The behavior of usage made absolutely no sense :/.

[ldid.git] / ldid.cpp

diff --git a/ldid.cpp b/ldid.cpp
index 32fd2d933509ced2d3b9152fc645c403a728e3f6..79104addb39ae14de59f50cbd60acde98bf7e607 100644 (file)
--- a/ldid.cpp
+++ b/ldid.cpp
@@ -85,6 +85,8 @@
 
 #ifndef LDID_NOPLIST
 #include <plist/plist.h>
 
 #ifndef LDID_NOPLIST
 #include <plist/plist.h>

+#elif __APPLE__
+#include <CoreFoundation/CoreFoundation.h>

 #endif
 
 #include "ldid.hpp"
 #endif
 
 #include "ldid.hpp"


@@ -883,7 +885,7 @@ struct CodeDirectory {
     uint32_t codeLimit;
     uint8_t hashSize;
     uint8_t hashType;
     uint32_t codeLimit;
     uint8_t hashSize;
     uint8_t hashType;

-    uint8_t spare1;
+    uint8_t platform;

     uint8_t pageSize;
     uint32_t spare2;
     uint32_t scatterOffset;
     uint8_t pageSize;
     uint32_t spare2;
     uint32_t scatterOffset;


@@ -892,6 +894,17 @@ struct CodeDirectory {
     //uint64_t codeLimit64;
 } _packed;
 
     //uint64_t codeLimit64;
 } _packed;
 

+enum CodeSignatureFlags {
+    kSecCodeSignatureHost = 0x0001,
+    kSecCodeSignatureAdhoc = 0x0002,
+    kSecCodeSignatureForceHard = 0x0100,
+    kSecCodeSignatureForceKill = 0x0200,
+    kSecCodeSignatureForceExpiration = 0x0400,
+    kSecCodeSignatureRestrict = 0x0800,
+    kSecCodeSignatureEnforcement = 0x1000,
+    kSecCodeSignatureLibraryValidation = 0x2000,
+};
+

 enum Kind : uint32_t {
     exprForm = 1, // prefix expr form
 };
 enum Kind : uint32_t {
     exprForm = 1, // prefix expr form
 };


@@ -1022,19 +1035,28 @@ struct AlgorithmSHA256 :
     }
 };
 
     }
 };
 

+static bool do_sha1(true);
+static bool do_sha256(true);
+

 static const std::vector<Algorithm *> &GetAlgorithms() {
     static AlgorithmSHA1 sha1;
     static AlgorithmSHA256 sha256;
 
 static const std::vector<Algorithm *> &GetAlgorithms() {
     static AlgorithmSHA1 sha1;
     static AlgorithmSHA256 sha256;
 

-    static Algorithm *array[] = {
-        &sha1,
-        &sha256,
-    };
+    static std::vector<Algorithm *> algorithms;
+    if (algorithms.empty()) {
+        if (do_sha1)
+            algorithms.push_back(&sha1);
+        if (do_sha256)
+            algorithms.push_back(&sha256);
+    }

 
 

-    static std::vector<Algorithm *> algorithms(array, array + sizeof(array) / sizeof(array[0]));

     return algorithms;
 }
 
     return algorithms;
 }
 

+struct Baton {
+    std::string entitlements_;
+};
+

 struct CodesignAllocation {
     FatMachHeader mach_header_;
     uint32_t offset_;
 struct CodesignAllocation {
     FatMachHeader mach_header_;
     uint32_t offset_;


@@ -1043,15 +1065,17 @@ struct CodesignAllocation {
     uint32_t alloc_;
     uint32_t align_;
     const char *arch_;
     uint32_t alloc_;
     uint32_t align_;
     const char *arch_;

+    Baton baton_;

 
 

-    CodesignAllocation(FatMachHeader mach_header, size_t offset, size_t size, size_t limit, size_t alloc, size_t align, const char *arch) :
+    CodesignAllocation(FatMachHeader mach_header, size_t offset, size_t size, size_t limit, size_t alloc, size_t align, const char *arch, const Baton &baton) :

         mach_header_(mach_header),
         offset_(offset),
         size_(size),
         limit_(limit),
         alloc_(alloc),
         align_(align),
         mach_header_(mach_header),
         offset_(offset),
         size_(size),
         limit_(limit),
         alloc_(alloc),
         align_(align),

-        arch_(arch)
+        arch_(arch),
+        baton_(baton)

     {
     }
 };
     {
     }
 };


@@ -1159,35 +1183,44 @@ class Map {
 
 namespace ldid {
 
 
 namespace ldid {
 

+#ifndef LDID_NOPLIST
+static plist_t plist(const std::string &data);
+#endif
+
+void Analyze(const MachHeader &mach_header, const Functor<void (const char *data, size_t size)> &entitle) {
+    _foreach (load_command, mach_header.GetLoadCommands())
+        if (mach_header.Swap(load_command->cmd) == LC_CODE_SIGNATURE) {
+            auto signature(reinterpret_cast<struct linkedit_data_command *>(load_command));
+            auto offset(mach_header.Swap(signature->dataoff));
+            auto pointer(reinterpret_cast<uint8_t *>(mach_header.GetBase()) + offset);
+            auto super(reinterpret_cast<struct SuperBlob *>(pointer));
+
+            for (size_t index(0); index != Swap(super->count); ++index)
+                if (Swap(super->index[index].type) == CSSLOT_ENTITLEMENTS) {
+                    auto begin(Swap(super->index[index].offset));
+                    auto blob(reinterpret_cast<struct Blob *>(pointer + begin));
+                    auto writ(Swap(blob->length) - sizeof(*blob));
+                    entitle(reinterpret_cast<char *>(blob + 1), writ);
+                }
+        }
+}
+

 std::string Analyze(const void *data, size_t size) {
     std::string entitlements;
 
     FatHeader fat_header(const_cast<void *>(data), size);
     _foreach (mach_header, fat_header.GetMachHeaders())
 std::string Analyze(const void *data, size_t size) {
     std::string entitlements;
 
     FatHeader fat_header(const_cast<void *>(data), size);
     _foreach (mach_header, fat_header.GetMachHeaders())

-        _foreach (load_command, mach_header.GetLoadCommands())
-            if (mach_header.Swap(load_command->cmd) == LC_CODE_SIGNATURE) {
-                auto signature(reinterpret_cast<struct linkedit_data_command *>(load_command));
-                auto offset(mach_header.Swap(signature->dataoff));
-                auto pointer(reinterpret_cast<uint8_t *>(mach_header.GetBase()) + offset);
-                auto super(reinterpret_cast<struct SuperBlob *>(pointer));
-
-                for (size_t index(0); index != Swap(super->count); ++index)
-                    if (Swap(super->index[index].type) == CSSLOT_ENTITLEMENTS) {
-                        auto begin(Swap(super->index[index].offset));
-                        auto blob(reinterpret_cast<struct Blob *>(pointer + begin));
-                        auto writ(Swap(blob->length) - sizeof(*blob));
-
-                        if (entitlements.empty())
-                            entitlements.assign(reinterpret_cast<char *>(blob + 1), writ);
-                        else
-                            _assert(entitlements.compare(0, entitlements.size(), reinterpret_cast<char *>(blob + 1), writ) == 0);
-                    }
-            }
+        Analyze(mach_header, fun([&](const char *data, size_t size) {
+            if (entitlements.empty())
+                entitlements.assign(data, size);
+            else
+                _assert(entitlements.compare(0, entitlements.size(), data, size) == 0);
+        }));

 
     return entitlements;
 }
 
 
     return entitlements;
 }
 

-static void Allocate(const void *idata, size_t isize, std::streambuf &output, const Functor<size_t (const MachHeader &, size_t)> &allocate, const Functor<size_t (const MachHeader &, std::streambuf &output, size_t, const std::string &, const char *, const Progress &)> &save, const Progress &progress) {
+static void Allocate(const void *idata, size_t isize, std::streambuf &output, const Functor<size_t (const MachHeader &, Baton &, size_t)> &allocate, const Functor<size_t (const MachHeader &, const Baton &, std::streambuf &output, size_t, const std::string &, const char *, const Progress &)> &save, const Progress &progress) {

     FatHeader source(const_cast<void *>(idata), isize);
 
     size_t offset(0);
     FatHeader source(const_cast<void *>(idata), isize);
 
     size_t offset(0);


@@ -1218,12 +1251,15 @@ static void Allocate(const void *idata, size_t isize, std::streambuf &output, co
 
         if (symtab != NULL) {
             auto end(mach_header.Swap(symtab->stroff) + mach_header.Swap(symtab->strsize));
 
         if (symtab != NULL) {
             auto end(mach_header.Swap(symtab->stroff) + mach_header.Swap(symtab->strsize));

-            _assert(end <= size);
-            _assert(end >= size - 0x10);
-            size = end;
+            if (symtab->stroff != 0 || symtab->strsize != 0) {
+                _assert(end <= size);
+                _assert(end >= size - 0x10);
+                size = end;
+            }

         }
 
         }
 

-        size_t alloc(allocate(mach_header, size));
+        Baton baton;
+        size_t alloc(allocate(mach_header, baton, size));

 
         auto *fat_arch(mach_header.GetFatArch());
         uint32_t align;
 
         auto *fat_arch(mach_header.GetFatArch());
         uint32_t align;


@@ -1274,7 +1310,7 @@ static void Allocate(const void *idata, size_t isize, std::streambuf &output, co
         if (alloc != 0)
             limit = Align(limit, 0x10);
 
         if (alloc != 0)
             limit = Align(limit, 0x10);
 

-        allocations.push_back(CodesignAllocation(mach_header, offset, size, limit, alloc, align, arch));
+        allocations.push_back(CodesignAllocation(mach_header, offset, size, limit, alloc, align, arch, baton));

         offset += size + alloc;
         offset = Align(offset, 0x10);
     }
         offset += size + alloc;
         offset = Align(offset, 0x10);
     }


@@ -1396,7 +1432,7 @@ static void Allocate(const void *idata, size_t isize, std::streambuf &output, co
         pad(output, allocation.limit_ - allocation.size_);
         position += allocation.limit_ - allocation.size_;
 
         pad(output, allocation.limit_ - allocation.size_);
         position += allocation.limit_ - allocation.size_;
 

-        size_t saved(save(mach_header, output, allocation.limit_, overlap, top, progress));
+        size_t saved(save(mach_header, allocation.baton_, output, allocation.limit_, overlap, top, progress));

         if (allocation.alloc_ > saved)
             pad(output, allocation.alloc_ - saved);
         else
         if (allocation.alloc_ > saved)
             pad(output, allocation.alloc_ - saved);
         else


@@ -1568,8 +1604,12 @@ class Signature {
         for (unsigned i(0), e(sk_X509_num(certs)); i != e; i++)
             _assert(PKCS7_add_certificate(value_, sk_X509_value(certs, e - i - 1)));
 
         for (unsigned i(0), e(sk_X509_num(certs)); i != e; i++)
             _assert(PKCS7_add_certificate(value_, sk_X509_value(certs, e - i - 1)));
 

-        auto info(PKCS7_sign_add_signer(value_, stuff, stuff, NULL, PKCS7_NOSMIMECAP));
+        // XXX: this is the same as PKCS7_sign_add_signer(value_, stuff, stuff, NULL, PKCS7_NOSMIMECAP)
+        _assert(X509_check_private_key(stuff, stuff));
+        auto info(PKCS7_add_signature(value_, stuff, stuff, EVP_sha1()));

         _assert(info != NULL);
         _assert(info != NULL);

+        _assert(PKCS7_add_certificate(value_, stuff));
+        _assert(PKCS7_add_signed_attribute(info, NID_pkcs9_contentType, V_ASN1_OBJECT, OBJ_nid2obj(NID_pkcs7_data)));

 
         PKCS7_set_detached(value_, 1);
 
 
         PKCS7_set_detached(value_, 1);
 


@@ -1585,7 +1625,13 @@ class Signature {
             throw;
         }
 
             throw;
         }
 

-        _assert(PKCS7_final(value_, data, PKCS7_BINARY));
+        // XXX: this is the same as PKCS7_final(value_, data, PKCS7_BINARY)
+        BIO *bio(PKCS7_dataInit(value_, NULL));
+        _assert(bio != NULL);
+        _scope({ BIO_free_all(bio); });
+        SMIME_crlf_copy(data, bio, PKCS7_BINARY);
+        BIO_flush(bio);
+        _assert(PKCS7_dataFinal(value_, bio));

     }
 
     ~Signature() {
     }
 
     ~Signature() {


@@ -1765,7 +1811,7 @@ static void req(std::streambuf &buffer, uint8_t (&&data)[Size_]) {
     put(buffer, zeros, 3 - (Size_ + 3) % 4);
 }
 
     put(buffer, zeros, 3 - (Size_ + 3) % 4);
 }
 

-Hash Sign(const void *idata, size_t isize, std::streambuf &output, const std::string &identifier, const std::string &entitlements, const std::string &requirements, const std::string &key, const Slots &slots, const Progress &progress) {
+Hash Sign(const void *idata, size_t isize, std::streambuf &output, const std::string &identifier, const std::string &entitlements, bool merge, const std::string &requirements, const std::string &key, const Slots &slots, uint32_t flags, bool platform, const Progress &progress) {

     Hash hash;
 
 
     Hash hash;
 
 


@@ -1816,7 +1862,7 @@ Hash Sign(const void *idata, size_t isize, std::streambuf &output, const std::st
     // XXX: this is just a "sufficiently large number"
     size_t certificate(0x3000);
 
     // XXX: this is just a "sufficiently large number"
     size_t certificate(0x3000);
 

-    Allocate(idata, isize, output, fun([&](const MachHeader &mach_header, size_t size) -> size_t {
+    Allocate(idata, isize, output, fun([&](const MachHeader &mach_header, Baton &baton, size_t size) -> size_t {

         size_t alloc(sizeof(struct SuperBlob));
 
         uint32_t normal((size + PageSize_ - 1) / PageSize_);
         size_t alloc(sizeof(struct SuperBlob));
 
         uint32_t normal((size + PageSize_ - 1) / PageSize_);


@@ -1835,11 +1881,56 @@ Hash Sign(const void *idata, size_t isize, std::streambuf &output, const std::st
         alloc += sizeof(struct BlobIndex);
         alloc += backing.str().size();
 
         alloc += sizeof(struct BlobIndex);
         alloc += backing.str().size();
 

-        if (!entitlements.empty()) {
+        if (!merge)
+            baton.entitlements_ = entitlements;
+        else {
+#ifndef LDID_NOPLIST
+            Analyze(mach_header, fun([&](const char *data, size_t size) {
+                baton.entitlements_.assign(data, size);
+            }));
+
+            if (baton.entitlements_.empty())
+                baton.entitlements_ = entitlements;
+            else if (!entitlements.empty()) {
+                auto combined(plist(baton.entitlements_));
+                _scope({ plist_free(combined); });
+                _assert(plist_get_node_type(combined) == PLIST_DICT);
+
+                auto merging(plist(entitlements));
+                _scope({ plist_free(merging); });
+                _assert(plist_get_node_type(merging) == PLIST_DICT);
+
+                plist_dict_iter iterator(NULL);
+                plist_dict_new_iter(merging, &iterator);
+                _scope({ free(iterator); });
+
+                for (;;) {
+                    char *key(NULL);
+                    plist_t value(NULL);
+                    plist_dict_next_item(merging, iterator, &key, &value);
+                    if (key == NULL)
+                        break;
+                    _scope({ free(key); });
+                    plist_dict_set_item(combined, key, plist_copy(value));
+                }
+
+                char *xml(NULL);
+                uint32_t size;
+                plist_to_xml(combined, &xml, &size);
+                _scope({ free(xml); });
+
+                baton.entitlements_.assign(xml, size);
+            }
+#else
+            _assert(false);
+#endif
+        }
+
+        if (!baton.entitlements_.empty()) {

             special = std::max(special, CSSLOT_ENTITLEMENTS);
             alloc += sizeof(struct BlobIndex);
             alloc += sizeof(struct Blob);
             special = std::max(special, CSSLOT_ENTITLEMENTS);
             alloc += sizeof(struct BlobIndex);
             alloc += sizeof(struct Blob);

-            alloc += entitlements.size();
+            alloc += baton.entitlements_.size();

         }
 
         size_t directory(0);
         }
 
         size_t directory(0);


@@ -1864,16 +1955,16 @@ Hash Sign(const void *idata, size_t isize, std::streambuf &output, const std::st
 #endif
 
         return alloc;
 #endif
 
         return alloc;

-    }), fun([&](const MachHeader &mach_header, std::streambuf &output, size_t limit, const std::string &overlap, const char *top, const Progress &progress) -> size_t {
+    }), fun([&](const MachHeader &mach_header, const Baton &baton, std::streambuf &output, size_t limit, const std::string &overlap, const char *top, const Progress &progress) -> size_t {

         Blobs blobs;
 
         if (true) {
             insert(blobs, CSSLOT_REQUIREMENTS, backing);
         }
 
         Blobs blobs;
 
         if (true) {
             insert(blobs, CSSLOT_REQUIREMENTS, backing);
         }
 

-        if (!entitlements.empty()) {
+        if (!baton.entitlements_.empty()) {

             std::stringbuf data;
             std::stringbuf data;

-            put(data, entitlements.data(), entitlements.size());
+            put(data, baton.entitlements_.data(), baton.entitlements_.size());

             insert(blobs, CSSLOT_ENTITLEMENTS, CSMAGIC_EMBEDDED_ENTITLEMENTS, data);
         }
 
             insert(blobs, CSSLOT_ENTITLEMENTS, CSMAGIC_EMBEDDED_ENTITLEMENTS, data);
         }
 


@@ -1902,13 +1993,13 @@ Hash Sign(const void *idata, size_t isize, std::streambuf &output, const std::st
 
             CodeDirectory directory;
             directory.version = Swap(uint32_t(0x00020200));
 
             CodeDirectory directory;
             directory.version = Swap(uint32_t(0x00020200));

-            directory.flags = Swap(uint32_t(0));
+            directory.flags = Swap(uint32_t(flags));

             directory.nSpecialSlots = Swap(special);
             directory.codeLimit = Swap(uint32_t(limit));
             directory.nCodeSlots = Swap(normal);
             directory.hashSize = algorithm.size_;
             directory.hashType = algorithm.type_;
             directory.nSpecialSlots = Swap(special);
             directory.codeLimit = Swap(uint32_t(limit));
             directory.nCodeSlots = Swap(normal);
             directory.hashSize = algorithm.size_;
             directory.hashType = algorithm.type_;

-            directory.spare1 = 0x00;
+            directory.platform = platform ? 0x01 : 0x00;

             directory.pageSize = PageShift_;
             directory.spare2 = Swap(uint32_t(0));
             directory.scatterOffset = Swap(uint32_t(0));
             directory.pageSize = PageShift_;
             directory.spare2 = Swap(uint32_t(0));
             directory.scatterOffset = Swap(uint32_t(0));


@@ -1970,11 +2061,21 @@ Hash Sign(const void *idata, size_t isize, std::streambuf &output, const std::st
 
 #ifndef LDID_NOSMIME
         if (!key.empty()) {
 
 #ifndef LDID_NOSMIME
         if (!key.empty()) {

+#ifdef LDID_NOPLIST
+            auto plist(CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
+            _scope({ CFRelease(plist); });
+
+            auto cdhashes(CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks));
+            _scope({ CFRelease(cdhashes); });
+
+            CFDictionarySetValue(plist, CFSTR("cdhashes"), cdhashes);
+#else

             auto plist(plist_new_dict());
             _scope({ plist_free(plist); });
 
             auto cdhashes(plist_new_array());
             plist_dict_set_item(plist, "cdhashes", cdhashes);
             auto plist(plist_new_dict());
             _scope({ plist_free(plist); });
 
             auto cdhashes(plist_new_array());
             plist_dict_set_item(plist, "cdhashes", cdhashes);

+#endif

 
             unsigned total(0);
             for (Algorithm *pointer : GetAlgorithms()) {
 
             unsigned total(0);
             for (Algorithm *pointer : GetAlgorithms()) {


@@ -1988,13 +2089,26 @@ Hash Sign(const void *idata, size_t isize, std::streambuf &output, const std::st
                 algorithm(hash, blob.data(), blob.size());
                 hash.resize(20);
 
                 algorithm(hash, blob.data(), blob.size());
                 hash.resize(20);
 

+#ifdef LDID_NOPLIST
+                auto value(CFDataCreate(kCFAllocatorDefault, reinterpret_cast<const UInt8 *>(hash.data()), hash.size()));
+                _scope({ CFRelease(value); });
+                CFArrayAppendValue(cdhashes, value);
+#else

                 plist_array_append_item(cdhashes, plist_new_data(hash.data(), hash.size()));
                 plist_array_append_item(cdhashes, plist_new_data(hash.data(), hash.size()));

+#endif

             }
 
             }
 

+#ifdef LDID_NOPLIST
+            auto created(CFPropertyListCreateXMLData(kCFAllocatorDefault, plist));
+            _scope({ CFRelease(created); });
+            auto xml(reinterpret_cast<const char *>(CFDataGetBytePtr(created)));
+            auto size(CFDataGetLength(created));
+#else

             char *xml(NULL);
             uint32_t size;
             plist_to_xml(plist, &xml, &size);
             _scope({ free(xml); });
             char *xml(NULL);
             uint32_t size;
             plist_to_xml(plist, &xml, &size);
             _scope({ free(xml); });

+#endif

 
             std::stringbuf data;
             const std::string &sign(blobs[CSSLOT_CODEDIRECTORY]);
 
             std::stringbuf data;
             const std::string &sign(blobs[CSSLOT_CODEDIRECTORY]);


@@ -2020,9 +2134,9 @@ Hash Sign(const void *idata, size_t isize, std::streambuf &output, const std::st
 
 #ifndef LDID_NOTOOLS
 static void Unsign(void *idata, size_t isize, std::streambuf &output, const Progress &progress) {
 
 #ifndef LDID_NOTOOLS
 static void Unsign(void *idata, size_t isize, std::streambuf &output, const Progress &progress) {

-    Allocate(idata, isize, output, fun([](const MachHeader &mach_header, size_t size) -> size_t {
+    Allocate(idata, isize, output, fun([](const MachHeader &mach_header, Baton &baton, size_t size) -> size_t {

         return 0;
         return 0;

-    }), fun([](const MachHeader &mach_header, std::streambuf &output, size_t limit, const std::string &overlap, const char *top, const Progress &progress) -> size_t {
+    }), fun([](const MachHeader &mach_header, const Baton &baton, std::streambuf &output, size_t limit, const std::string &overlap, const char *top, const Progress &progress) -> size_t {

         return 0;
     }), progress);
 }
         return 0;
     }), progress);
 }


@@ -2357,7 +2471,7 @@ struct RuleCode {
 };
 
 #ifndef LDID_NOPLIST
 };
 
 #ifndef LDID_NOPLIST

-static Hash Sign(const uint8_t *prefix, size_t size, std::streambuf &buffer, Hash &hash, std::streambuf &save, const std::string &identifier, const std::string &entitlements, const std::string &requirements, const std::string &key, const Slots &slots, size_t length, const Progress &progress) {
+static Hash Sign(const uint8_t *prefix, size_t size, std::streambuf &buffer, Hash &hash, std::streambuf &save, const std::string &identifier, const std::string &entitlements, bool merge, const std::string &requirements, const std::string &key, const Slots &slots, size_t length, uint32_t flags, bool platform, const Progress &progress) {

     // XXX: this is a miserable fail
     std::stringbuf temp;
     put(temp, prefix, size);
     // XXX: this is a miserable fail
     std::stringbuf temp;
     put(temp, prefix, size);


@@ -2367,7 +2481,7 @@ static Hash Sign(const uint8_t *prefix, size_t size, std::streambuf &buffer, Has
     auto data(temp.str());
 
     HashProxy proxy(hash, save);
     auto data(temp.str());
 
     HashProxy proxy(hash, save);

-    return Sign(data.data(), data.size(), proxy, identifier, entitlements, requirements, key, slots, progress);
+    return Sign(data.data(), data.size(), proxy, identifier, entitlements, merge, requirements, key, slots, flags, platform, progress);

 }
 
 Bundle Sign(const std::string &root, Folder &folder, const std::string &key, std::map<std::string, Hash> &remote, const std::string &requirements, const Functor<std::string (const std::string &, const std::string &)> &alter, const Progress &progress) {
 }
 
 Bundle Sign(const std::string &root, Folder &folder, const std::string &key, std::map<std::string, Hash> &remote, const std::string &requirements, const Functor<std::string (const std::string &, const std::string &)> &alter, const Progress &progress) {


@@ -2511,7 +2625,7 @@ Bundle Sign(const std::string &root, Folder &folder, const std::string &key, std
                     case MH_CIGAM: case MH_CIGAM_64:
                         folder.Save(name, true, flag, fun([&](std::streambuf &save) {
                             Slots slots;
                     case MH_CIGAM: case MH_CIGAM_64:
                         folder.Save(name, true, flag, fun([&](std::streambuf &save) {
                             Slots slots;

-                            Sign(header.bytes, size, data, hash, save, identifier, "", "", key, slots, length, Progression(progress, root + name));
+                            Sign(header.bytes, size, data, hash, save, identifier, "", false, "", key, slots, length, 0, false, Progression(progress, root + name));

                         }));
                         return;
                 }
                         }));
                         return;
                 }


@@ -2640,7 +2754,7 @@ Bundle Sign(const std::string &root, Folder &folder, const std::string &key, std
             Slots slots;
             slots[1] = local.at(info);
             slots[3] = local.at(signature);
             Slots slots;
             slots[1] = local.at(info);
             slots[3] = local.at(signature);

-            bundle.hash = Sign(NULL, 0, buffer, local[executable], save, identifier, entitlements, requirements, key, slots, length, Progression(progress, root + executable));
+            bundle.hash = Sign(NULL, 0, buffer, local[executable], save, identifier, entitlements, false, requirements, key, slots, length, 0, false, Progression(progress, root + executable));

         }));
     }));
 
         }));
     }));
 


@@ -2659,6 +2773,13 @@ Bundle Sign(const std::string &root, Folder &folder, const std::string &key, con
 #endif
 }
 
 #endif
 }
 

+static void usage(const char *argv0) {
+    fprintf(stderr, "usage: %s -S[entitlements.xml] <binary>\n", argv0);
+    fprintf(stderr, "   %s -e MobileSafari\n", argv0);
+    fprintf(stderr, "   %s -S cat\n", argv0);
+    fprintf(stderr, "   %s -Stfp.xml gdb\n", argv0);
+}
+

 #ifndef LDID_NOTOOLS
 int main(int argc, char *argv[]) {
 #ifndef LDID_NOSMIME
 #ifndef LDID_NOTOOLS
 int main(int argc, char *argv[]) {
 #ifndef LDID_NOSMIME


@@ -2676,6 +2797,8 @@ int main(int argc, char *argv[]) {
     bool flag_e(false);
     bool flag_q(false);
 
     bool flag_e(false);
     bool flag_q(false);
 

+    bool flag_H(false);
+

 #ifndef LDID_NOFLAGT
     bool flag_T(false);
 #endif
 #ifndef LDID_NOFLAGT
     bool flag_T(false);
 #endif


@@ -2690,6 +2813,11 @@ int main(int argc, char *argv[]) {
 
     bool flag_u(false);
 
 
     bool flag_u(false);
 

+    bool flag_M(false);
+
+    uint32_t flags(0);
+    bool platform(false);
+

     uint32_t flag_CPUType(_not(uint32_t));
     uint32_t flag_CPUSubtype(_not(uint32_t));
 
     uint32_t flag_CPUType(_not(uint32_t));
     uint32_t flag_CPUSubtype(_not(uint32_t));
 


@@ -2708,11 +2836,8 @@ int main(int argc, char *argv[]) {
     std::vector<std::string> files;
 
     if (argc == 1) {
     std::vector<std::string> files;
 
     if (argc == 1) {

-        fprintf(stderr, "usage: %s -S[entitlements.xml] <binary>\n", argv[0]);
-        fprintf(stderr, "   %s -e MobileSafari\n", argv[0]);
-        fprintf(stderr, "   %s -S cat\n", argv[0]);
-        fprintf(stderr, "   %s -Stfp.xml gdb\n", argv[0]);
-        exit(0);
+        usage(argv[0]);
+        return 0;

     }
 
     for (int argi(1); argi != argc; ++argi)
     }
 
     for (int argi(1); argi != argc; ++argi)


@@ -2742,6 +2867,27 @@ int main(int argc, char *argv[]) {
 
             case 'q': flag_q = true; break;
 
 
             case 'q': flag_q = true; break;
 

+            case 'H': {
+                const char *hash = argv[argi] + 2;
+
+                if (!flag_H) {
+                    flag_H = true;
+
+                    do_sha1 = false;
+                    do_sha256 = false;
+
+                    fprintf(stderr, "WARNING: -H is only present for compatibility with a fork of ldid\n");
+                    fprintf(stderr, "         you should NOT be manually specifying the hash algorithm\n");
+                }
+
+                if (false);
+                else if (strcmp(hash, "sha1") == 0)
+                    do_sha1 = true;
+                else if (strcmp(hash, "sha256") == 0)
+                    do_sha256 = true;
+                else _assert(false);
+            } break;
+

             case 'Q': {
                 const char *xml = argv[argi] + 2;
                 requirements.open(xml, O_RDONLY, PROT_READ, MAP_PRIVATE);
             case 'Q': {
                 const char *xml = argv[argi] + 2;
                 requirements.open(xml, O_RDONLY, PROT_READ, MAP_PRIVATE);


@@ -2766,6 +2912,32 @@ int main(int argc, char *argv[]) {
                 }
             break;
 
                 }
             break;
 

+            case 'C': {
+                const char *name = argv[argi] + 2;
+                if (false);
+                else if (strcmp(name, "host") == 0)
+                    flags |= kSecCodeSignatureHost;
+                else if (strcmp(name, "adhoc") == 0)
+                    flags |= kSecCodeSignatureAdhoc;
+                else if (strcmp(name, "hard") == 0)
+                    flags |= kSecCodeSignatureForceHard;
+                else if (strcmp(name, "kill") == 0)
+                    flags |= kSecCodeSignatureForceKill;
+                else if (strcmp(name, "expires") == 0)
+                    flags |= kSecCodeSignatureForceExpiration;
+                else if (strcmp(name, "restrict") == 0)
+                    flags |= kSecCodeSignatureRestrict;
+                else if (strcmp(name, "enforcement") == 0)
+                    flags |= kSecCodeSignatureEnforcement;
+                else if (strcmp(name, "library-validation") == 0)
+                    flags |= kSecCodeSignatureLibraryValidation;
+                else _assert(false);
+            } break;
+
+            case 'P':
+                platform = true;
+            break;
+

             case 's':
                 _assert(!flag_r);
                 _assert(!flag_S);
             case 's':
                 _assert(!flag_r);
                 _assert(!flag_S);


@@ -2782,6 +2954,10 @@ int main(int argc, char *argv[]) {
                 }
             break;
 
                 }
             break;
 

+            case 'M':
+                flag_M = true;
+            break;
+

             case 'K':
                 if (argv[argi][2] != '\0')
                     key.open(argv[argi] + 2, O_RDONLY, PROT_READ, MAP_PRIVATE);
             case 'K':
                 if (argv[argi][2] != '\0')
                     key.open(argv[argi] + 2, O_RDONLY, PROT_READ, MAP_PRIVATE);


@@ -2809,16 +2985,16 @@ int main(int argc, char *argv[]) {
             } break;
 
             default:
             } break;
 
             default:

-                goto usage;
+                usage(argv[0]);
+                return 1;

             break;
         }
 
     _assert(flag_S || key.empty());
     _assert(flag_S || flag_I == NULL);
 
             break;
         }
 
     _assert(flag_S || key.empty());
     _assert(flag_S || flag_I == NULL);
 

-    if (files.empty()) usage: {
-        exit(0);
-    }
+    if (files.empty())
+        return 0;

 
     size_t filei(0), filee(0);
     _foreach (file, files) try {
 
     size_t filei(0), filee(0);
     _foreach (file, files) try {


@@ -2846,7 +3022,7 @@ int main(int argc, char *argv[]) {
                 ldid::Unsign(input.data(), input.size(), output, dummy_);
             else {
                 std::string identifier(flag_I ?: split.base.c_str());
                 ldid::Unsign(input.data(), input.size(), output, dummy_);
             else {
                 std::string identifier(flag_I ?: split.base.c_str());

-                ldid::Sign(input.data(), input.size(), output, identifier, entitlements, requirements, key, slots, dummy_);
+                ldid::Sign(input.data(), input.size(), output, identifier, entitlements, flag_M, requirements, key, slots, flags, platform, dummy_);

             }
 
             Commit(path, temp);
             }
 
             Commit(path, temp);