types

const (
	/* code signing attributes of a process */
	NONE           CDFlag = 0x00000000 /* no flags */
	VALID          CDFlag = 0x00000001 /* dynamically valid */
	ADHOC          CDFlag = 0x00000002 /* ad hoc signed */
	GET_TASK_ALLOW CDFlag = 0x00000004 /* has get-task-allow entitlement */
	INSTALLER      CDFlag = 0x00000008 /* has installer entitlement */

	FORCED_LV       CDFlag = 0x00000010 /* Library Validation required by Hardened System Policy */
	INVALID_ALLOWED CDFlag = 0x00000020 /* (macOS Only) Page invalidation allowed by task port policy */

	HARD             CDFlag = 0x00000100 /* don't load invalid pages */
	KILL             CDFlag = 0x00000200 /* kill process if it becomes invalid */
	CHECK_EXPIRATION CDFlag = 0x00000400 /* force expiration checking */
	RESTRICT         CDFlag = 0x00000800 /* tell dyld to treat restricted */

	ENFORCEMENT            CDFlag = 0x00001000 /* require enforcement */
	REQUIRE_LV             CDFlag = 0x00002000 /* require library validation */
	ENTITLEMENTS_VALIDATED CDFlag = 0x00004000 /* code signature permits restricted entitlements */
	NVRAM_UNRESTRICTED     CDFlag = 0x00008000 /* has com.apple.rootless.restricted-nvram-variables.heritable entitlement */

	RUNTIME CDFlag = 0x00010000 /* Apply hardened runtime policies */

	LINKER_SIGNED CDFlag = 0x20000 // type property

	ALLOWED_MACHO CDFlag = (ADHOC | HARD | KILL | CHECK_EXPIRATION | RESTRICT | ENFORCEMENT | REQUIRE_LV | RUNTIME)

	EXEC_SET_HARD        CDFlag = 0x00100000 /* set HARD on any exec'ed process */
	EXEC_SET_KILL        CDFlag = 0x00200000 /* set KILL on any exec'ed process */
	EXEC_SET_ENFORCEMENT CDFlag = 0x00400000 /* set ENFORCEMENT on any exec'ed process */
	EXEC_INHERIT_SIP     CDFlag = 0x00800000 /* set INSTALLER on any exec'ed process */

	KILLED          CDFlag = 0x01000000 /* was killed by kernel for invalidity */
	DYLD_PLATFORM   CDFlag = 0x02000000 /* dyld used to load this is a platform binary */
	PLATFORM_BINARY CDFlag = 0x04000000 /* this is a platform binary */
	PLATFORM_PATH   CDFlag = 0x08000000 /* platform binary by the fact of path (osx only) */

	DEBUGGED             CDFlag = 0x10000000 /* process is currently or has previously been debugged and allowed to run with invalid pages */
	SIGNED               CDFlag = 0x20000000 /* process has a signature (may have gone invalid) */
	DEV_CODE             CDFlag = 0x40000000 /* code is dev signed, cannot be loaded into prod signed code (will go away with rdar://problem/28322552) */
	DATAVAULT_CONTROLLER CDFlag = 0x80000000 /* has Data Vault controller entitlement */

	ENTITLEMENT_FLAGS CDFlag = (GET_TASK_ALLOW | INSTALLER | DATAVAULT_CONTROLLER | NVRAM_UNRESTRICTED)
)

const (
	// Magic numbers used by Code Signing
	MAGIC_REQUIREMENT                Magic = 0xfade0c00 // single Requirement blob
	MAGIC_REQUIREMENTS               Magic = 0xfade0c01 // Requirements vector (internal requirements)
	MAGIC_CODEDIRECTORY              Magic = 0xfade0c02 // CodeDirectory blob
	MAGIC_EMBEDDED_SIGNATURE         Magic = 0xfade0cc0 // embedded form of signature data
	MAGIC_EMBEDDED_SIGNATURE_OLD     Magic = 0xfade0b02 /* XXX */
	MAGIC_LIBRARY_DEPENDENCY_BLOB    Magic = 0xfade0c05
	MAGIC_EMBEDDED_ENTITLEMENTS      Magic = 0xfade7171 /* embedded entitlements */
	MAGIC_EMBEDDED_ENTITLEMENTS_DER  Magic = 0xfade7172 /* embedded entitlements */
	MAGIC_DETACHED_SIGNATURE         Magic = 0xfade0cc1 // multi-arch collection of embedded signatures
	MAGIC_BLOBWRAPPER                Magic = 0xfade0b01 // used for the cms blob
	MAGIC_EMBEDDED_LAUNCH_CONSTRAINT Magic = 0xfade8181 // Light weight code requirement
)

const (
	HostRequirementType       RequirementType = 1 /* what hosts may run us */
	GuestRequirementType      RequirementType = 2 /* what guests we may run */
	DesignatedRequirementType RequirementType = 3 /* designated requirement */
	LibraryRequirementType    RequirementType = 4 /* what libraries we may link against */
	PluginRequirementType     RequirementType = 5 /* what plug-ins we may load */
)

const (
	CSSLOT_CODEDIRECTORY                 SlotType = 0
	CSSLOT_INFOSLOT                      SlotType = 1 // Info.plist
	CSSLOT_REQUIREMENTS                  SlotType = 2 // internal requirements
	CSSLOT_RESOURCEDIR                   SlotType = 3 // resource directory
	CSSLOT_APPLICATION                   SlotType = 4 // Application specific slot/Top-level directory list
	CSSLOT_ENTITLEMENTS                  SlotType = 5 // embedded entitlement configuration
	CSSLOT_REP_SPECIFIC                  SlotType = 6 // for use by disk images
	CSSLOT_ENTITLEMENTS_DER              SlotType = 7 // DER representation of entitlements plist
	CSSLOT_LAUNCH_CONSTRAINT_SELF        SlotType = 8
	CSSLOT_LAUNCH_CONSTRAINT_PARENT      SlotType = 9
	CSSLOT_LAUNCH_CONSTRAINT_RESPONSIBLE SlotType = 10
	CSSLOT_LIBRARY_CONSTRAINT            SlotType = 11
	CSSLOT_ALTERNATE_CODEDIRECTORIES     SlotType = 0x1000 // Used for expressing a code directory using an alternate digest type.
	CSSLOT_ALTERNATE_CODEDIRECTORIES1    SlotType = 0x1001 // Used for expressing a code directory using an alternate digest type.
	CSSLOT_ALTERNATE_CODEDIRECTORIES2    SlotType = 0x1002 // Used for expressing a code directory using an alternate digest type.
	CSSLOT_ALTERNATE_CODEDIRECTORIES3    SlotType = 0x1003 // Used for expressing a code directory using an alternate digest type.
	CSSLOT_ALTERNATE_CODEDIRECTORIES4    SlotType = 0x1004 // Used for expressing a code directory using an alternate digest type.
	CSSLOT_ALTERNATE_CODEDIRECTORY_MAX            = 5
	CSSLOT_ALTERNATE_CODEDIRECTORY_LIMIT          = CSSLOT_ALTERNATE_CODEDIRECTORIES + CSSLOT_ALTERNATE_CODEDIRECTORY_MAX
	CSSLOT_CMS_SIGNATURE                 SlotType = 0x10000 // CMS signature
	CSSLOT_IDENTIFICATIONSLOT            SlotType = 0x10001 // identification blob; used for detached signature
	CSSLOT_TICKETSLOT                    SlotType = 0x10002 // Notarization ticket
)