search

indygreg / apple-platform-rs

Rust crates supporting Apple platform development
588 stars 49 forks source link

`rcodesign verify` complains about SHA-1 digests too aggressively #50

Closed VladRassokhin closed 12 months ago

VladRassokhin commented 1 year ago

I'm using rcodesign from apple-codesign-0.20.0-x86_64-apple-darwin.tar.gz

$ ./rcodesign verify rcodesign
insecure digest algorithm used in code directory: Sha1
Error: problems reported during verification

Meanwhile executable has both Sha1 and Sha256.

codesign -dvvv rcodesign
Executable=.../rcodesign
Identifier=rcodesign
Format=Mach-O thin (x86_64)
CodeDirectory v=20500 size=159573 flags=0x10000(runtime) hashes=4981+2 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha1=47332de323d9bed5128aa8b54e2d0e93a0945149
CandidateCDHashFull sha1=47332de323d9bed5128aa8b54e2d0e93a0945149
CandidateCDHash sha256=64b59ac235a217a6f192e294f32bac949a39ff8c
CandidateCDHashFull sha256=64b59ac235a217a6f192e294f32bac949a39ff8cd7f396643d450073681b509a
Hash choices=sha1,sha256
CMSDigest=9af4f134feff5ccd1fe1f3c6741b2b6b6c4eedf39b61b9149ca9fa7eefc019e1
CMSDigestType=2
CDHash=64b59ac235a217a6f192e294f32bac949a39ff8c
Signature size=9123
Authority=Developer ID Application: Gregory Szorc (MK22MZP987)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=2 Oct 2022, 21:45:48
Info.plist=not bound
TeamIdentifier=MK22MZP987
Runtime Version=12.1.0
Sealed Resources=none
Internal requirements count=1 size=172

Seems macho.code_signature() returns ony first signature? My knowledge of rust is subtle. Probably verify_macho should check both code directories and not complain if one of them is using good enough algorithm (sha256).

indygreg commented 1 year ago

The verification code in apple-codesign has drifted out of sync with the signing code and is lacking compliance with Apple's implementations in a number of areas. I've actually been tempted to delete the code because I question the value of having code with so many bugs that can likely never be bug compliant with Apple's tooling.