Security-59306.80.4.tar.gz

[apple/security.git] / OSX / libsecurity_codesigning / lib / SecCodeSigner.h

diff --git a/OSX/libsecurity_codesigning/lib/SecCodeSigner.h b/OSX/libsecurity_codesigning/lib/SecCodeSigner.h
index 4dead60df822c11309eb1beb3b15e0969238b572..eba1183066b0226d3e772f4de680ccd918d79891 100644 (file)
--- a/OSX/libsecurity_codesigning/lib/SecCodeSigner.h
+++ b/OSX/libsecurity_codesigning/lib/SecCodeSigner.h
@@ -135,6 +135,12 @@ CFTypeID SecCodeSignerGetTypeID(void);
                on the verifying system.
                The default is to embed enough certificates to ensure proper verification of Apple-generated
                timestamp signatures.
                on the verifying system.
                The default is to embed enough certificates to ensure proper verification of Apple-generated
                timestamp signatures.

+       @constant kSecCodeSignerRuntimeVersion A CFString indicating the version of runtime hardening policies
+               that the process should be opted into. The string should be of the form "x", "x.x", or "x.x.x" where
+               x is a number between 0 and 255. This parameter is optional. If the signer specifies
+               kSecCodeSignatureRuntime but does not provide this parameter, the runtime version will be the SDK
+               version built into the Mach-O.
+

  */
 extern const CFStringRef kSecCodeSignerApplicationData;
 extern const CFStringRef kSecCodeSignerDetached;
  */
 extern const CFStringRef kSecCodeSignerApplicationData;
 extern const CFStringRef kSecCodeSignerDetached;


@@ -157,6 +163,12 @@ extern const CFStringRef kSecCodeSignerTimestampOmitCertificates;
 extern const CFStringRef kSecCodeSignerPreserveMetadata;
 extern const CFStringRef kSecCodeSignerTeamIdentifier;
 extern const CFStringRef kSecCodeSignerPlatformIdentifier;
 extern const CFStringRef kSecCodeSignerPreserveMetadata;
 extern const CFStringRef kSecCodeSignerTeamIdentifier;
 extern const CFStringRef kSecCodeSignerPlatformIdentifier;

+extern const CFStringRef kSecCodeSignerRuntimeVersion;
+extern const CFStringRef kSecCodeSignerPreserveAFSC;
+extern const CFStringRef kSecCodeSignerOmitAdhocFlag;
+extern const CFStringRef kSecCodeSignerEditCpuType;
+extern const CFStringRef kSecCodeSignerEditCpuSubtype;
+extern const CFStringRef kSecCodeSignerEditCMS;

 
 enum {
     kSecCodeSignerPreserveIdentifier = 1 << 0,         // preserve signing identifier
 
 enum {
     kSecCodeSignerPreserveIdentifier = 1 << 0,         // preserve signing identifier


@@ -164,7 +176,10 @@ enum {
     kSecCodeSignerPreserveEntitlements = 1 << 2,       // preserve entitlements
     kSecCodeSignerPreserveResourceRules = 1 << 3,      // preserve resource rules (and thus resources)
     kSecCodeSignerPreserveFlags = 1 << 4,                      // preserve signing flags
     kSecCodeSignerPreserveEntitlements = 1 << 2,       // preserve entitlements
     kSecCodeSignerPreserveResourceRules = 1 << 3,      // preserve resource rules (and thus resources)
     kSecCodeSignerPreserveFlags = 1 << 4,                      // preserve signing flags

-    kSecCodeSignerPreserveTeamIdentifier = 1 << 5,  // preserve team identifier flags
+       kSecCodeSignerPreserveTeamIdentifier = 1 << 5,  // preserve team identifier flags
+       kSecCodeSignerPreserveDigestAlgorithm = 1 << 6, // preserve digest algorithms used
+       kSecCodeSignerPreservePEH = 1 << 7,                             // preserve pre-encryption hashes
+       kSecCodeSignerPreserveRuntime = 1 << 8,        // preserve the runtime version

 };
 
 
 };
 
 


@@ -178,7 +193,9 @@ enum {
                useful defaults, and will need to be set before signing is attempted.
        @param flags Optional flags. Pass kSecCSDefaultFlags for standard behavior.
                The kSecCSRemoveSignature flag requests that any existing signature be stripped
                useful defaults, and will need to be set before signing is attempted.
        @param flags Optional flags. Pass kSecCSDefaultFlags for standard behavior.
                The kSecCSRemoveSignature flag requests that any existing signature be stripped

-               from the target code instead of signing.
+               from the target code instead of signing. The kSecCSEditSignature flag
+        requests editing of existing signatures, which only works with a very
+        limited set of options.

        @param staticCode On successful return, a SecStaticCode object reference representing
        the file system origin of the given SecCode. On error, unchanged.
        @result Upon success, errSecSuccess. Upon error, an OSStatus value documented in
        @param staticCode On successful return, a SecStaticCode object reference representing
        the file system origin of the given SecCode. On error, unchanged.
        @result Upon success, errSecSuccess. Upon error, an OSStatus value documented in


@@ -193,6 +210,9 @@ enum {
        kSecCSSignNoV1 = 1 << 5,                        // do not include V1 form
        kSecCSSignBundleRoot = 1 << 6,          // include files in bundle root
        kSecCSSignStrictPreflight = 1 << 7, // fail signing operation if signature would fail strict validation
        kSecCSSignNoV1 = 1 << 5,                        // do not include V1 form
        kSecCSSignBundleRoot = 1 << 6,          // include files in bundle root
        kSecCSSignStrictPreflight = 1 << 7, // fail signing operation if signature would fail strict validation

+       kSecCSSignGeneratePEH = 1 << 8,         // generate pre-encryption hashes
+    kSecCSSignGenerateEntitlementDER = 1 << 9, // generate entitlement DER
+    kSecCSEditSignature = 1 << 10,      // edit existing signature

 };
 
 
 };