Security-59306.140.5.tar.gz

[apple/security.git] / OSX / libsecurity_codesigning / lib / SecAssessment.h

diff --git a/OSX/libsecurity_codesigning/lib/SecAssessment.h b/OSX/libsecurity_codesigning/lib/SecAssessment.h
index fb17a20e2bb1a748912b57598d61db614bc9d2cc..59d5fa8d7b38882266a7969b5263bedbb3eb60df 100644 (file)
--- a/OSX/libsecurity_codesigning/lib/SecAssessment.h
+++ b/OSX/libsecurity_codesigning/lib/SecAssessment.h
@@ -24,6 +24,7 @@
 #define _H_SECASSESSMENT
 
 #include <CoreFoundation/CoreFoundation.h>
+#include <Security/CSCommon.h>
 
 #ifdef __cplusplus
 extern "C" {
@@ -87,7 +88,6 @@ extern CFStringRef kSecAssessmentOperationTypeOpenDocument; // .. LaunchServices
        @constant kSecAssessmentAllowWeak Allow signatures that contain known weaknesses, such as an
                insecure resource envelope.
        @constant kSecAssessmentIgnoreWhitelist Do not search the weak signature whitelist.
-       @constant kSecAssessmentFlagDequarantine Set the ASSESSMENT_OK flag if successful.
        @constant kSecAssessmentFlagIgnoreActiveAssessments Permit parallel re-assessment of the same target.
        @constant kSecAssessmentFlagLowPriority Run the assessment in low priority.
 
@@ -105,7 +105,7 @@ enum {
        kSecAssessmentFlagEnforce = 1 << 26,                    // force on (disable bypass switches)
        kSecAssessmentFlagAllowWeak = 1 << 25,                  // allow weak signatures
        kSecAssessmentFlagIgnoreWhitelist = 1 << 24,    // do not search weak signature whitelist
-    kSecAssessmentFlagDequarantine = 1 << 23,          // set the ASSESSMENT_OK flag if successful
+    // 1 << 23 removed (was kSecAssessmentFlagDequarantine)
     kSecAssessmentFlagIgnoreActiveAssessments = 1 << 22, // permit parallel re-assessment of the same target
     kSecAssessmentFlagLowPriority = 1 << 21,        // run the assessment in low priority
 };
@@ -144,6 +144,8 @@ extern CFStringRef kSecAssessmentFeedbackProgress;          // progress reporting feedba
 extern CFStringRef kSecAssessmentFeedbackInfoCurrent;  // info key: current work progress
 extern CFStringRef kSecAssessmentFeedbackInfoTotal;            // info key: total expected work
        
+extern CFStringRef kSecAssessmentContextKeyPrimarySignature; // on document assessment, treat code signature as primary and return its status
+       
 extern CFStringRef kSecAssessmentAssessmentVerdict;            // CFBooleanRef: master result - allow or deny
 extern CFStringRef kSecAssessmentAssessmentOriginator; // CFStringRef: describing the signature originator
 extern CFStringRef kSecAssessmentAssessmentAuthority;  // CFDictionaryRef: authority used to arrive at result
@@ -154,6 +156,8 @@ extern CFStringRef kSecAssessmentAssessmentCodeSigningError; // error code retur
 extern CFStringRef kSecAssessmentAssessmentAuthorityRow; // (internal)
 extern CFStringRef kSecAssessmentAssessmentAuthorityOverride; // (internal)
 extern CFStringRef kSecAssessmentAssessmentAuthorityOriginalVerdict; // (internal)
+extern CFStringRef kSecAssessmentAssessmentAuthorityFlags; // (internal)
+extern CFStringRef kSecAssessmentAssessmentNotarizationDate; // (internal)
 
 extern CFStringRef kDisabledOverride;                                  // AuthorityOverride value for "Gatekeeper is disabled"
 
@@ -310,6 +314,19 @@ Boolean SecAssessmentUpdate(CFTypeRef target,
  */
 Boolean SecAssessmentControl(CFStringRef control, void *arguments, CFErrorRef *errors);
 
+/*
+ * SecAssessmentTicket SPI
+ */
+typedef uint64_t SecAssessmentTicketFlags;
+enum {
+       kSecAssessmentTicketFlagDefault = 0,                            // default behavior, offline check
+       kSecAssessmentTicketFlagForceOnlineCheck = 1 << 0,      // force an online check
+       kSecAssessmentTicketFlagLegacyListCheck = 1 << 1, // Check the DeveloperID Legacy list
+};
+Boolean SecAssessmentTicketRegister(CFDataRef ticketData, CFErrorRef *errors);
+Boolean SecAssessmentRegisterPackageTicket(CFURLRef packageURL, CFErrorRef* errors) API_AVAILABLE(macos(10.14.6));
+Boolean SecAssessmentTicketLookup(CFDataRef hash, SecCSDigestAlgorithm hashType, SecAssessmentTicketFlags flags, double *date, CFErrorRef *errors);
+Boolean SecAssessmentLegacyCheck(CFDataRef hash, SecCSDigestAlgorithm hashType, CFStringRef teamID, CFErrorRef *errors);
 
 #ifdef __cplusplus
 }