README
¶
Device management library
These packages belong to the root module, github.com/deploymenttheory/go-apple-dm.
There is no separate devicemanagement module. The reference server remains in
../server/.
| Folder | Responsibility |
|---|---|
appleplatformservices/ |
Apple service clients and their test helpers |
mdmprotocol/ |
MDM, DDM, enrollment, codecs and events |
pki/ |
Certificate issuance, validation and revocation |
schema/ |
Generated Apple types, validation and source provenance |
storage/ |
Storage contracts, memory implementations and contract suites |
simulator/ |
Device simulator for embedding and tests |
clock/, paging/, state/ |
Clock, pagination and protocol state abstractions |
ratelimit/, secrets/, telemetry/ |
Quotas, secret handling and instrumentation |
testpki/ |
Shared certificate test utilities |
internal/ |
Private canonical JSON, CBOR and SCEP implementations |
Shared URL validation remains in ../internal/httpsurl/ because both the library
and server use it. Schema generation and repository checks remain in the root
cmd/schemagen/, internal/schemagen/ and internal/layout/ directories.
Updating existing imports
Insert /devicemanagement after the root module path for the public package
folders listed above. For example:
import "github.com/deploymenttheory/go-apple-dm/devicemanagement/mdmprotocol/mdm"
import "github.com/deploymenttheory/go-apple-dm/devicemanagement/schema/commands"
Select a root module revision containing these paths with go get github.com/deploymenttheory/go-apple-dm@REVISION. Old package locations do not have
forwarding aliases. Package names and exported signatures retain their existing
names; the relocation does not change wire formats, stored data or encryption
derivation identifiers. Server package imports continue to use the /server/
module path. Local development uses the root go.work.
See the architecture guide for dependency boundaries and the contributing guide for generation and verification commands.
Directories
¶
| Path | Synopsis |
|---|---|
|
appleplatformservices
|
|
|
axm
Package axm provides a typed client for the Apple Business Manager and Apple School Manager APIs.
|
Package axm provides a typed client for the Apple Business Manager and Apple School Manager APIs. |
|
axm/axmtest
Package axmtest provides an in-process Apple Business Manager and Apple School Manager API fake.
|
Package axmtest provides an in-process Apple Business Manager and Apple School Manager API fake. |
|
dep
Package dep implements Apple's device enrollment service client, token exchange, device synchronization and profile assignment.
|
Package dep implements Apple's device enrollment service client, token exchange, device synchronization and profile assignment. |
|
dep/deptest
Package deptest provides a device enrollment service fake, store contract suites and failure injection.
|
Package deptest provides a device enrollment service fake, store contract suites and failure injection. |
|
gdmf
Package gdmf reads Apple's software lookup catalog and selects operating system versions for devices.
|
Package gdmf reads Apple's software lookup catalog and selects operating system versions for devices. |
|
gdmf/gdmftest
Package gdmftest supplies a fixture catalog, HTTP server and in-memory software Lookup for tests.
|
Package gdmftest supplies a fixture catalog, HTTP server and in-memory software Lookup for tests. |
|
push
Package push defines notification targets, results, certificate sources and coalescing for MDM pushes.
|
Package push defines notification targets, results, certificate sources and coalescing for MDM pushes. |
|
push/apns
Package apns implements certificate-authenticated APNs HTTP/2 clients for MDM wake-ups and ordinary app alert/background notifications.
|
Package apns implements certificate-authenticated APNs HTTP/2 clients for MDM wake-ups and ordinary app alert/background notifications. |
|
push/pushtest
Package pushtest provides a scripted push.Pusher and an in-process APNs server.
|
Package pushtest provides a scripted push.Pusher and an in-process APNs server. |
|
Package clock abstracts time with a real clock and a manually advanced concurrent-safe fake.
|
Package clock abstracts time with a real clock and a manually advanced concurrent-safe fake. |
|
Package contentcache decodes Apple Content Cache metrics and provides an embeddable receiver with caller-supplied authorization and storage.
|
Package contentcache decodes Apple Content Cache metrics and provides an embeddable receiver with caller-supplied authorization and storage. |
|
internal
|
|
|
canonjson
Package canonjson implements the JSON Canonicalization Scheme defined by RFC 8785.
|
Package canonjson implements the JSON Canonicalization Scheme defined by RFC 8785. |
|
cbor
Package cbor encodes and decodes the CBOR subset used by Managed Device Attestation objects.
|
Package cbor encodes and decodes the CBOR subset used by Managed Device Attestation objects. |
|
scepwire
Package scepwire builds and checks the CMS messages used for SCEP enrollment.
|
Package scepwire builds and checks the CMS messages used for SCEP enrollment. |
|
mdmprotocol
|
|
|
cms
Package cms signs and verifies attached and detached CMS signatures used by Apple device management.
|
Package cms signs and verifies attached and detached CMS signatures used by Apple device management. |
|
ddm
Package ddm implements declarations, membership, snapshots, synchronization tokens and status handling for declarative device management.
|
Package ddm implements declarations, membership, snapshots, synchronization tokens and status handling for declarative device management. |
|
ddm/predicate
Package predicate parses and evaluates a subset of NSPredicate syntax for declarative device management activations.
|
Package predicate parses and evaluates a subset of NSPredicate syntax for declarative device management activations. |
|
dmhook
Package dmhook defines service-operation metadata and the hook interface for observing or vetoing operations.
|
Package dmhook defines service-operation metadata and the hook interface for observing or vetoing operations. |
|
enroll
Package enroll builds MDM enrollment profiles and serves the over-the-air Profile Service protocol.
|
Package enroll builds MDM enrollment profiles and serves the over-the-air Profile Service protocol. |
|
enroll/accountdriven
Package accountdriven implements account-driven Device Enrollment and account-driven User Enrollment authentication.
|
Package accountdriven implements account-driven Device Enrollment and account-driven User Enrollment authentication. |
|
enroll/ade
Package ade serves Automated Device Enrollment profiles after parsing and verifying signed MachineInfo.
|
Package ade serves Automated Device Enrollment profiles after parsing and verifying signed MachineInfo. |
|
enroll/adetest
Package adetest constructs signed MachineInfo and its request carriers for Automated Device Enrollment tests.
|
Package adetest constructs signed MachineInfo and its request carriers for Automated Device Enrollment tests. |
|
enroll/discovery
Package discovery serves account-driven enrollment service discovery at /.well-known/com.apple.remotemanagement.
|
Package discovery serves account-driven enrollment service discovery at /.well-known/com.apple.remotemanagement. |
|
enroll/webauth
Package webauth implements an OpenID Connect relying party for enrollment browser authentication.
|
Package webauth implements an OpenID Connect relying party for enrollment browser authentication. |
|
enroll/webauth/webauthtest
Package webauthtest supplies an OpenID Connect provider and browser-flow helpers for enrollment tests.
|
Package webauthtest supplies an OpenID Connect provider and browser-flow helpers for enrollment tests. |
|
event
Package event provides typed events, publisher/coordinator contracts and an in-process bus with enrollment, actor and timestamp metadata.
|
Package event provides typed events, publisher/coordinator contracts and an in-process bus with enrollment, actor and timestamp metadata. |
|
mdm
Package mdm defines enrollment identities and decodes Apple MDM check-in, command and response envelopes.
|
Package mdm defines enrollment identities and decodes Apple MDM check-in, command and response envelopes. |
|
plist
Package plist wraps XML and binary property-list encoding and bounded decoding.
|
Package plist wraps XML and binary property-list encoding and bounded decoding. |
|
profile
Package profile composes, signs and parses Apple configuration profiles.
|
Package profile composes, signs and parses Apple configuration profiles. |
|
Package paging defines cursor-page requests, generic results and shared page-size bounds.
|
Package paging defines cursor-page requests, generic results and shared page-size bounds. |
|
pki
|
|
|
acme
Package acme serves the ACME protocol used by Apple device identity payloads, including device-attest-01.
|
Package acme serves the ACME protocol used by Apple device identity payloads, including device-attest-01. |
|
acme/attest
Package attest parses and verifies Managed Device Attestation certificate chains and objects.
|
Package attest parses and verifies Managed Device Attestation certificate chains and objects. |
|
acme/attest/attesttest
Package attesttest generates Managed Device Attestation test chains and property extensions.
|
Package attesttest generates Managed Device Attestation test chains and property extensions. |
|
acme/jose
Package jose parses, verifies and produces the JWS and JWK forms used by ACME.
|
Package jose parses, verifies and produces the JWS and JWK forms used by ACME. |
|
ca
Package ca defines certificate signing, issuance storage and policy for enrollment identities.
|
Package ca defines certificate signing, issuance storage and policy for enrollment identities. |
|
lifecycle
Package lifecycle manages certificate setup, renewal and issuer replacement using persistent state.
|
Package lifecycle manages certificate setup, renewal and issuer replacement using persistent state. |
|
pushcert
Package pushcert inspects APNs certificates, validates MDM and app identities, and generates customer CSRs and Apple vendor-signed portal requests.
|
Package pushcert inspects APNs certificates, validates MDM and app identities, and generates customer CSRs and Apple vendor-signed portal requests. |
|
revocation
Package revocation records issuance and irreversible revocation and publishes issuer-signed CRL and OCSP status.
|
Package revocation records issuance and irreversible revocation and publishes issuer-signed CRL and OCSP status. |
|
scep
Package scep serves SCEP enrollment and renewal and provides a client for identity issuance.
|
Package scep serves SCEP enrollment and renewal and provides a client for identity issuance. |
|
Package ratelimit implements optional atomic GCRA quotas with bounded, expiring state.
|
Package ratelimit implements optional atomic GCRA quotas with bounded, expiring state. |
|
schema
|
|
|
checkin
Package checkin holds the MDM check-in messages generated from Apple's device management schema: 9 schema files and 14 types.
|
Package checkin holds the MDM check-in messages generated from Apple's device management schema: 9 schema files and 14 types. |
|
commands
Package commands holds the MDM commands and their responses generated from Apple's device management schema: 67 schema files and 224 types.
|
Package commands holds the MDM commands and their responses generated from Apple's device management schema: 67 schema files and 224 types. |
|
ddm
Package ddm holds the declarative device management declarations generated from Apple's device management schema: 64 schema files and 204 types.
|
Package ddm holds the declarative device management declarations generated from Apple's device management schema: 64 schema files and 204 types. |
|
ddmproto
Package ddmproto holds the declarative device management protocol messages generated from Apple's device management schema: 3 schema files and 7 types.
|
Package ddmproto holds the declarative device management protocol messages generated from Apple's device management schema: 3 schema files and 7 types. |
|
errors
Package errors holds the enrollment error response bodies generated from Apple's device management schema: 5 schema files and 10 types.
|
Package errors holds the enrollment error response bodies generated from Apple's device management schema: 5 schema files and 10 types. |
|
internal/conformance
Package conformance supplies encoding round-trip and validation helpers for generated schema tests.
|
Package conformance supplies encoding round-trip and validation helpers for generated schema tests. |
|
other
Package other holds the other device management data formats generated from Apple's device management schema: 5 schema files and 10 types.
|
Package other holds the other device management data formats generated from Apple's device management schema: 5 schema files and 10 types. |
|
profiles
Package profiles holds the configuration profile payloads generated from Apple's device management schema: 127 schema files and 231 types.
|
Package profiles holds the configuration profile payloads generated from Apple's device management schema: 127 schema files and 231 types. |
|
status
Package status holds the declarative device management status items generated from Apple's device management schema: 63 schema files and 100 types.
|
Package status holds the declarative device management status items generated from Apple's device management schema: 63 schema files and 100 types. |
|
support
Package support queries generated platform, version, channel and enrollment-context metadata.
|
Package support queries generated platform, version, channel and enrollment-context metadata. |
|
validation
Package validation collects constraint failures from generated schema validators.
|
Package validation collects constraint failures from generated schema validators. |
|
Package secrets provides named credential sources and a value type that redacts formatted output.
|
Package secrets provides named credential sources and a value type that redacts formatted output. |
|
Package simulator exercises modeled Apple MDM and enrollment flows as a device-side test client.
|
Package simulator exercises modeled Apple MDM and enrollment flows as a device-side test client. |
|
Package state defines transactional, expiring byte records for protocol state.
|
Package state defines transactional, expiring byte records for protocol state. |
|
Package storage defines MDM persistence contracts and shared sentinel errors.
|
Package storage defines MDM persistence contracts and shared sentinel errors. |
|
acme/acmetest
Package acmetest defines ACME store contracts, fixtures and controlled failures.
|
Package acmetest defines ACME store contracts, fixtures and controlled failures. |
|
acme/inmem
Package inmem implements a mutex-protected in-memory acme.Store.
|
Package inmem implements a mutex-protected in-memory acme.Store. |
|
crypt
Package crypt seals byte values with AES-256-GCM using named keys from secrets.Provider.
|
Package crypt seals byte values with AES-256-GCM using named keys from secrets.Provider. |
|
ddm/ddmtest
Package ddmtest defines transactional declaration-store contracts and fixtures.
|
Package ddmtest defines transactional declaration-store contracts and fixtures. |
|
ddm/inmem
Package inmem implements a mutex-protected in-memory ddm.Store.
|
Package inmem implements a mutex-protected in-memory ddm.Store. |
|
dep/inmem
Package inmem implements a mutex-protected in-memory device enrollment service store.
|
Package inmem implements a mutex-protected in-memory device enrollment service store. |
|
inmem
Package inmem implements a mutex-protected MDM store for tests and development.
|
Package inmem implements a mutex-protected MDM store for tests and development. |
|
storagetest
Package storagetest defines the contract suites every MDM storage backend runs.
|
Package storagetest defines the contract suites every MDM storage backend runs. |
|
Package telemetry provides explicit OpenTelemetry configuration, bounded vocabularies and outbound HTTP measurement.
|
Package telemetry provides explicit OpenTelemetry configuration, bounded vocabularies and outbound HTTP measurement. |
|
telemetrytest
Package telemetrytest records OpenTelemetry measurements and spans for assertions.
|
Package telemetrytest records OpenTelemetry measurements and spans for assertions. |
|
Package testpki creates ephemeral certificate authorities and identities for tests and the device simulator.
|
Package testpki creates ephemeral certificate authorities and identities for tests and the device simulator. |
Click to show internal directories.
Click to hide internal directories.