Security-55471.14.4.tar.gz

diff --git a/CloudKeychainProxy/CloudKeychainProxy-Info.plist b/CloudKeychainProxy/CloudKeychainProxy-Info.plist
index 307d5a82f8eff8c0cfd0dec8eb9c4802b19590fa..4b3a1ba465db6ec4eed51dc4949c9faccc61dc36 100644 (file)
--- a/CloudKeychainProxy/CloudKeychainProxy-Info.plist
+++ b/CloudKeychainProxy/CloudKeychainProxy-Info.plist
@@ -21,7 +21,7 @@
        <key>CFBundleSignature</key>
        <string>????</string>
        <key>CFBundleVersion</key>
        <key>CFBundleSignature</key>
        <string>????</string>
        <key>CFBundleVersion</key>

-       <string>55471.14</string>
+       <string>55471.14.4</string>

        <key>NSHumanReadableCopyright</key>
        <string>Copyright © 2013 Apple, Inc. All rights reserved.</string>
 </dict>
        <key>NSHumanReadableCopyright</key>
        <string>Copyright © 2013 Apple, Inc. All rights reserved.</string>
 </dict>

diff --git a/Keychain Circle Notification/Keychain Circle Notification-Info.plist b/Keychain Circle Notification/Keychain Circle Notification-Info.plist
index fcfb823b11ff7f96b9a91f56febf88abc13b7d9b..471548b6f284232e18d86a3c930c78c500a290b0 100644 (file)
--- a/Keychain Circle Notification/Keychain Circle Notification-Info.plist
+++ b/Keychain Circle Notification/Keychain Circle Notification-Info.plist
@@ -21,7 +21,7 @@
        <key>CFBundleSignature</key>
        <string>????</string>
        <key>CFBundleVersion</key>
        <key>CFBundleSignature</key>
        <string>????</string>
        <key>CFBundleVersion</key>

-       <string>55471.14</string>
+       <string>55471.14.4</string>

        <key>LSApplicationCategoryType</key>
        <string></string>
        <key>LSMinimumSystemVersion</key>
        <key>LSApplicationCategoryType</key>
        <string></string>
        <key>LSMinimumSystemVersion</key>

diff --git a/Keychain/Keychain-Info.plist b/Keychain/Keychain-Info.plist
index 0e3211c07fe8507374245d0419bfca1f753e3771..0b234892b11c1099b3fcebeecfd735ce35cf289a 100644 (file)
--- a/Keychain/Keychain-Info.plist
+++ b/Keychain/Keychain-Info.plist
@@ -21,7 +21,7 @@
        <key>CFBundleSignature</key>
        <string>????</string>
        <key>CFBundleVersion</key>
        <key>CFBundleSignature</key>
        <string>????</string>
        <key>CFBundleVersion</key>

-       <string>55471.14</string>
+       <string>55471.14.4</string>

        <key>LSMinimumSystemVersion</key>
        <string>${MACOSX_DEPLOYMENT_TARGET}</string>
        <key>NSMainNibFile</key>
        <key>LSMinimumSystemVersion</key>
        <string>${MACOSX_DEPLOYMENT_TARGET}</string>
        <key>NSMainNibFile</key>

diff --git a/authd/Info.plist b/authd/Info.plist
index 55e3b90546ef2208b0d5241cd6e9d241b99fff0f..55e7c8430fa0cde2b16bfa100bf90268414f209d 100644 (file)
--- a/authd/Info.plist
+++ b/authd/Info.plist
@@ -19,7 +19,7 @@
        <key>CFBundleSignature</key>
        <string>????</string>
        <key>CFBundleVersion</key>
        <key>CFBundleSignature</key>
        <string>????</string>
        <key>CFBundleVersion</key>

-       <string>55471.14</string>
+       <string>55471.14.4</string>

        <key>NSHumanReadableCopyright</key>
        <string>Copyright © 2012 Apple. All rights reserved.</string>
        <key>XPCService</key>
        <key>NSHumanReadableCopyright</key>
        <string>Copyright © 2012 Apple. All rights reserved.</string>
        <key>XPCService</key>

diff --git a/lib/Info-Security.plist b/lib/Info-Security.plist
index 683ab139431994bfdfc97118433e778b959f0e75..1bd358d96e52f5f05fa105ad49374394886f5a13 100644 (file)
--- a/lib/Info-Security.plist
+++ b/lib/Info-Security.plist
@@ -19,6 +19,6 @@
        <key>CFBundleSignature</key>
        <string>????</string>
        <key>CFBundleVersion</key>
        <key>CFBundleSignature</key>
        <string>????</string>
        <key>CFBundleVersion</key>

-       <string>55471.14</string>
+       <string>55471.14.4</string>

 </dict>
 </plist>
 </dict>
 </plist>

diff --git a/lib/plugins/csparser-Info.plist b/lib/plugins/csparser-Info.plist
index 53cef9376bfd169cbec274f5393e74bfd7f1d058..21b388561a77fb7ed05176a241b2267708251c79 100644 (file)
--- a/lib/plugins/csparser-Info.plist
+++ b/lib/plugins/csparser-Info.plist
@@ -17,7 +17,7 @@
        <key>CFBundleSignature</key>
        <string>????</string>
        <key>CFBundleVersion</key>
        <key>CFBundleSignature</key>
        <string>????</string>
        <key>CFBundleVersion</key>

-       <string>55471.14</string>
+       <string>55471.14.4</string>

        <key>CFBundleShortVersionString</key>
        <string>3.0</string>
 </dict>
        <key>CFBundleShortVersionString</key>
        <string>3.0</string>
 </dict>

diff --git a/lib/security.exp-in b/lib/security.exp-in
index 301de44bd3e263715f280645f90e786abad9ea16..585b1198b66728918d51fc9e4430e9e277235ffd 100644 (file)
--- a/lib/security.exp-in
+++ b/lib/security.exp-in
@@ -328,6 +328,7 @@ _kSecCodeSignerResourceRules
 _kSecCodeSignerSDKRoot
 _kSecCodeSignerSigningTime
 _kSecCodeSignerRequireTimestamp
 _kSecCodeSignerSDKRoot
 _kSecCodeSignerSigningTime
 _kSecCodeSignerRequireTimestamp

+_kSecCodeSignerTeamIdentifier

 _kSecCodeSignerTimestampServer
 _kSecCodeSignerTimestampAuthentication
 _kSecCodeSignerTimestampOmitCertificates
 _kSecCodeSignerTimestampServer
 _kSecCodeSignerTimestampAuthentication
 _kSecCodeSignerTimestampOmitCertificates


@@ -350,6 +351,7 @@ _kSecCodeInfoRequirements
 _kSecCodeInfoRequirementData
 _kSecCodeInfoSource
 _kSecCodeInfoStatus
 _kSecCodeInfoRequirementData
 _kSecCodeInfoSource
 _kSecCodeInfoStatus

+_kSecCodeInfoTeamIdentifier

 _kSecCodeInfoTrust
 _kSecCodeInfoUnique
 _kSecCodeInfoCodeDirectory
 _kSecCodeInfoTrust
 _kSecCodeInfoUnique
 _kSecCodeInfoCodeDirectory

diff --git a/libsecurity_codesigning/lib/CSCommon.h b/libsecurity_codesigning/lib/CSCommon.h
index 23cd134a210fde052b26746ad3878fcb77c7df94..15f04c70fe3a1bb3dbd3d8de9dc4639e3336ba32 100644 (file)
--- a/libsecurity_codesigning/lib/CSCommon.h
+++ b/libsecurity_codesigning/lib/CSCommon.h
@@ -231,6 +231,7 @@ enum {
        kSecCodeSignatureForceExpiration = 0x0400, /* force certificate expiration checks */
        kSecCodeSignatureRestrict = 0x0800, /* restrict dyld loading */
        kSecCodeSignatureEnforcement = 0x1000, /* enforce code signing */
        kSecCodeSignatureForceExpiration = 0x0400, /* force certificate expiration checks */
        kSecCodeSignatureRestrict = 0x0800, /* restrict dyld loading */
        kSecCodeSignatureEnforcement = 0x1000, /* enforce code signing */

+       kSecCodeSignatureLibraryValidation = 0x2000, /* library validation required */

 };
 
 
 };
 
 

diff --git a/libsecurity_codesigning/lib/CodeSigner.cpp b/libsecurity_codesigning/lib/CodeSigner.cpp
index 6d1f07aa8d1531ff24f60728ec7719bd9948e93d..004fb125f79e3e76046fed55ac34bd456c6806e4 100644 (file)
--- a/libsecurity_codesigning/lib/CodeSigner.cpp
+++ b/libsecurity_codesigning/lib/CodeSigner.cpp
@@ -32,6 +32,7 @@
 #include <security_utilities/unix++.h>
 #include <security_utilities/unixchild.h>
 #include <Security/SecCertificate.h>
 #include <security_utilities/unix++.h>
 #include <security_utilities/unixchild.h>
 #include <Security/SecCertificate.h>

+#include <Security/SecCertificatePriv.h>

 #include <vector>
 
 namespace Security {
 #include <vector>
 
 namespace Security {


@@ -89,6 +90,30 @@ void SecCodeSigner::parameters(CFDictionaryRef paramDict)
                MacOSError::throwMe(errSecCSInvalidObjectRef);
 }
 
                MacOSError::throwMe(errSecCSInvalidObjectRef);
 }
 

+//
+// Retrieve the team ID from the signing certificate if and only if
+// it is an apple developer signing cert
+//
+std::string SecCodeSigner::getTeamIDFromSigner(CFArrayRef certs)
+{
+       if (mSigner && mSigner != SecIdentityRef(kCFNull)) {
+               CFRef<SecCertificateRef> signerCert;
+               MacOSError::check(SecIdentityCopyCertificate(mSigner, &signerCert.aref()));
+
+               /* Make sure the certificate looks like an Apple certificate, because we do not
+                       extract the team ID from a non Apple certificate */
+               if (SecStaticCode::isAppleDeveloperCert(certs)) {
+                       CFRef<CFStringRef> teamIDFromCert;
+
+                       MacOSError::check(SecCertificateCopySubjectComponent(signerCert.get(), &CSSMOID_OrganizationalUnitName, &teamIDFromCert.aref()));
+
+                       if (teamIDFromCert)
+                               return cfString(teamIDFromCert);
+               }
+       }
+
+       return "";
+}

 
 //
 // Roughly check for validity.
 
 //
 // Roughly check for validity.


@@ -218,6 +243,9 @@ SecCodeSigner::Parser::Parser(SecCodeSigner &state, CFDictionaryRef parameters)
        if (CFStringRef ident = get<CFStringRef>(kSecCodeSignerIdentifier))
                state.mIdentifier = cfString(ident);
        
        if (CFStringRef ident = get<CFStringRef>(kSecCodeSignerIdentifier))
                state.mIdentifier = cfString(ident);
        

+       if (CFStringRef teamid = get<CFStringRef>(kSecCodeSignerTeamIdentifier))
+               state.mTeamID = cfString(teamid);
+       

        if (CFStringRef prefix = get<CFStringRef>(kSecCodeSignerIdentifierPrefix))
                state.mIdentifierPrefix = cfString(prefix);
        
        if (CFStringRef prefix = get<CFStringRef>(kSecCodeSignerIdentifierPrefix))
                state.mIdentifierPrefix = cfString(prefix);
        

diff --git a/libsecurity_codesigning/lib/CodeSigner.h b/libsecurity_codesigning/lib/CodeSigner.h
index 9b050c18571922f2aa70a59f737bef3ac9f795b1..18f327ef6c138e2af525290a1fc7692acc659fbb 100644 (file)
--- a/libsecurity_codesigning/lib/CodeSigner.h
+++ b/libsecurity_codesigning/lib/CodeSigner.h
@@ -55,12 +55,14 @@ public:
        
        void parameters(CFDictionaryRef args);  // parse and set parameters
        bool valid() const;
        
        void parameters(CFDictionaryRef args);  // parse and set parameters
        bool valid() const;

+    
+       std::string getTeamIDFromSigner(CFArrayRef certs);

        
        void sign(SecStaticCode *code, SecCSFlags flags);
        void remove(SecStaticCode *code, SecCSFlags flags);
        
        void returnDetachedSignature(BlobCore *blob, Signer &signer);
        
        void sign(SecStaticCode *code, SecCSFlags flags);
        void remove(SecStaticCode *code, SecCSFlags flags);
        
        void returnDetachedSignature(BlobCore *blob, Signer &signer);

-       
+

 protected:
        std::string sdkPath(const std::string &path) const;
        bool isAdhoc() const;
 protected:
        std::string sdkPath(const std::string &path) const;
        bool isAdhoc() const;


@@ -84,6 +86,7 @@ private:
        CodeDirectory::HashAlgorithm mDigestAlgorithm; // interior digest (hash) algorithm
        std::string mIdentifier;                // unique identifier override
        std::string mIdentifierPrefix;  // prefix for un-dotted default identifiers
        CodeDirectory::HashAlgorithm mDigestAlgorithm; // interior digest (hash) algorithm
        std::string mIdentifier;                // unique identifier override
        std::string mIdentifierPrefix;  // prefix for un-dotted default identifiers

+       std::string mTeamID;            // teamID

        bool mNoMachO;                                  // override to perform non-Mach-O signing
        bool mDryRun;                                   // dry run (do not change target)
        CFRef<CFNumberRef> mPageSize;   // main executable page size
        bool mNoMachO;                                  // override to perform non-Mach-O signing
        bool mDryRun;                                   // dry run (do not change target)
        CFRef<CFNumberRef> mPageSize;   // main executable page size

diff --git a/libsecurity_codesigning/lib/SecCode.cpp b/libsecurity_codesigning/lib/SecCode.cpp
index cd91d81349c0bd4707325739da0a1f03310fa64c..12e719fa3bbda05b210e382c295eae935141583e 100644 (file)
--- a/libsecurity_codesigning/lib/SecCode.cpp
+++ b/libsecurity_codesigning/lib/SecCode.cpp
@@ -242,6 +242,7 @@ const CFStringRef kSecCodeInfoRequirements =        CFSTR("requirements");
 const CFStringRef kSecCodeInfoRequirementData =        CFSTR("requirement-data");
 const CFStringRef kSecCodeInfoSource =                 CFSTR("source");
 const CFStringRef kSecCodeInfoStatus =                 CFSTR("status");
 const CFStringRef kSecCodeInfoRequirementData =        CFSTR("requirement-data");
 const CFStringRef kSecCodeInfoSource =                 CFSTR("source");
 const CFStringRef kSecCodeInfoStatus =                 CFSTR("status");

+const CFStringRef kSecCodeInfoTeamIdentifier =  CFSTR("teamid");

 const CFStringRef kSecCodeInfoTime =                   CFSTR("signing-time");
 const CFStringRef kSecCodeInfoTimestamp =              CFSTR("signing-timestamp");
 const CFStringRef kSecCodeInfoTrust =                  CFSTR("trust");
 const CFStringRef kSecCodeInfoTime =                   CFSTR("signing-time");
 const CFStringRef kSecCodeInfoTimestamp =              CFSTR("signing-timestamp");
 const CFStringRef kSecCodeInfoTrust =                  CFSTR("trust");

diff --git a/libsecurity_codesigning/lib/SecCode.h b/libsecurity_codesigning/lib/SecCode.h
index 1afbfebd68c6ded5c8b0810e76d704dedfe85648..ee773ae15b10f1ac8f5ffa7983e6007ec6bcdc10 100644 (file)
--- a/libsecurity_codesigning/lib/SecCode.h
+++ b/libsecurity_codesigning/lib/SecCode.h
@@ -413,6 +413,7 @@ extern const CFStringRef kSecCodeInfoRequirements;  /* Requirement */
 extern const CFStringRef kSecCodeInfoRequirementData; /* Requirement */
 extern const CFStringRef kSecCodeInfoSource;           /* generic */
 extern const CFStringRef kSecCodeInfoStatus;           /* Dynamic */
 extern const CFStringRef kSecCodeInfoRequirementData; /* Requirement */
 extern const CFStringRef kSecCodeInfoSource;           /* generic */
 extern const CFStringRef kSecCodeInfoStatus;           /* Dynamic */

+extern const CFStringRef kSecCodeInfoTeamIdentifier; /* Signing */

 extern const CFStringRef kSecCodeInfoTime;                     /* Signing */
 extern const CFStringRef kSecCodeInfoTimestamp;                /* Signing */
 extern const CFStringRef kSecCodeInfoTrust;                    /* Signing */
 extern const CFStringRef kSecCodeInfoTime;                     /* Signing */
 extern const CFStringRef kSecCodeInfoTimestamp;                /* Signing */
 extern const CFStringRef kSecCodeInfoTrust;                    /* Signing */

diff --git a/libsecurity_codesigning/lib/SecCodeSigner.cpp b/libsecurity_codesigning/lib/SecCodeSigner.cpp
index 33e380291c42552d82057694fe0ba21ddfc5b66c..a705ba7180d281eddd7f1781c1e8d8b5372ef8c8 100644 (file)
--- a/libsecurity_codesigning/lib/SecCodeSigner.cpp
+++ b/libsecurity_codesigning/lib/SecCodeSigner.cpp
@@ -57,6 +57,7 @@ const CFStringRef kSecCodeSignerTimestampServer = CFSTR("timestamp-url");
 const CFStringRef kSecCodeSignerTimestampAuthentication = CFSTR("timestamp-authentication");
 const CFStringRef kSecCodeSignerTimestampOmitCertificates =    CFSTR("timestamp-omit-certificates");
 const CFStringRef kSecCodeSignerPreserveMetadata = CFSTR("preserve-metadata");
 const CFStringRef kSecCodeSignerTimestampAuthentication = CFSTR("timestamp-authentication");
 const CFStringRef kSecCodeSignerTimestampOmitCertificates =    CFSTR("timestamp-omit-certificates");
 const CFStringRef kSecCodeSignerPreserveMetadata = CFSTR("preserve-metadata");

+const CFStringRef kSecCodeSignerTeamIdentifier =       CFSTR("teamidentifier");

 
 // temporary add-back to bridge B&I build dependencies -- remove soon
 const CFStringRef kSecCodeSignerTSAUse = CFSTR("timestamp-required");
 
 // temporary add-back to bridge B&I build dependencies -- remove soon
 const CFStringRef kSecCodeSignerTSAUse = CFSTR("timestamp-required");

diff --git a/libsecurity_codesigning/lib/SecCodeSigner.h b/libsecurity_codesigning/lib/SecCodeSigner.h
index b0c223834952b6f27e4c5c0ffd9913b365ea6f72..d5c15962eb9523382b8ed1c8023ed3578a0d57de 100644 (file)
--- a/libsecurity_codesigning/lib/SecCodeSigner.h
+++ b/libsecurity_codesigning/lib/SecCodeSigner.h
@@ -155,6 +155,7 @@ extern const CFStringRef kSecCodeSignerRequireTimestamp;
 extern const CFStringRef kSecCodeSignerTimestampServer;
 extern const CFStringRef kSecCodeSignerTimestampOmitCertificates;
 extern const CFStringRef kSecCodeSignerPreserveMetadata;
 extern const CFStringRef kSecCodeSignerTimestampServer;
 extern const CFStringRef kSecCodeSignerTimestampOmitCertificates;
 extern const CFStringRef kSecCodeSignerPreserveMetadata;

+extern const CFStringRef kSecCodeSignerTeamIdentifier;

 
 enum {
     kSecCodeSignerPreserveIdentifier = 1 << 0,         // preserve signing identifier
 
 enum {
     kSecCodeSignerPreserveIdentifier = 1 << 0,         // preserve signing identifier


@@ -162,6 +163,7 @@ enum {
     kSecCodeSignerPreserveEntitlements = 1 << 2,       // preserve entitlements
     kSecCodeSignerPreserveResourceRules = 1 << 3,      // preserve resource rules (and thus resources)
     kSecCodeSignerPreserveFlags = 1 << 4,                      // preserve signing flags
     kSecCodeSignerPreserveEntitlements = 1 << 2,       // preserve entitlements
     kSecCodeSignerPreserveResourceRules = 1 << 3,      // preserve resource rules (and thus resources)
     kSecCodeSignerPreserveFlags = 1 << 4,                      // preserve signing flags

+    kSecCodeSignerPreserveTeamIdentifier = 1 << 5,  // preserve team identifier flags

 };
 
 
 };
 
 

diff --git a/libsecurity_codesigning/lib/StaticCode.cpp b/libsecurity_codesigning/lib/StaticCode.cpp
index a26a1fee33a0456ad3426013d744b12c3c17d63a..62bfe21544644dd72d73c02f3085991b3e7dc5d6 100644 (file)
--- a/libsecurity_codesigning/lib/StaticCode.cpp
+++ b/libsecurity_codesigning/lib/StaticCode.cpp
@@ -47,6 +47,7 @@
 #include <security_utilities/unix++.h>
 #include <security_utilities/cfmunge.h>
 #include <Security/CMSDecoder.h>
 #include <security_utilities/unix++.h>
 #include <security_utilities/cfmunge.h>
 #include <Security/CMSDecoder.h>

+#include <security_utilities/logging.h>

 
 
 namespace Security {
 
 
 namespace Security {


@@ -54,6 +55,13 @@ namespace CodeSigning {
 
 using namespace UnixPlusPlus;
 
 
 using namespace UnixPlusPlus;
 

+// A requirement representing a Mac or iOS dev cert, a Mac or iOS distribution cert, or a developer ID
+static const char WWDRRequirement[] = "anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.1] exists "
+                                                               "and ( cert leaf[subject.CN] = \"Mac Developer: \"* or cert leaf[subject.CN] = \"iPhone Developer: \"* )";
+static const char developerID[] = "anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists"
+                                                                                       " and certificate leaf[field.1.2.840.113635.100.6.1.13] exists";
+static const char distributionCertificate[] =  "anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.7] exists";
+static const char iPhoneDistributionCert[] =   "anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.4] exists";

 
 //
 // Map a component slot number to a suitable error code for a failure
 
 //
 // Map a component slot number to a suitable error code for a failure


@@ -478,6 +486,30 @@ bool SecStaticCode::verifySignature()
                SecTrustResultType trustResult;
                MacOSError::check(SecTrustEvaluate(mTrust, &trustResult));
                MacOSError::check(SecTrustGetResult(mTrust, &trustResult, &mCertChain.aref(), &mEvalDetails));
                SecTrustResultType trustResult;
                MacOSError::check(SecTrustEvaluate(mTrust, &trustResult));
                MacOSError::check(SecTrustGetResult(mTrust, &trustResult, &mCertChain.aref(), &mEvalDetails));

+
+               // if this is an Apple developer cert....
+               if (teamID() && SecStaticCode::isAppleDeveloperCert(mCertChain)) {
+                       CFRef<CFStringRef> teamIDFromCert;
+                       if (CFArrayGetCount(mCertChain) > 0) {
+                               /* Note that SecCertificateCopySubjectComponent sets the out paramater to NULL if there is no field present */
+                               MacOSError::check(SecCertificateCopySubjectComponent((SecCertificateRef)CFArrayGetValueAtIndex(mCertChain, Requirement::leafCert),
+                                                                                                                                        &CSSMOID_OrganizationalUnitName,
+                                                                                                                                        &teamIDFromCert.aref()));
+
+                               if (teamIDFromCert) {
+                                       CFRef<CFStringRef> teamIDFromCD = CFStringCreateWithCString(NULL, teamID(), kCFStringEncodingUTF8);
+                                       if (!teamIDFromCD) {
+                                               MacOSError::throwMe(errSecCSInternalError);
+                                       }
+
+                                       if (CFStringCompare(teamIDFromCert, teamIDFromCD, 0) != kCFCompareEqualTo) {
+                                               Security::Syslog::error("Team identifier in the signing certificate (%s) does not match the team identifier (%s) in the code directory", cfString(teamIDFromCert).c_str(), teamID());
+                                               MacOSError::throwMe(errSecCSSignatureInvalid);
+                                       }
+                               }
+                       }
+               }
+

                CODESIGN_EVAL_STATIC_SIGNATURE_RESULT(this, trustResult, mCertChain ? (int)CFArrayGetCount(mCertChain) : 0);
                switch (trustResult) {
                case kSecTrustResultProceed:
                CODESIGN_EVAL_STATIC_SIGNATURE_RESULT(this, trustResult, mCertChain ? (int)CFArrayGetCount(mCertChain) : 0);
                switch (trustResult) {
                case kSecTrustResultProceed:


@@ -1162,6 +1194,8 @@ CFDictionaryRef SecStaticCode::signingInformation(SecCSFlags flags)
                        if (CFAbsoluteTime time = this->signingTimestamp())
                                if (CFRef<CFDateRef> date = CFDateCreate(NULL, time))
                                        CFDictionaryAddValue(dict, kSecCodeInfoTimestamp, date);
                        if (CFAbsoluteTime time = this->signingTimestamp())
                                if (CFRef<CFDateRef> date = CFDateCreate(NULL, time))
                                        CFDictionaryAddValue(dict, kSecCodeInfoTimestamp, date);

+                       if (const char *teamID = this->teamID())
+                               CFDictionaryAddValue(dict, kSecCodeInfoTeamIdentifier, CFTempString(teamID));

                } catch (...) { }
        
        //
                } catch (...) { }
        
        //


@@ -1343,6 +1377,11 @@ void SecStaticCode::handleOtherArchitectures(void (^handle)(SecStaticCode* other
                                if (ctx.offset != activeOffset) {       // inactive architecture; check it
                                        SecPointer<SecStaticCode> subcode = new SecStaticCode(DiskRep::bestGuess(this->mainExecutablePath(), &ctx));
                                        subcode->detachedSignature(this->mDetachedSig); // carry over explicit (but not implicit) detached signature
                                if (ctx.offset != activeOffset) {       // inactive architecture; check it
                                        SecPointer<SecStaticCode> subcode = new SecStaticCode(DiskRep::bestGuess(this->mainExecutablePath(), &ctx));
                                        subcode->detachedSignature(this->mDetachedSig); // carry over explicit (but not implicit) detached signature

+                                       if (this->teamID() == NULL || subcode->teamID() == NULL) {
+                                               if (this->teamID() != subcode->teamID())
+                                                       MacOSError::throwMe(errSecCSSignatureInvalid);
+                                       } else if (strcmp(this->teamID(), subcode->teamID()) != 0)
+                                               MacOSError::throwMe(errSecCSSignatureInvalid);

                                        handle(subcode);
                                }
                        }
                                        handle(subcode);
                                }
                        }


@@ -1350,6 +1389,19 @@ void SecStaticCode::handleOtherArchitectures(void (^handle)(SecStaticCode* other
        }
 }
 
        }
 }
 

+//
+// A method that takes a certificate chain (certs) and evaluates
+// if it is a Mac or IPhone developer cert, an app store distribution cert,
+// or a developer ID
+//
+bool SecStaticCode::isAppleDeveloperCert(CFArrayRef certs)
+{
+       static const std::string appleDeveloperRequirement = "(" + std::string(WWDRRequirement) + ") or (" + developerID + ") or (" + distributionCertificate + ") or (" + iPhoneDistributionCert + ")";
+       SecRequirement *req = new SecRequirement(parseRequirement(appleDeveloperRequirement), true);
+       Requirement::Context ctx(certs, NULL, NULL, "", NULL);
+
+       return req->requirement()->validates(ctx);
+}

 
 } // end namespace CodeSigning
 } // end namespace Security
 
 } // end namespace CodeSigning
 } // end namespace Security

diff --git a/libsecurity_codesigning/lib/StaticCode.h b/libsecurity_codesigning/lib/StaticCode.h
index 66b05ed01738c230beed8ac51a16458d59ebab02..b7c5b72aa3699f8f534744ba4bf7abe6b231bc84 100644 (file)
--- a/libsecurity_codesigning/lib/StaticCode.h
+++ b/libsecurity_codesigning/lib/StaticCode.h
@@ -119,6 +119,7 @@ public:
        std::string mainExecutablePath() { return mRep->mainExecutablePath(); }
        CFURLRef canonicalPath() const { return mRep->canonicalPath(); }
        std::string identifier() { return codeDirectory()->identifier(); }
        std::string mainExecutablePath() { return mRep->mainExecutablePath(); }
        CFURLRef canonicalPath() const { return mRep->canonicalPath(); }
        std::string identifier() { return codeDirectory()->identifier(); }

+       const char *teamID() { return codeDirectory()->teamID(); }

        std::string format() const { return mRep->format(); }
        std::string signatureSource();
        virtual CFDataRef component(CodeDirectory::SpecialSlot slot, OSStatus fail = errSecCSSignatureFailed);
        std::string format() const { return mRep->format(); }
        std::string signatureSource();
        virtual CFDataRef component(CodeDirectory::SpecialSlot slot, OSStatus fail = errSecCSSignatureFailed);


@@ -169,10 +170,12 @@ public:
        
        CFDictionaryRef signingInformation(SecCSFlags flags); // omnibus information-gathering API (creates new dictionary)
 
        
        CFDictionaryRef signingInformation(SecCSFlags flags); // omnibus information-gathering API (creates new dictionary)
 

+       static bool isAppleDeveloperCert(CFArrayRef certs); // determines if this is an apple developer certificate for libraray validation
+

 public:
        void staticValidate(SecCSFlags flags, const SecRequirement *req);
        void staticValidateCore(SecCSFlags flags, const SecRequirement *req);
 public:
        void staticValidate(SecCSFlags flags, const SecRequirement *req);
        void staticValidateCore(SecCSFlags flags, const SecRequirement *req);

-       
+

 protected:
        CFDictionaryRef getDictionary(CodeDirectory::SpecialSlot slot, bool check = true); // component value as a dictionary
        bool verifySignature();
 protected:
        CFDictionaryRef getDictionary(CodeDirectory::SpecialSlot slot, bool check = true); // component value as a dictionary
        bool verifySignature();

diff --git a/libsecurity_codesigning/lib/cdbuilder.cpp b/libsecurity_codesigning/lib/cdbuilder.cpp
index e191779249ac4fe20c98b03a62577fd5cd0152aa..279998f832998dd43ac2bbd73fc45a47f43f7116 100644 (file)
--- a/libsecurity_codesigning/lib/cdbuilder.cpp
+++ b/libsecurity_codesigning/lib/cdbuilder.cpp
@@ -108,11 +108,24 @@ CodeDirectory::Scatter *CodeDirectory::Builder::scatter(unsigned count)
        return mScatter;
 }
 
        return mScatter;
 }
 

+// This calculates the fixed size of the code directory
+// Because of <rdar://problem/16102695>, if the team ID
+// field is not used, we leave out the team ID offset
+// as well, to keep cd hashes consistent between
+// versions.
+const size_t CodeDirectory::Builder::fixedSize(const uint32_t version)
+{
+       size_t cdSize = sizeof(CodeDirectory);
+       if (version < supportsTeamID)
+               cdSize -= sizeof(mDir->teamIDOffset);
+
+       return cdSize;
+}

 
 //
 // Calculate the size we'll need for the CodeDirectory as described so far
 //
 
 //
 // Calculate the size we'll need for the CodeDirectory as described so far
 //

-size_t CodeDirectory::Builder::size()
+size_t CodeDirectory::Builder::size(const uint32_t version)

 {
        assert(mExec);                  // must have called executable()
        if (mExecLength == 0)
 {
        assert(mExec);                  // must have called executable()
        if (mExecLength == 0)


@@ -125,10 +138,14 @@ size_t CodeDirectory::Builder::size()
                mCodeSlots = (mExecLength + mPageSize - 1) / mPageSize; // round up
        }
                
                mCodeSlots = (mExecLength + mPageSize - 1) / mPageSize; // round up
        }
                

-       size_t offset = sizeof(CodeDirectory);
+       size_t offset = fixedSize(version);
+       

        offset += mScatterSize;                         // scatter vector
        offset += mIdentifier.size() + 1;       // size of identifier (with null byte)
        offset += mScatterSize;                         // scatter vector
        offset += mIdentifier.size() + 1;       // size of identifier (with null byte)

+       if (mTeamID.size())
+               offset += mTeamID.size() + 1;   // size of teamID (with null byte)

        offset += (mCodeSlots + mSpecialSlots) * mDigestLength; // hash vector
        offset += (mCodeSlots + mSpecialSlots) * mDigestLength; // hash vector

+

        return offset;
 }
 
        return offset;
 }
 


@@ -149,16 +166,26 @@ size_t CodeDirectory::Builder::size()
 CodeDirectory *CodeDirectory::Builder::build()
 {
        assert(mExec);                  // must have (successfully) called executable()
 CodeDirectory *CodeDirectory::Builder::build()
 {
        assert(mExec);                  // must have (successfully) called executable()

-
+       uint32_t version;
+       

        // size and allocate
        size_t identLength = mIdentifier.size() + 1;
        // size and allocate
        size_t identLength = mIdentifier.size() + 1;

-       size_t total = size();
+       size_t teamIDLength = mTeamID.size() + 1;
+       
+       // Determine the version
+       if (mTeamID.size()) {
+               version = currentVersion;
+       } else {
+               version = supportsScatter;
+       }
+       
+       size_t total = size(version);

        if (!(mDir = (CodeDirectory *)calloc(1, total)))        // initialize to zero
                UnixError::throwMe(ENOMEM);
        
        // fill header
        mDir->initialize(total);
        if (!(mDir = (CodeDirectory *)calloc(1, total)))        // initialize to zero
                UnixError::throwMe(ENOMEM);
        
        // fill header
        mDir->initialize(total);

-       mDir->version = currentVersion;
+       mDir->version = version;

        mDir->flags = mFlags;
        mDir->nSpecialSlots = (uint32_t)mSpecialSlots;
        mDir->nCodeSlots = (uint32_t)mCodeSlots;
        mDir->flags = mFlags;
        mDir->nSpecialSlots = (uint32_t)mSpecialSlots;
        mDir->nCodeSlots = (uint32_t)mCodeSlots;


@@ -175,8 +202,8 @@ CodeDirectory *CodeDirectory::Builder::build()
                mDir->pageSize = 0;     // means infinite page size
 
        // locate and fill flex fields
                mDir->pageSize = 0;     // means infinite page size
 
        // locate and fill flex fields

-       size_t offset = sizeof(CodeDirectory);
-
+       size_t offset = fixedSize(mDir->version);
+       

        if (mScatter) {
                mDir->scatterOffset = (uint32_t)offset;
                memcpy(mDir->scatterVector(), mScatter, mScatterSize);
        if (mScatter) {
                mDir->scatterOffset = (uint32_t)offset;
                memcpy(mDir->scatterVector(), mScatter, mScatterSize);


@@ -186,7 +213,12 @@ CodeDirectory *CodeDirectory::Builder::build()
        mDir->identOffset = (uint32_t)offset;
        memcpy(mDir->identifier(), mIdentifier.c_str(), identLength);
        offset += identLength;
        mDir->identOffset = (uint32_t)offset;
        memcpy(mDir->identifier(), mIdentifier.c_str(), identLength);
        offset += identLength;

-
+       
+       if (mTeamID.size()) {
+               mDir->teamIDOffset = (uint32_t)offset;
+               memcpy(mDir->teamID(), mTeamID.c_str(), teamIDLength);
+               offset += teamIDLength;
+       }

        // (add new flexibly-allocated fields here)
 
        mDir->hashOffset = (uint32_t)(offset + mSpecialSlots * mDigestLength);
        // (add new flexibly-allocated fields here)
 
        mDir->hashOffset = (uint32_t)(offset + mSpecialSlots * mDigestLength);

diff --git a/libsecurity_codesigning/lib/cdbuilder.h b/libsecurity_codesigning/lib/cdbuilder.h
index fd5e54b0c792853aa08871cea7e70a3ff3f40307..5e697896d2b9a6e964d3b17a0daa1048aa6086c5 100644 (file)
--- a/libsecurity_codesigning/lib/cdbuilder.h
+++ b/libsecurity_codesigning/lib/cdbuilder.h
@@ -51,13 +51,15 @@ public:
 
        void specialSlot(SpecialSlot slot, CFDataRef data);
        void identifier(const std::string &code) { mIdentifier = code; }
 
        void specialSlot(SpecialSlot slot, CFDataRef data);
        void identifier(const std::string &code) { mIdentifier = code; }

+       void teamID(const std::string &team) { mTeamID = team; }

        void flags(uint32_t f) { mFlags = f; }
        
        Scatter *scatter(unsigned count);                       // allocate that many scatter elements (w/o sentinel)
        Scatter *scatter() { return mScatter; }         // return already allocated scatter vector
        
        void flags(uint32_t f) { mFlags = f; }
        
        Scatter *scatter(unsigned count);                       // allocate that many scatter elements (w/o sentinel)
        Scatter *scatter() { return mScatter; }         // return already allocated scatter vector
        

-       size_t size();                                                          // calculate size
+       size_t size(const uint32_t version);            // calculate size

        CodeDirectory *build();                                         // build CodeDirectory and return it
        CodeDirectory *build();                                         // build CodeDirectory and return it

+       const size_t fixedSize(const uint32_t version); // calculate fixed size of the CodeDirectory

 
        DynamicHash *getHash() const { return CodeDirectory::hashFor(this->mHashType); }
        
 
        DynamicHash *getHash() const { return CodeDirectory::hashFor(this->mHashType); }
        


@@ -77,6 +79,7 @@ private:
        uint32_t mHashType;                                                     // digest algorithm code
        uint32_t mDigestLength;                                         // number of bytes in a single glue digest
        std::string mIdentifier;                                        // canonical identifier
        uint32_t mHashType;                                                     // digest algorithm code
        uint32_t mDigestLength;                                         // number of bytes in a single glue digest
        std::string mIdentifier;                                        // canonical identifier

+       std::string mTeamID;                        // team identifier

        
        size_t mSpecialSlots;                                           // highest special slot set
        size_t mCodeSlots;                                                      // number of code pages (slots)
        
        size_t mSpecialSlots;                                           // highest special slot set
        size_t mCodeSlots;                                                      // number of code pages (slots)

diff --git a/libsecurity_codesigning/lib/codedirectory.cpp b/libsecurity_codesigning/lib/codedirectory.cpp
index 06f67a3239df23a7643a0b82de087df036a9b5fb..706a7b0f452e3649d5c3979d72ae34e7155d8913 100644 (file)
--- a/libsecurity_codesigning/lib/codedirectory.cpp
+++ b/libsecurity_codesigning/lib/codedirectory.cpp
@@ -143,6 +143,8 @@ void CodeDirectory::checkIntegrity() const
        // now check interior offsets for validity
        if (!stringAt(identOffset))
                MacOSError::throwMe(errSecCSSignatureFailed); // identifier out of blob range
        // now check interior offsets for validity
        if (!stringAt(identOffset))
                MacOSError::throwMe(errSecCSSignatureFailed); // identifier out of blob range

+       if (version >= supportsTeamID && teamIDOffset != 0 && !stringAt(teamIDOffset))
+                       MacOSError::throwMe(errSecCSSignatureFailed); // identifier out of blob range

        if (!contains(hashOffset - int64_t(hashSize) * nSpecialSlots, hashSize * (int64_t(nSpecialSlots) + nCodeSlots)))
                MacOSError::throwMe(errSecCSSignatureFailed); // hash array out of blob range
        if (const Scatter *scatter = this->scatterVector()) {
        if (!contains(hashOffset - int64_t(hashSize) * nSpecialSlots, hashSize * (int64_t(nSpecialSlots) + nCodeSlots)))
                MacOSError::throwMe(errSecCSSignatureFailed); // hash array out of blob range
        if (const Scatter *scatter = this->scatterVector()) {


@@ -292,5 +294,6 @@ const SecCodeDirectoryFlagTable kSecCodeDirectoryFlagTable[] = {
        { "expires",            kSecCodeSignatureForceExpiration,       true },
        { "restrict",           kSecCodeSignatureRestrict,              true },
        { "enforcement",        kSecCodeSignatureEnforcement,           true },
        { "expires",            kSecCodeSignatureForceExpiration,       true },
        { "restrict",           kSecCodeSignatureRestrict,              true },
        { "enforcement",        kSecCodeSignatureEnforcement,           true },

+       { "library-validation", kSecCodeSignatureLibraryValidation,             true },

        { NULL }
 };
        { NULL }
 };

diff --git a/libsecurity_codesigning/lib/codedirectory.h b/libsecurity_codesigning/lib/codedirectory.h
index 08c81c686ca898afca18da05b5a8d8df8143675c..4b64c14695a57be89eb0de2b1925be7df3c5e608 100644 (file)
--- a/libsecurity_codesigning/lib/codedirectory.h
+++ b/libsecurity_codesigning/lib/codedirectory.h
@@ -180,13 +180,15 @@ public:
        uint8_t pageSize;                               // log2(page size in bytes); 0 => infinite
        Endian<uint32_t> spare2;                // unused (must be zero)
        Endian<uint32_t> scatterOffset; // offset of optional scatter vector (zero if absent)
        uint8_t pageSize;                               // log2(page size in bytes); 0 => infinite
        Endian<uint32_t> spare2;                // unused (must be zero)
        Endian<uint32_t> scatterOffset; // offset of optional scatter vector (zero if absent)

+       Endian<uint32_t> teamIDOffset;  // offset of optional teamID string

        
        // works with the version field; see comments above
        
        // works with the version field; see comments above

-       static const uint32_t currentVersion = 0x20100;         // "version 2.1"
+       static const uint32_t currentVersion = 0x20200;         // "version 2.2"

        static const uint32_t compatibilityLimit = 0x2F000;     // "version 3 with wiggle room"
        
        static const uint32_t earliestVersion = 0x20001;        // earliest supported version
        static const uint32_t supportsScatter = 0x20100;        // first version to support scatter option
        static const uint32_t compatibilityLimit = 0x2F000;     // "version 3 with wiggle room"
        
        static const uint32_t earliestVersion = 0x20001;        // earliest supported version
        static const uint32_t supportsScatter = 0x20100;        // first version to support scatter option

+       static const uint32_t supportsTeamID = 0x20200; // first version to support team ID option

        
        void checkIntegrity() const;    // throws if inconsistent or unsupported version
 
        
        void checkIntegrity() const;    // throws if inconsistent or unsupported version
 


@@ -196,7 +198,7 @@ public:
        
        const char *identifier() const { return at<const char>(identOffset); }
        char *identifier() { return at<char>(identOffset); }
        
        const char *identifier() const { return at<const char>(identOffset); }
        char *identifier() { return at<char>(identOffset); }

-
+    

        // main hash array access
        SpecialSlot maxSpecialSlot() const;
                
        // main hash array access
        SpecialSlot maxSpecialSlot() const;
                


@@ -230,7 +232,10 @@ public:
                { return (version >= supportsScatter && scatterOffset) ? at<Scatter>(scatterOffset) : NULL; }
        const Scatter *scatterVector() const
                { return (version >= supportsScatter && scatterOffset) ? at<const Scatter>(scatterOffset) : NULL; }
                { return (version >= supportsScatter && scatterOffset) ? at<Scatter>(scatterOffset) : NULL; }
        const Scatter *scatterVector() const
                { return (version >= supportsScatter && scatterOffset) ? at<const Scatter>(scatterOffset) : NULL; }

-       
+
+       const char *teamID() const { return version >= supportsTeamID && teamIDOffset ? at<const char>(teamIDOffset) : NULL; }
+       char *teamID() { return version >= supportsTeamID && teamIDOffset ? at<char>(teamIDOffset) : NULL; }
+    

 public:
        bool validateSlot(const void *data, size_t size, Slot slot) const;                      // validate memory buffer against page slot
        bool validateSlot(UnixPlusPlus::FileDesc fd, size_t size, Slot slot) const;     // read and validate file
 public:
        bool validateSlot(const void *data, size_t size, Slot slot) const;                      // validate memory buffer against page slot
        bool validateSlot(UnixPlusPlus::FileDesc fd, size_t size, Slot slot) const;     // read and validate file

diff --git a/libsecurity_codesigning/lib/signer.cpp b/libsecurity_codesigning/lib/signer.cpp
index 968accf152f97ae68f7c6238e6c18713d8b0b7f2..9b676c339b9d9b5c26c65ae0b0a06f34695d4807 100644 (file)
--- a/libsecurity_codesigning/lib/signer.cpp
+++ b/libsecurity_codesigning/lib/signer.cpp
@@ -53,8 +53,33 @@ void SecCodeSigner::Signer::sign(SecCSFlags flags)
 {
        rep = code->diskRep()->base();
        this->prepare(flags);
 {
        rep = code->diskRep()->base();
        this->prepare(flags);

-       
+

        PreSigningContext context(*this);
        PreSigningContext context(*this);

+
+       /* If an explicit teamID was passed in it must be
+        the same as what came from the cert */
+       std::string teamIDFromCert = state.getTeamIDFromSigner(context.certs);
+
+       if (state.mPreserveMetadata & kSecCodeSignerPreserveTeamIdentifier) {
+               /* If preserving the team identifier, teamID is set previously when the
+                code object is still available */
+               if (!teamIDFromCert.empty() && teamID != teamIDFromCert)
+                       MacOSError::throwMe(errSecCSInvalidFlags);
+       } else {
+               if (teamIDFromCert.empty()) {
+                       /* state.mTeamID is an explicitly passed teamID */
+                       teamID = state.mTeamID;
+               } else if (state.mTeamID.empty() || (state.mTeamID == teamIDFromCert)) {
+                       /* If there was no explicit team ID set, or the explicit team ID matches
+                        what is in the cert, use the team ID from the certificate */
+                       teamID = teamIDFromCert;
+               } else {
+                       /* The caller passed in an explicit team ID that does not match what is
+                        in the signing cert, which is an invalid usage */
+                       MacOSError::throwMe(errSecCSInvalidFlags);
+               }
+       }
+

        if (Universal *fat = state.mNoMachO ? NULL : rep->mainExecutableImage()) {
                signMachO(fat, context);
        } else {
        if (Universal *fat = state.mNoMachO ? NULL : rep->mainExecutableImage()) {
                signMachO(fat, context);
        } else {


@@ -113,6 +138,13 @@ void SecCodeSigner::Signer::prepare(SecCSFlags flags)
        } else
                secdebug("signer", "using explicit identifier=%s", identifier.c_str());
 
        } else
                secdebug("signer", "using explicit identifier=%s", identifier.c_str());
 

+       teamID = state.mTeamID;
+       if (teamID.empty() && (inherit & kSecCodeSignerPreserveTeamIdentifier)) {
+               const char *c_id = code->teamID();
+               if (c_id)
+                       teamID = c_id;
+       }
+    

        entitlements = state.mEntitlementData;
        if (!entitlements && (inherit & kSecCodeSignerPreserveEntitlements))
                entitlements = code->component(cdEntitlementSlot);
        entitlements = state.mEntitlementData;
        if (!entitlements && (inherit & kSecCodeSignerPreserveEntitlements))
                entitlements = code->component(cdEntitlementSlot);


@@ -374,7 +406,7 @@ void SecCodeSigner::Signer::signMachO(Universal *fat, const Requirement::Context
                }
                
                // prepare SuperBlob size estimate
                }
                
                // prepare SuperBlob size estimate

-               size_t cdSize = arch.cdbuilder.size();
+               size_t cdSize = arch.cdbuilder.size(CodeDirectory::currentVersion);

                arch.blobSize = arch.size(cdSize, state.mCMSSize, 0);
        }
        
                arch.blobSize = arch.size(cdSize, state.mCMSSize, 0);
        }
        


@@ -460,7 +492,8 @@ void SecCodeSigner::Signer::populate(CodeDirectory::Builder &builder, DiskRep::W
        builder.executable(rep->mainExecutablePath(), pagesize, offset, length);
        builder.flags(cdFlags);
        builder.identifier(identifier);
        builder.executable(rep->mainExecutablePath(), pagesize, offset, length);
        builder.flags(cdFlags);
        builder.identifier(identifier);

-       
+       builder.teamID(teamID);
+

        if (CFRef<CFDataRef> data = rep->component(cdInfoSlot))
                builder.specialSlot(cdInfoSlot, data);
        if (ireqs) {
        if (CFRef<CFDataRef> data = rep->component(cdInfoSlot))
                builder.specialSlot(cdInfoSlot, data);
        if (ireqs) {

diff --git a/libsecurity_codesigning/lib/signer.h b/libsecurity_codesigning/lib/signer.h
index dbbd1b442e81f7d1e6f1da557dfd8725132d3f7e..495cc00c93ca66ee9687f4a85f4233c76379dab0 100644 (file)
--- a/libsecurity_codesigning/lib/signer.h
+++ b/libsecurity_codesigning/lib/signer.h
@@ -83,6 +83,7 @@ private:
        CFRef<CFDictionaryRef> resourceDirectory;       // resource directory
        CFRef<CFDataRef> resourceDictData; // XML form of resourceDirectory
        std::string identifier;                 // signing identifier
        CFRef<CFDictionaryRef> resourceDirectory;       // resource directory
        CFRef<CFDataRef> resourceDictData; // XML form of resourceDirectory
        std::string identifier;                 // signing identifier

+       std::string teamID;             // team identifier

        CFRef<CFDataRef> entitlements;  // entitlements
        uint32_t cdFlags;                               // CodeDirectory flags
        const Requirements *requirements; // internal requirements ready-to-use
        CFRef<CFDataRef> entitlements;  // entitlements
        uint32_t cdFlags;                               // CodeDirectory flags
        const Requirements *requirements; // internal requirements ready-to-use

diff --git a/libsecurity_keychain/lib/Certificate.cpp b/libsecurity_keychain/lib/Certificate.cpp
index 95fdeb1057eba1e529b32eb1f517de2a0d6465fa..0dbc174b007d4d9065608baaabf9f7c7e94fa3bd 100644 (file)
--- a/libsecurity_keychain/lib/Certificate.cpp
+++ b/libsecurity_keychain/lib/Certificate.cpp
@@ -894,6 +894,8 @@ Certificate::copyDNSNames()
                /* Encoding is kCFStringEncodingUTF8 since the string is either
                   PRINTABLE_STRING, IA5_STRING, T61_STRING or PKIX_UTF8_STRING. */
                CFStringRef string = CFStringCreateWithBytes(NULL, it->Data, static_cast<CFIndex>(it->Length), kCFStringEncodingUTF8, true);
                /* Encoding is kCFStringEncodingUTF8 since the string is either
                   PRINTABLE_STRING, IA5_STRING, T61_STRING or PKIX_UTF8_STRING. */
                CFStringRef string = CFStringCreateWithBytes(NULL, it->Data, static_cast<CFIndex>(it->Length), kCFStringEncodingUTF8, true);

+               /* Be prepared for improperly formatted (non-UTF8) strings! */
+               if (!string) continue;

                CFArrayAppendValue(array, string);
                CFRelease(string);
        }
                CFArrayAppendValue(array, string);
                CFRelease(string);
        }


@@ -932,6 +934,8 @@ Certificate::copyEmailAddresses()
                /* Encoding is kCFStringEncodingUTF8 since the string is either
                   PRINTABLE_STRING, IA5_STRING, T61_STRING or PKIX_UTF8_STRING. */
                CFStringRef string = CFStringCreateWithBytes(NULL, it->Data, static_cast<CFIndex>(it->Length), kCFStringEncodingUTF8, true);
                /* Encoding is kCFStringEncodingUTF8 since the string is either
                   PRINTABLE_STRING, IA5_STRING, T61_STRING or PKIX_UTF8_STRING. */
                CFStringRef string = CFStringCreateWithBytes(NULL, it->Data, static_cast<CFIndex>(it->Length), kCFStringEncodingUTF8, true);

+               /* Be prepared for improperly formatted (non-UTF8) strings! */
+               if (!string) continue;

                CFArrayAppendValue(array, string);
                CFRelease(string);
        }
                CFArrayAppendValue(array, string);
                CFRelease(string);
        }

diff --git a/libsecurity_ssl/lib/SecureTransport.h b/libsecurity_ssl/lib/SecureTransport.h
index 856d7f1409271f547115e92911e8edfa6541b5ac..e0a5cf484a8049738110d341cfac57b1b621fefb 100644 (file)
--- a/libsecurity_ssl/lib/SecureTransport.h
+++ b/libsecurity_ssl/lib/SecureTransport.h
@@ -130,6 +130,11 @@ typedef enum {
      * using a block cipher.
      */
     kSSLSessionOptionSendOneByteRecord,
      * using a block cipher.
      */
     kSSLSessionOptionSendOneByteRecord,

+    /*
+     * Allow/Disallow server identity change on renegotiation. Disallow by default
+     * to avoid Triple Handshake attack.
+     */
+    kSSLSessionOptionAllowServerIdentityChange,

 
 } SSLSessionOption;
 
 
 } SSLSessionOption;
 

diff --git a/libsecurity_ssl/lib/sslCert.c b/libsecurity_ssl/lib/sslCert.c
index 081e8726a5df8ccd3b7056a46d30ead0544b05eb..4aee2efbfa0cc6657347c835133975e4902e3ad4 100644 (file)
--- a/libsecurity_ssl/lib/sslCert.c
+++ b/libsecurity_ssl/lib/sslCert.c
@@ -143,12 +143,8 @@ SSLProcessCertificate(SSLBuffer message, SSLContext *ctx)
     size_t          listLen, certLen;
     UInt8           *p;
     OSStatus        err;
     size_t          listLen, certLen;
     UInt8           *p;
     OSStatus        err;

-#ifdef USE_SSLCERTIFICATE
-    SSLCertificate      *cert;
-#else

     CFMutableArrayRef   certChain = NULL;
     SecCertificateRef   cert;
     CFMutableArrayRef   certChain = NULL;
     SecCertificateRef   cert;

-#endif

 
     p = message.data;
     listLen = SSLDecodeInt(p,3);
 
     p = message.data;
     listLen = SSLDecodeInt(p,3);


@@ -159,38 +155,23 @@ SSLProcessCertificate(SSLBuffer message, SSLContext *ctx)
     }
 
     while (listLen > 0)
     }
 
     while (listLen > 0)

-    {   certLen = SSLDecodeInt(p,3);
+    {
+        if (listLen < 3) {
+            sslErrorLog("SSLProcessCertificate: length decode error 2\n");
+            return errSSLProtocol;
+        }
+        certLen = SSLDecodeInt(p,3);

         p += 3;
         if (listLen < certLen + 3) {
         p += 3;
         if (listLen < certLen + 3) {

-               sslErrorLog("SSLProcessCertificate: length decode error 2\n");
+               sslErrorLog("SSLProcessCertificate: length decode error 3\n");

             return errSSLProtocol;
         }
             return errSSLProtocol;
         }

-#ifdef USE_SSLCERTIFICATE
-               cert = (SSLCertificate *)sslMalloc(sizeof(SSLCertificate));
-               if(cert == NULL) {
-                       return errSecAllocate;
-               }
-        if ((err = SSLAllocBuffer(&cert->derCert, certLen)
-        {   sslFree(cert);
-            return err;
-        }
-        memcpy(cert->derCert.data, p, certLen);
-        p += certLen;
-        cert->next = ctx->peerCert;     /* Insert backwards; root cert
-                                                                                * will be first in linked list */
-        ctx->peerCert = cert;
-#else

                if (!certChain) {
                        certChain = CFArrayCreateMutable(kCFAllocatorDefault, 0,
                                &kCFTypeArrayCallBacks);
                        if (certChain == NULL) {
                                return errSecAllocate;
                        }
                if (!certChain) {
                        certChain = CFArrayCreateMutable(kCFAllocatorDefault, 0,
                                &kCFTypeArrayCallBacks);
                        if (certChain == NULL) {
                                return errSecAllocate;
                        }

-                       if (ctx->peerCert) {
-                               sslDebugLog("SSLProcessCertificate: releasing existing cert chain\n");
-                               CFRelease(ctx->peerCert);
-                       }
-                       ctx->peerCert = certChain;

                }
                cert = SecCertificateCreateWithBytes(NULL, p, certLen);
                #if SSL_DEBUG && !TARGET_OS_IPHONE
                }
                cert = SecCertificateCreateWithBytes(NULL, p, certLen);
                #if SSL_DEBUG && !TARGET_OS_IPHONE


@@ -212,11 +193,28 @@ SSLProcessCertificate(SSLBuffer message, SSLContext *ctx)
                /* Insert forwards; root cert will be last in linked list */
                CFArrayAppendValue(certChain, cert);
                CFRelease(cert);
                /* Insert forwards; root cert will be last in linked list */
                CFArrayAppendValue(certChain, cert);
                CFRelease(cert);

-#endif

         listLen -= 3+certLen;
     }
     assert(p == message.data + message.length && listLen == 0);
 
         listLen -= 3+certLen;
     }
     assert(p == message.data + message.length && listLen == 0);
 

+    if (ctx->protocolSide == kSSLClientSide && ctx->peerCert && !ctx->allowServerIdentityChange) {
+        // Do not accept a different server cert during renegotiation unless allowed.
+        if((certChain!=NULL) && !CFEqual(ctx->peerCert, certChain))
+        {
+            CFRelease(certChain);
+            sslErrorLog("Illegal server identity change during renegotiation\n");
+            return errSSLProtocol;
+        }
+    }
+
+    // Replace old cert with new cert.
+    if (ctx->peerCert) {
+        sslDebugLog("SSLProcessCertificate: releasing existing cert chain\n");
+        CFRelease(ctx->peerCert);
+    }
+
+    ctx->peerCert = certChain;
+

     if (!ctx->peerCert) {
                /* this *might* be OK... */
                if((ctx->protocolSide == kSSLServerSide) &&
     if (!ctx->peerCert) {
                /* this *might* be OK... */
                if((ctx->protocolSide == kSSLServerSide) &&


@@ -241,6 +239,8 @@ SSLProcessCertificate(SSLBuffer message, SSLContext *ctx)
                }
     }
 
                }
     }
 

+
+

     if((err = sslVerifyCertChain(ctx, ctx->peerCert, true)) != 0) {
         AlertDescription desc;
         switch(err) {
     if((err = sslVerifyCertChain(ctx, ctx->peerCert, true)) != 0) {
         AlertDescription desc;
         switch(err) {

diff --git a/libsecurity_ssl/lib/sslContext.c b/libsecurity_ssl/lib/sslContext.c
index c041afaac6a1ecb9fc324c576a420d0108ebd8d7..cc74aa16ab8aa359ed51f789f9ee8671be0323ff 100644 (file)
--- a/libsecurity_ssl/lib/sslContext.c
+++ b/libsecurity_ssl/lib/sslContext.c
@@ -115,6 +115,7 @@ Boolean sslIsSessionActive(const SSLContext *ctx)
 
 static CFTypeID kSSLContextTypeID;
 int kSplitDefaultValue;
 
 static CFTypeID kSSLContextTypeID;
 int kSplitDefaultValue;

+bool kAllowServerIdentityChangeDefaultValue;

 
 static void _sslContextDestroy(CFTypeRef arg);
 static Boolean _sslContextEqual(CFTypeRef a, CFTypeRef b);
 
 static void _sslContextDestroy(CFTypeRef arg);
 static Boolean _sslContextEqual(CFTypeRef a, CFTypeRef b);


@@ -126,11 +127,12 @@ static void _SSLContextReadDefault()
        /* 0 = disabled, 1 = split every write, 2 = split second and subsequent writes */
     /* Enabled by default, this make cause some interop issues, see <rdar://problem/12307662> and <rdar://problem/12323307> */
     const int defaultSplitDefaultValue = 2;
        /* 0 = disabled, 1 = split every write, 2 = split second and subsequent writes */
     /* Enabled by default, this make cause some interop issues, see <rdar://problem/12307662> and <rdar://problem/12323307> */
     const int defaultSplitDefaultValue = 2;

-
+    //To change:
+    //sudo defaults write /Library/Preferences/com.apple.security SSLWriteSplit -int 0

        CFTypeRef value = (CFTypeRef)CFPreferencesCopyValue(CFSTR("SSLWriteSplit"),
                                                        CFSTR("com.apple.security"),
                                                        kCFPreferencesAnyUser,
        CFTypeRef value = (CFTypeRef)CFPreferencesCopyValue(CFSTR("SSLWriteSplit"),
                                                        CFSTR("com.apple.security"),
                                                        kCFPreferencesAnyUser,

-                                                       kCFPreferencesAnyHost);
+                                                       kCFPreferencesCurrentHost);

        if (value) {
                if (CFGetTypeID(value) == CFBooleanGetTypeID())
                        kSplitDefaultValue = CFBooleanGetValue((CFBooleanRef)value) ? 1 : 0;
        if (value) {
                if (CFGetTypeID(value) == CFBooleanGetTypeID())
                        kSplitDefaultValue = CFBooleanGetValue((CFBooleanRef)value) ? 1 : 0;


@@ -146,6 +148,33 @@ static void _SSLContextReadDefault()
        else {
                kSplitDefaultValue = defaultSplitDefaultValue;
        }
        else {
                kSplitDefaultValue = defaultSplitDefaultValue;
        }

+
+
+    /* 0 = disallowed, 1 = allowed */
+    /* Disallowed by default */
+    const bool defaultValue = false;
+    //To change:
+    //sudo defaults write /Library/Preferences/com.apple.security SSLAllowServerIdentityChange -bool YES
+       value = (CFTypeRef)CFPreferencesCopyValue(CFSTR("SSLAllowServerIdentityChange"),
+                                              CFSTR("com.apple.security"),
+                                              kCFPreferencesAnyUser,
+                                              kCFPreferencesCurrentHost);
+       if (value) {
+               if (CFGetTypeID(value) == CFBooleanGetTypeID())
+                       kAllowServerIdentityChangeDefaultValue = CFBooleanGetValue((CFBooleanRef)value);
+               else if (CFGetTypeID(value) == CFNumberGetTypeID()) {
+            int localValue;
+                       if (!CFNumberGetValue((CFNumberRef)value, kCFNumberIntType, &localValue)) {
+                               kAllowServerIdentityChangeDefaultValue = defaultValue;
+            } else {
+                kAllowServerIdentityChangeDefaultValue = localValue;
+            }
+               }
+               CFRelease(value);
+       }
+       else {
+               kAllowServerIdentityChangeDefaultValue = defaultValue;
+       }

 }
 
 static void _SSLContextRegisterClass()
 }
 
 static void _SSLContextRegisterClass()


@@ -274,6 +303,9 @@ SSLContextRef SSLCreateContextWithRecordFuncs(CFAllocatorRef alloc, SSLProtocolS
        /* Default for sending one-byte app data record is DISABLED */
        ctx->oneByteRecordEnable = false;
 
        /* Default for sending one-byte app data record is DISABLED */
        ctx->oneByteRecordEnable = false;
 

+    /* Default for allowing server identity change on renegotiation is FALSE */
+    ctx->allowServerIdentityChange = false;
+

        /* Consult global system preference for default behavior:
         * 0 = disabled, 1 = split every write, 2 = split second and subsequent writes
         * (caller can override by setting kSSLSessionOptionSendOneByteRecord)
        /* Consult global system preference for default behavior:
         * 0 = disabled, 1 = split every write, 2 = split second and subsequent writes
         * (caller can override by setting kSSLSessionOptionSendOneByteRecord)


@@ -282,6 +314,8 @@ SSLContextRef SSLCreateContextWithRecordFuncs(CFAllocatorRef alloc, SSLProtocolS
        pthread_once(&sReadDefault, _SSLContextReadDefault);
        if (kSplitDefaultValue > 0)
                ctx->oneByteRecordEnable = true;
        pthread_once(&sReadDefault, _SSLContextReadDefault);
        if (kSplitDefaultValue > 0)
                ctx->oneByteRecordEnable = true;

+    if (kAllowServerIdentityChangeDefaultValue>0)
+        ctx->allowServerIdentityChange = true;

 
        /* default for anonymous ciphers is DISABLED */
        ctx->anonCipherEnable = false;
 
        /* default for anonymous ciphers is DISABLED */
        ctx->anonCipherEnable = false;


@@ -574,6 +608,9 @@ SSLSetSessionOption                 (SSLContextRef          context,
         case kSSLSessionOptionFalseStart:
             context->falseStartEnabled = value;
             break;
         case kSSLSessionOptionFalseStart:
             context->falseStartEnabled = value;
             break;

+        case kSSLSessionOptionAllowServerIdentityChange:
+            context->allowServerIdentityChange = value;
+            break;

         default: 
             return errSecParam;
     }
         default: 
             return errSecParam;
     }

diff --git a/libsecurity_ssl/lib/sslContext.h b/libsecurity_ssl/lib/sslContext.h
index eee676cc7829e4829233b01a84344cf3b3a61a27..a3e13cd9089c6b266dc197eadfbffb7458a1359d 100644 (file)
--- a/libsecurity_ssl/lib/sslContext.h
+++ b/libsecurity_ssl/lib/sslContext.h
@@ -351,6 +351,8 @@ struct SSLContext
        Boolean                         rsaBlindingEnable;
        Boolean                         oneByteRecordEnable;    /* enable 1/n-1 data splitting for TLSv1 and SSLv3 */
        Boolean                         wroteAppData;           /* at least one write completed with current writeCipher */
        Boolean                         rsaBlindingEnable;
        Boolean                         oneByteRecordEnable;    /* enable 1/n-1 data splitting for TLSv1 and SSLv3 */
        Boolean                         wroteAppData;           /* at least one write completed with current writeCipher */

+    Boolean             allowServerIdentityChange; /* allow server identity change on renegotiation
+                                                    disallowed by default to avoid triple handshake attack */

 
        /* optional session cache timeout (in seconds) override - 0 means default */
        uint32_t                                sessionCacheTimeout;
 
        /* optional session cache timeout (in seconds) override - 0 means default */
        uint32_t                                sessionCacheTimeout;

diff --git a/libsecurity_ssl/regressions/ssl-43-ciphers.c b/libsecurity_ssl/regressions/ssl-43-ciphers.c
index 933a77d9c85fec75194d28617d64781e0e529e8c..92afa7e4f82dae183919a1cf6b4a19f1d6538098 100644 (file)
--- a/libsecurity_ssl/regressions/ssl-43-ciphers.c
+++ b/libsecurity_ssl/regressions/ssl-43-ciphers.c
@@ -85,7 +85,7 @@ static struct {
     { OPENSSL_SERVER, 4000, 0, false}, //openssl s_server w/o client side auth
     { GNUTLS_SERVER, 5000, 1, false}, // gnutls-serv w/o client side auth
     { "www.mikestoolbox.org", 442, 2, false}, // mike's  w/o client side auth
     { OPENSSL_SERVER, 4000, 0, false}, //openssl s_server w/o client side auth
     { GNUTLS_SERVER, 5000, 1, false}, // gnutls-serv w/o client side auth
     { "www.mikestoolbox.org", 442, 2, false}, // mike's  w/o client side auth

-//    { "tls.secg.org", 40022, 3, false}, // secg ecc server w/o client side auth 
+//    { "tls.secg.org", 40022, 3, false}, // secg ecc server w/o client side auth - This server generate DH params we dont support. 

 
     { OPENSSL_SERVER, 4010, 0, true}, //openssl s_server w/ client side auth
     { GNUTLS_SERVER, 5010, 1, true}, // gnutls-serv w/ client side auth
 
     { OPENSSL_SERVER, 4010, 0, true}, //openssl s_server w/ client side auth
     { GNUTLS_SERVER, 5010, 1, true}, // gnutls-serv w/ client side auth

diff --git a/sec/SOSCircle/CloudKeychainProxy/scripts/sosbuildroot b/sec/SOSCircle/CloudKeychainProxy/scripts/sosbuildroot
index 70d43f1c9c5b2ae05aa067de415775d7aa2a49c7..efa31374d8583be85c72f9c1a9431007a66327de 100755 (executable)
--- a/sec/SOSCircle/CloudKeychainProxy/scripts/sosbuildroot
+++ b/sec/SOSCircle/CloudKeychainProxy/scripts/sosbuildroot
@@ -11,7 +11,7 @@ config=${2-Release}
 roots=/var/tmp
 project=Security
 
 roots=/var/tmp
 project=Security
 

-~rc/bin/buildit .  --rootsDirectory=/var/tmp -noverify -release iOS -project $project -archive -dsymsInDstroot \
+~rc/bin/buildit .  --rootsDirectory=/var/tmp -noverify -project $project -archive -dsymsInDstroot \

        -target $target \
        -configuration $config || { echo 'build failed' ; exit 1; }
 
        -target $target \
        -configuration $config || { echo 'build failed' ; exit 1; }
 

diff --git a/sec/SOSCircle/SecureObjectSync/SOSCoder.c b/sec/SOSCircle/SecureObjectSync/SOSCoder.c
index 7a9eb8ff0754caa5b5f517816c842031c10e9e93..581d1f2f765d94f3fcc31b498215bf8bfcfc1415 100644 (file)
--- a/sec/SOSCircle/SecureObjectSync/SOSCoder.c
+++ b/sec/SOSCircle/SecureObjectSync/SOSCoder.c
@@ -164,7 +164,7 @@ SOSCoderRef SOSCoderCreateFromData(CFDataRef exportedData, CFErrorRef *error) {
     require(ccder_decode_tag(&tag, der, der_end),fail);
 
     switch (tag) {
     require(ccder_decode_tag(&tag, der, der_end),fail);
 
     switch (tag) {

-        case CCDER_OCTET_STRING:
+        case CCDER_OCTET_STRING: 

         {
             der = der_decode_data(kCFAllocatorDefault, 0, &otr_data, error, der, der_end);
             p->waitingForDataPacket = false;
         {
             der = der_decode_data(kCFAllocatorDefault, 0, &otr_data, error, der, der_end);
             p->waitingForDataPacket = false;

diff --git a/sec/Security/Regressions/secitem/si-33-keychain-backup.c b/sec/Security/Regressions/secitem/si-33-keychain-backup.c
index dddb3d10652d1c7270308f38d8dfc616287c16f7..0456964acd5013541413f4b3746cff472f047756 100644 (file)
--- a/sec/Security/Regressions/secitem/si-33-keychain-backup.c
+++ b/sec/Security/Regressions/secitem/si-33-keychain-backup.c
@@ -409,6 +409,7 @@ static void tests(void)
               "Found the item we added after restore");
     CFReleaseNull(backup);
 
               "Found the item we added after restore");
     CFReleaseNull(backup);
 

+    // force tombstone to be added, since it's not the default behavior in Innsbruck per rdar://14680869

     CFDictionaryAddValue(query, kSecUseTombstones, kCFBooleanTrue);
 
     ok_status(SecItemDelete(query), "Deleted item we added");
     CFDictionaryAddValue(query, kSecUseTombstones, kCFBooleanTrue);
 
     ok_status(SecItemDelete(query), "Deleted item we added");

diff --git a/sec/sec.xcodeproj/project.xcworkspace/contents.xcworkspacedata b/sec/sec.xcodeproj/project.xcworkspace/contents.xcworkspacedata
new file mode 100644 (file)
index 0000000..2310a48
--- /dev/null
+++ b/sec/sec.xcodeproj/project.xcworkspace/contents.xcworkspacedata
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Workspace
+   version = "1.0">
+   <FileRef
+      location = "self:sec.xcodeproj">
+   </FileRef>
+</Workspace>

diff --git a/sec/sec.xcodeproj/project.xcworkspace/xcshareddata/sec.xccheckout b/sec/sec.xcodeproj/project.xcworkspace/xcshareddata/sec.xccheckout
new file mode 100644 (file)
index 0000000..3e2b35f
--- /dev/null
+++ b/sec/sec.xcodeproj/project.xcworkspace/xcshareddata/sec.xccheckout
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+       <key>IDESourceControlProjectFavoriteDictionaryKey</key>
+       <false/>
+       <key>IDESourceControlProjectIdentifier</key>
+       <string>55BE31B1-4B75-46C3-99C0-AC509F5CE8EA</string>
+       <key>IDESourceControlProjectName</key>
+       <string>sec</string>
+       <key>IDESourceControlProjectOriginsDictionary</key>
+       <dict>
+               <key>B1756FC7-4092-4712-B882-FDA75264D61A</key>
+               <string>git.apple.com:/git/projects/secmodules/sec</string>
+       </dict>
+       <key>IDESourceControlProjectPath</key>
+       <string>sec.xcodeproj/project.xcworkspace</string>
+       <key>IDESourceControlProjectRelativeInstallPathDictionary</key>
+       <dict>
+               <key>B1756FC7-4092-4712-B882-FDA75264D61A</key>
+               <string>../..</string>
+       </dict>
+       <key>IDESourceControlProjectURL</key>
+       <string>git.apple.com:/git/projects/secmodules/sec</string>
+       <key>IDESourceControlProjectVersion</key>
+       <integer>110</integer>
+       <key>IDESourceControlProjectWCCIdentifier</key>
+       <string>B1756FC7-4092-4712-B882-FDA75264D61A</string>
+       <key>IDESourceControlProjectWCConfigurations</key>
+       <array>
+               <dict>
+                       <key>IDESourceControlRepositoryExtensionIdentifierKey</key>
+                       <string>public.vcs.git</string>
+                       <key>IDESourceControlWCCIdentifierKey</key>
+                       <string>B1756FC7-4092-4712-B882-FDA75264D61A</string>
+                       <key>IDESourceControlWCCName</key>
+                       <string>sec</string>
+               </dict>
+       </array>
+</dict>
+</plist>

diff --git a/sec/sec.xcodeproj/project.xcworkspace/xcuserdata/jkauth.xcuserdatad/UserInterfaceState.xcuserstate b/sec/sec.xcodeproj/project.xcworkspace/xcuserdata/jkauth.xcuserdatad/UserInterfaceState.xcuserstate
new file mode 100644 (file)
index 0000000..9860dcc
Binary files /dev/null and b/sec/sec.xcodeproj/project.xcworkspace/xcuserdata/jkauth.xcuserdatad/UserInterfaceState.xcuserstate differ

diff --git a/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libCPSRegresssions.xcscheme b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libCPSRegresssions.xcscheme
new file mode 100644 (file)
index 0000000..6926d6a
--- /dev/null
+++ b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libCPSRegresssions.xcscheme
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0600"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "E7CBDB711890BD810010B75B"
+               BuildableName = "libCPSRegresssions.a"
+               BlueprintName = "libCPSRegresssions"
+               ReferencedContainer = "container:sec.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      buildConfiguration = "Debug">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Debug"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      allowLocationSimulation = "YES">
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Release"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

diff --git a/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libCloudKeychainProxy.xcscheme b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libCloudKeychainProxy.xcscheme
new file mode 100644 (file)
index 0000000..bac2687
--- /dev/null
+++ b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libCloudKeychainProxy.xcscheme
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0600"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "5284029F164445760035F320"
+               BuildableName = "libCloudKeychainProxy.a"
+               BlueprintName = "libCloudKeychainProxy"
+               ReferencedContainer = "container:sec.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      buildConfiguration = "Debug">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Debug"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      allowLocationSimulation = "YES">
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Release"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

diff --git a/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libCloudProtection.xcscheme b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libCloudProtection.xcscheme
new file mode 100644 (file)
index 0000000..5880dcd
--- /dev/null
+++ b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libCloudProtection.xcscheme
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0600"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "E7CBDB911890BF350010B75B"
+               BuildableName = "libCloudProtection.a"
+               BlueprintName = "libCloudProtection"
+               ReferencedContainer = "container:sec.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      buildConfiguration = "Debug">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Debug"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      allowLocationSimulation = "YES">
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Release"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

diff --git a/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSOSCommands.xcscheme b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSOSCommands.xcscheme
new file mode 100644 (file)
index 0000000..2144bfe
--- /dev/null
+++ b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSOSCommands.xcscheme
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0600"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "E7FEFB82169E363300E18152"
+               BuildableName = "libSOSCommands.a"
+               BlueprintName = "libSOSCommands"
+               ReferencedContainer = "container:sec.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      buildConfiguration = "Debug">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Debug"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      allowLocationSimulation = "YES">
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Release"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

diff --git a/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSOSRegressions.xcscheme b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSOSRegressions.xcscheme
new file mode 100644 (file)
index 0000000..9e81d34
--- /dev/null
+++ b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSOSRegressions.xcscheme
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0600"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "E702E75714E1F48800CDE635"
+               BuildableName = "libSOSRegressions.a"
+               BlueprintName = "libSOSRegressions"
+               ReferencedContainer = "container:sec.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      buildConfiguration = "Debug">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Debug"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      allowLocationSimulation = "YES">
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Release"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

diff --git a/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSecItemShimOSX.xcscheme b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSecItemShimOSX.xcscheme
new file mode 100644 (file)
index 0000000..f75e31b
--- /dev/null
+++ b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSecItemShimOSX.xcscheme
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0600"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "186CDD0E14CA116C00AF9171"
+               BuildableName = "libSecItemShimOSX.a"
+               BlueprintName = "libSecItemShimOSX"
+               ReferencedContainer = "container:sec.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      buildConfiguration = "Debug">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Debug"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      allowLocationSimulation = "YES">
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Release"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

diff --git a/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSecOtrOSX.xcscheme b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSecOtrOSX.xcscheme
new file mode 100644 (file)
index 0000000..95daee4
--- /dev/null
+++ b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSecOtrOSX.xcscheme
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0600"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "4A5CCA4E15ACEFA500702357"
+               BuildableName = "libSecOtrOSX.a"
+               BlueprintName = "libSecOtrOSX"
+               ReferencedContainer = "container:sec.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      buildConfiguration = "Debug">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Debug"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      allowLocationSimulation = "YES">
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Release"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

diff --git a/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSecureObjectSync.xcscheme b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSecureObjectSync.xcscheme
new file mode 100644 (file)
index 0000000..91e9ff4
--- /dev/null
+++ b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSecureObjectSync.xcscheme
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0600"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "E702E73514E1F3EA00CDE635"
+               BuildableName = "libSecureObjectSync.a"
+               BlueprintName = "libSecureObjectSync"
+               ReferencedContainer = "container:sec.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      buildConfiguration = "Debug">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Debug"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      allowLocationSimulation = "YES">
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Release"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

diff --git a/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSecurityCommands.xcscheme b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSecurityCommands.xcscheme
new file mode 100644 (file)
index 0000000..93eabc6
--- /dev/null
+++ b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSecurityCommands.xcscheme
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0600"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "E7104A12169E216E00DB0045"
+               BuildableName = "libSecurityCommands.a"
+               BlueprintName = "libSecurityCommands"
+               ReferencedContainer = "container:sec.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      buildConfiguration = "Debug">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Debug"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      allowLocationSimulation = "YES">
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Release"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

diff --git a/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSecurityRegressions.xcscheme b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSecurityRegressions.xcscheme
new file mode 100644 (file)
index 0000000..e5b07f2
--- /dev/null
+++ b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSecurityRegressions.xcscheme
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0600"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "4A824AFB158FF07000F932C0"
+               BuildableName = "libSecurityRegressions.a"
+               BlueprintName = "libSecurityRegressions"
+               ReferencedContainer = "container:sec.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      buildConfiguration = "Debug">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Debug"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      allowLocationSimulation = "YES">
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Release"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

diff --git a/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSecurityTool.xcscheme b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSecurityTool.xcscheme
new file mode 100644 (file)
index 0000000..32f5412
--- /dev/null
+++ b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libSecurityTool.xcscheme
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0600"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "E71049F1169E023B00DB0045"
+               BuildableName = "libSecurityTool.a"
+               BlueprintName = "libSecurityTool"
+               ReferencedContainer = "container:sec.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      buildConfiguration = "Debug">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Debug"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      allowLocationSimulation = "YES">
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Release"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

diff --git a/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libsecdRegressions.xcscheme b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libsecdRegressions.xcscheme
new file mode 100644 (file)
index 0000000..27a28f0
--- /dev/null
+++ b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libsecdRegressions.xcscheme
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0600"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "0C0BDB55175687EC00BC1A7E"
+               BuildableName = "libsecdRegressions.a"
+               BlueprintName = "libsecdRegressions"
+               ReferencedContainer = "container:sec.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      buildConfiguration = "Debug">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Debug"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      allowLocationSimulation = "YES">
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Release"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

diff --git a/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libsecipc_client.xcscheme b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libsecipc_client.xcscheme
new file mode 100644 (file)
index 0000000..c2be7ed
--- /dev/null
+++ b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libsecipc_client.xcscheme
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0600"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "18270F5414CF651900B05E7F"
+               BuildableName = "libsecipc_client.a"
+               BlueprintName = "libsecipc_client"
+               ReferencedContainer = "container:sec.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      buildConfiguration = "Debug">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Debug"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      allowLocationSimulation = "YES">
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Release"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

diff --git a/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libsecurity.xcscheme b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libsecurity.xcscheme
new file mode 100644 (file)
index 0000000..a165245
--- /dev/null
+++ b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libsecurity.xcscheme
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0600"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "18D4043414CE0CF300A2BE4E"
+               BuildableName = "libsecurity.a"
+               BlueprintName = "libsecurity"
+               ReferencedContainer = "container:sec.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      buildConfiguration = "Debug">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Debug"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      allowLocationSimulation = "YES">
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Release"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

diff --git a/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libsecurityd.xcscheme b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libsecurityd.xcscheme
new file mode 100644 (file)
index 0000000..434f12e
--- /dev/null
+++ b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libsecurityd.xcscheme
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0600"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "18D4056114CE53C200A2BE4E"
+               BuildableName = "libsecurityd.a"
+               BlueprintName = "libsecurityd"
+               ReferencedContainer = "container:sec.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      buildConfiguration = "Debug">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Debug"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      allowLocationSimulation = "YES">
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Release"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

diff --git a/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libsecuritydRegressions.xcscheme b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libsecuritydRegressions.xcscheme
new file mode 100644 (file)
index 0000000..904ed59
--- /dev/null
+++ b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/libsecuritydRegressions.xcscheme
@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0600"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "4CC92AC215A3BC6B00C6D578"
+               BuildableName = "libsecuritydRegressions.a"
+               BlueprintName = "libsecuritydRegressions"
+               ReferencedContainer = "container:sec.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      buildConfiguration = "Debug">
+      <Testables>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Debug"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      allowLocationSimulation = "YES">
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      buildConfiguration = "Release"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

diff --git a/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/xcschememanagement.plist b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/xcschememanagement.plist
new file mode 100644 (file)
index 0000000..f24515b
--- /dev/null
+++ b/sec/sec.xcodeproj/xcuserdata/jkauth.xcuserdatad/xcschemes/xcschememanagement.plist
@@ -0,0 +1,172 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+       <key>SchemeUserState</key>
+       <dict>
+               <key>libCPSRegresssions.xcscheme</key>
+               <dict>
+                       <key>orderHint</key>
+                       <integer>15</integer>
+               </dict>
+               <key>libCloudKeychainProxy.xcscheme</key>
+               <dict>
+                       <key>orderHint</key>
+                       <integer>9</integer>
+               </dict>
+               <key>libCloudProtection.xcscheme</key>
+               <dict>
+                       <key>orderHint</key>
+                       <integer>14</integer>
+               </dict>
+               <key>libSOSCommands.xcscheme</key>
+               <dict>
+                       <key>orderHint</key>
+                       <integer>12</integer>
+               </dict>
+               <key>libSOSRegressions.xcscheme</key>
+               <dict>
+                       <key>orderHint</key>
+                       <integer>5</integer>
+               </dict>
+               <key>libSecItemShimOSX.xcscheme</key>
+               <dict>
+                       <key>orderHint</key>
+                       <integer>2</integer>
+               </dict>
+               <key>libSecOtrOSX.xcscheme</key>
+               <dict>
+                       <key>orderHint</key>
+                       <integer>8</integer>
+               </dict>
+               <key>libSecureObjectSync.xcscheme</key>
+               <dict>
+                       <key>orderHint</key>
+                       <integer>4</integer>
+               </dict>
+               <key>libSecurityCommands.xcscheme</key>
+               <dict>
+                       <key>orderHint</key>
+                       <integer>11</integer>
+               </dict>
+               <key>libSecurityRegressions.xcscheme</key>
+               <dict>
+                       <key>orderHint</key>
+                       <integer>6</integer>
+               </dict>
+               <key>libSecurityTool.xcscheme</key>
+               <dict>
+                       <key>orderHint</key>
+                       <integer>10</integer>
+               </dict>
+               <key>libsecdRegressions.xcscheme</key>
+               <dict>
+                       <key>orderHint</key>
+                       <integer>13</integer>
+               </dict>
+               <key>libsecipc_client.xcscheme</key>
+               <dict>
+                       <key>orderHint</key>
+                       <integer>3</integer>
+               </dict>
+               <key>libsecurity.xcscheme</key>
+               <dict>
+                       <key>orderHint</key>
+                       <integer>0</integer>
+               </dict>
+               <key>libsecurityd.xcscheme</key>
+               <dict>
+                       <key>orderHint</key>
+                       <integer>1</integer>
+               </dict>
+               <key>libsecuritydRegressions.xcscheme</key>
+               <dict>
+                       <key>orderHint</key>
+                       <integer>7</integer>
+               </dict>
+       </dict>
+       <key>SuppressBuildableAutocreation</key>
+       <dict>
+               <key>0C0BDB55175687EC00BC1A7E</key>
+               <dict>
+                       <key>primary</key>
+                       <true/>
+               </dict>
+               <key>18270F5414CF651900B05E7F</key>
+               <dict>
+                       <key>primary</key>
+                       <true/>
+               </dict>
+               <key>186CDD0E14CA116C00AF9171</key>
+               <dict>
+                       <key>primary</key>
+                       <true/>
+               </dict>
+               <key>18D4043414CE0CF300A2BE4E</key>
+               <dict>
+                       <key>primary</key>
+                       <true/>
+               </dict>
+               <key>18D4056114CE53C200A2BE4E</key>
+               <dict>
+                       <key>primary</key>
+                       <true/>
+               </dict>
+               <key>4A5CCA4E15ACEFA500702357</key>
+               <dict>
+                       <key>primary</key>
+                       <true/>
+               </dict>
+               <key>4A824AFB158FF07000F932C0</key>
+               <dict>
+                       <key>primary</key>
+                       <true/>
+               </dict>
+               <key>4CC92AC215A3BC6B00C6D578</key>
+               <dict>
+                       <key>primary</key>
+                       <true/>
+               </dict>
+               <key>5284029F164445760035F320</key>
+               <dict>
+                       <key>primary</key>
+                       <true/>
+               </dict>
+               <key>E702E73514E1F3EA00CDE635</key>
+               <dict>
+                       <key>primary</key>
+                       <true/>
+               </dict>
+               <key>E702E75714E1F48800CDE635</key>
+               <dict>
+                       <key>primary</key>
+                       <true/>
+               </dict>
+               <key>E71049F1169E023B00DB0045</key>
+               <dict>
+                       <key>primary</key>
+                       <true/>
+               </dict>
+               <key>E7104A12169E216E00DB0045</key>
+               <dict>
+                       <key>primary</key>
+                       <true/>
+               </dict>
+               <key>E7CBDB711890BD810010B75B</key>
+               <dict>
+                       <key>primary</key>
+                       <true/>
+               </dict>
+               <key>E7CBDB911890BF350010B75B</key>
+               <dict>
+                       <key>primary</key>
+                       <true/>
+               </dict>
+               <key>E7FEFB82169E363300E18152</key>
+               <dict>
+                       <key>primary</key>
+                       <true/>
+               </dict>
+       </dict>
+</dict>
+</plist>

diff --git a/sec/securityd/Regressions/secd-55-account-circle.c b/sec/securityd/Regressions/secd-55-account-circle.c
index af4bec9fec8891160671dc4b4cc7a46d197938bf..fc4f83488857a31ca49282aa948642ce389e2a3d 100644 (file)
--- a/sec/securityd/Regressions/secd-55-account-circle.c
+++ b/sec/securityd/Regressions/secd-55-account-circle.c
@@ -213,6 +213,8 @@ static void tests(void)
 
     // Both in circle.
 
 
     // Both in circle.
 

+    // Emulation of <rdar://problem/13919554> Innsbruck11A368 +Roots: Device A was removed when Device B joined.
+

     // We want Alice to leave circle while an Applicant on a full concordance signed circle with old-Alice as an Alum and Bob a peer.
     // ZZZ
     ok(SOSAccountLeaveCircles(alice_account, &error), "Alice leaves once more  (%@)", error);
     // We want Alice to leave circle while an Applicant on a full concordance signed circle with old-Alice as an Alum and Bob a peer.
     // ZZZ
     ok(SOSAccountLeaveCircles(alice_account, &error), "Alice leaves once more  (%@)", error);

diff --git a/sec/securityd/SecItemServer.c b/sec/securityd/SecItemServer.c
index 729a7431fbb66860b22f7ffa38643cda7b2fccb4..29485ea852175cc9fd09b0dc17a19331adf6ce5a 100644 (file)
--- a/sec/securityd/SecItemServer.c
+++ b/sec/securityd/SecItemServer.c
@@ -611,12 +611,12 @@ struct sql_stages {
    the script in the main table.
     {pre,main,post, reencode} */
 static struct sql_stages s3dl_upgrade_script[] = {
    the script in the main table.
     {pre,main,post, reencode} */
 static struct sql_stages s3dl_upgrade_script[] = {

-    { -1, 0, 1, false },/* 0->current: Create version 6 database. */
-    {},                 /* 1->current: Upgrade to version 6 from version 1 -- Unsupported. */
-    {},                 /* 2->current: Upgrade to version 6 from version 2 -- Unsupported */
-    {},                 /* 3->current: Upgrade to version 6 from version 3 -- Unsupported */
-    {},                 /* 4->current: Upgrade to version 6 from version 4 -- Unsupported */
-    { 3, 0, 7, true },  /* 5->current: Upgrade to version 6 from version 5 */
+    { -1, 0, 1, false },/* 0->current: Create version 6 (Innsbruck) database. */
+    {},                 /* 1->current: Upgrade to version 6 from version 1 (LittleBear) -- Unsupported. */
+    {},                 /* 2->current: Upgrade to version 6 from version 2 (BigBearBeta) -- Unsupported */
+    {},                 /* 3->current: Upgrade to version 6 from version 3 (Apex) -- Unsupported */
+    {},                 /* 4->current: Upgrade to version 6 from version 4 (Telluride) -- Unsupported */
+    { 3, 0, 7, true },  /* 5->current: Upgrade to version 6 from version 5 (TellurideGM). */

 };
 
 static bool sql_run_script(SecDbConnectionRef dbt, int number, CFErrorRef *error)
 };
 
 static bool sql_run_script(SecDbConnectionRef dbt, int number, CFErrorRef *error)