Documentation
¶
Overview ¶
Package codesign inspects the code signature and embedded entitlements of on-disk Mach-O binaries and app bundles via the Security framework's SecStaticCode APIs, including verification of embedded sandboxed helper tools.
Index ¶
- Variables
- func EmbeddedHelperToolPath(appBundlePath, toolName string) string
- func EntitlementValueAtPath(path, key string) (any, error)
- func EntitlementsFromPath(path string) (map[string]any, error)
- func ExpectedHelperToolIdentifier(appBundleIdentifier, toolName string) string
- func HasEntitlementAtPath(path, key string) (bool, error)
- func IsHelperToolAtPath(path string) (bool, error)
- func IsSandboxedAtPath(path string) (bool, error)
- func SigningIdentifierAtPath(path string) (string, error)
- func VerifySandboxedAppWithHelper(appBundlePath, toolName string) (app Verification, helper HelperToolVerification, err error)
- type HelperToolVerification
- type Verification
Constants ¶
This section is empty.
Variables ¶
var IncompatibleWithInheritEntitlements = []string{ entitlements.GetTaskAllow, }
IncompatibleWithInheritEntitlements lists entitlements that must not appear on helper tools signed with com.apple.security.inherit.
var RequiredHelperToolEntitlements = []string{ entitlements.AppSandbox, entitlements.Inherit, }
RequiredHelperToolEntitlements are the only entitlements Apple recommends for embedded sandbox helper tools.
Functions ¶
func EmbeddedHelperToolPath ¶
EmbeddedHelperToolPath returns the recommended helper tool location inside an app bundle: Contents/MacOS/<toolName>.
func EntitlementValueAtPath ¶
EntitlementValueAtPath returns one embedded entitlement value from path.
func EntitlementsFromPath ¶
EntitlementsFromPath reads the embedded entitlements dictionary from a signed binary.
func ExpectedHelperToolIdentifier ¶
ExpectedHelperToolIdentifier returns the conventional code-signing identifier for a helper tool embedded in appBundleIdentifier.
func HasEntitlementAtPath ¶
HasEntitlementAtPath reports whether path's code signature includes a Boolean entitlement. A missing entitlement returns (false, nil).
func IsHelperToolAtPath ¶
IsHelperToolAtPath reports whether path is signed as a sandbox-inheriting helper.
func IsSandboxedAtPath ¶
IsSandboxedAtPath reports whether path's code signature includes App Sandbox. A missing entitlement returns (false, nil).
func SigningIdentifierAtPath ¶
SigningIdentifierAtPath returns the code signing identifier for path.
func VerifySandboxedAppWithHelper ¶
func VerifySandboxedAppWithHelper(appBundlePath, toolName string) (app Verification, helper HelperToolVerification, err error)
VerifySandboxedAppWithHelper validates a sandboxed app bundle and one embedded helper.
Types ¶
type HelperToolVerification ¶
type HelperToolVerification struct {
Path string
SigningIdentifier string
Sandboxed bool
InheritsSandbox bool
Entitlements map[string]any
ExtraEntitlements []string
IncompatiblePresent []string
Issues []string
}
HelperToolVerification reports whether an embedded helper tool meets Apple's sandbox inheritance signing requirements.
func ValidateHelperToolEntitlements ¶
func ValidateHelperToolEntitlements(ents map[string]any) HelperToolVerification
ValidateHelperToolEntitlements evaluates entitlements against Apple's embedded helper tool guidance without reading code signatures from disk.
func VerifyEmbeddedHelperTool ¶
func VerifyEmbeddedHelperTool(appBundlePath, toolName string) (HelperToolVerification, error)
VerifyEmbeddedHelperTool validates a helper tool embedded in appBundlePath.
func VerifyHelperToolAtPath ¶
func VerifyHelperToolAtPath(path string) (HelperToolVerification, error)
VerifyHelperToolAtPath validates helper tool entitlements at path.
func (HelperToolVerification) Valid ¶
func (verification HelperToolVerification) Valid() bool
Valid reports whether the helper tool satisfies Apple's minimum requirements.
type Verification ¶
Verification summarizes App Sandbox state read from a signed binary.
func VerifyAtPath ¶
func VerifyAtPath(path string) (Verification, error)
VerifyAtPath reads signing entitlements and derives sandbox status from path.
Source Files