Talk about understanding elements of code signing on iOS and OSX.
It shows different file formats and open standards used for signatures, and some common usage.
with ink on paper, a digital signature can be used to identify and authenticate the signer. However, a digital signature is more difficult to forge, and goes one step further: it can ensure that the signed data has not been altered. APPLE.COM
platforms Open source tools in combination with Apple's proprietary ones Relies on public-key cryptography based on the X.509 standard (like TLS/SSL) Keychain Access utility manages the X.509 infrastructure on OSX
/ certs on several Macs can be a problem Certificate you generate on one machine WILL NOT be usable for code signing on a machine that does not have that private key Forgetting this is a great way to waste hours and get angry
format for storing many cryptography objects as a single file Commonly used to bundle a private key with its X.509 certificate, or to bundle all the members of a chain of trust
account has a unique identifier You might have an enterprise and a production account with Apple: - Team Rocket = BHKW85A12H - Team Rocket (Ent) = A8WFE5231P
an app is allowed to use, and under what conditions. Each entitlement has a default value, which in most cases disables the capability associated with the entitlement.
together all these objects combine so that: - This unique app (App ID) - Can run on this restricted set of devices (UDIDs) - With a set of permssions (Entitlements) - With trust based on the signed Certificate.
is done, signing is performed All the individual components of the app are signed Signing all sorts of code, including tools, applications, scripts, libraries, plug-ins, ...
contain several different digital signatures If the code is universal, the object code for each slice (arch) is signed separately. This signature is stored within the binary file itself
the same set of hashes across the various blocks of code and data Public key from cert used to decrypt hashes -> original hashes If the two hashes match, the signature is valid
Lyft.app: valid on disk Lyft.app: satisfies its Designated Requirement $ echo "wat" >> Lyft.app/yolo # adding a random file $ codesign -vvv --verify Lyft.app Lyft.app: a sealed resource is missing or invalid file added: /Users/marinusalj/Downloads/Payload/ Lyft.app/yolo
Lyft.app: valid on disk Lyft.app: satisfies its Designated Requirement $ echo "wat" >> Lyft.app/yolo # adding a random file $ codesign -vvvv Lyft.app Lyft.app: a sealed resource is missing or invalid file added: /Users/marinusalj/Downloads/Payload/ Lyft.app/yolo
Lyft.app: valid on disk Lyft.app: satisfies its Designated Requirement $ echo "wat" >> Lyft.app/yolo # adding a random file $ codesign -vvvv Lyft.app Lyft.app: a sealed resource is missing or invalid file added: /Users/marinusalj/Downloads/Payload/ Lyft.app/yolo
xcodebuild phones home Unpack .p12 yourself on CI instead of relying on developer.apple.com Try debugging systematically step by step instead of brute forcing
supermarin
signer
nandenjin
asial_edu
gmoriki
yasulab
crebowinfo
levii
psj59129
zakiwarfel
destraynor
jacobian
cromwellryan
kneath
jmmastey
keathley
shpigford
tanoku
zenorocha
chrisshort
jonrohan
