to sign the main executable. This must be a power of two. A value of zero indicates
+ infinite size (no paging).
+ Only certain page sizes are allowed in most circumstances, and specifying an inappropriate
+ size will lead to spurious verification failures. This is for expert use only.
+ @constant kSecCodeSignerRequirements Specifies the internal requirements to be sealed into
+ the code signature. Must be either a CFData containing the binary (compiled) form of
+ a requirements set (SuperBlob), or a CFString containing a valid text form to be
+ compiled into binary form. Default requirements are automatically generated if this
+ parameter is omitted, and defaults may be applied to particular requirement types
+ that are not specified; but any requirement type you specify is sealed exactly as
+ specified.
+ @constant kSecCodeSignerResourceRules A CFDictionary containing resource scanning rules
+ determining what resource files are sealed into the signature (and in what way).
+ A situation-dependent default is applied if this parameter is not specified.
+ @constant kSecCodeSignerSDKRoot A CFURLRef indicating an alterate directory root
+ where signing operations should find subcomponents (libraries, frameworks, modules, etc.).
+ The default is the host system root "/".
+ @constant kSecCodeSignerSigningTime Specifies what date and time is sealed into the
+ code signature's CMS data. Can be either a CFDate object specifying a date, or
+ the value kCFNull indicating that no date should be included in the signature.
+ If not specified, the current date is chosen and sealed.
+ Since an ad-hoc signature has no CMS data, this argument is ineffective
+ for ad-hoc signing operations.
+ @constant kSecCodeSignerRequireTimestamp A CFBoolean indicating (if kCFBooleanTrue) that
+ the code signature should be certified by a timestamp authority service. This option
+ requires access to a timestamp server (usually over the Internet). If requested and
+ the timestamp server cannot be contacted or refuses service, the signing operation fails.
+ The timestamp value is not under the caller's control.
+ If the value is kCFBooleanFalse, no timestamp service is contacted and the resulting signature
+ has no certified timestamp.
+ If this key is omitted, a default is used that may vary from release to release.
+ Note that when signing multi-architectural ("fat") programs, each architecture will
+ be signed separately, and thus each architecture will have a slightly different timestamp.
+ @constant kSecCodeSignerTimestampServer A CFURL specifying which timestamp authority service
+ to contact for timestamping if requested by the kSecCodeSignerRequireTimestamp argument.
+ If omitted (and timestamping is performed), a system-defined default value is used, referring
+ to an Apple-operated timestamp service. Note that this service may not freely serve all requests.
+ @constant kSecCodeSignerTimestampAuthentication A SecIdentityRef describing the identity
+ used to authenticate to the timestamp authority server, if the server requires client-side
+ (SSL/TLS) authentication. This will not generally be the identity used to sign the actual
+ code, depending on the requirements of the timestamp authority service used.
+ If omitted, the timestamp server is contacted using unauthenticated HTTP requests.
+ @constant kSecCodeSignerTimestampOmitCertificates A CFBoolean indicating (if kCFBooleanTrue)
+ that the timestamp embedded in the signature, if requested, not contain the full certificate chain
+ of the timestamp service used. This will make for a marginally smaller signature, but may not
+ verify correctly unless all such certificates are available (through the keychain system)
+ on the verifying system.
+ The default is to embed enough certificates to ensure proper verification of Apple-generated
+ timestamp signatures.
projects / apple / libsecurity_codesigning.git / blobdiff