| # Copyright 2019 The Chromium Authors |
| # Use of this source code is governed by a BSD-style license that can be |
| # found in the LICENSE file. |
| """Signing Model Objects |
| |
| This module contains classes that encapsulate data about the signing process. |
| """ |
| |
| import enum |
| import os.path |
| import re |
| import string |
| |
| from signing import commands |
| |
| |
| def _get_unexpired_identities(): |
| """Returns a set of the SHA-1 hashes of unexpired code signing identities |
| |
| Raises: |
| ValueError: If no unexpired code signing identities are found. |
| """ |
| # Avoid -v because it filters out self-signed certificates. |
| command = ['security', 'find-identity', '-p', 'codesigning'] |
| output = commands.run_command_output(command) |
| |
| matches = re.finditer( |
| rb'\d+\) (?P<id>[0-9A-Fa-f]{40}) "[^"]+"( \((?P<error>[^\)]+)\))?', |
| output, |
| flags=re.MULTILINE, |
| ) |
| |
| identities = set() |
| for match in matches: |
| # Exclude expired certificates. Other errors are ignored. |
| if match.group('error') == b'CSSMERR_TP_CERT_EXPIRED': |
| continue |
| |
| identities.add(match.group('id')) |
| |
| if not identities: |
| raise ValueError('No code signing identities found') |
| |
| return identities |
| |
| |
| def _get_identity_hash(identity): |
| """Returns a string of the SHA-1 hash of a specified keychain identity. |
| |
| Args: |
| identity: A string specifying the identity. |
| |
| Returns: |
| A string with the hash, with a-f in lower case. |
| |
| Raises: |
| ValueError: If the identity cannot be found. |
| """ |
| if len(identity) == 40 and all(ch in string.hexdigits for ch in identity): |
| return identity.lower() |
| |
| unexpired_identities = _get_unexpired_identities() |
| |
| command = ['security', 'find-certificate', '-a', '-c', identity, '-Z'] |
| output = commands.run_command_output(command) |
| |
| hashes = re.findall( |
| b'^SHA-1 hash: ([0-9A-Fa-f]{40})$', output, flags=re.MULTILINE |
| ) |
| if not hashes: |
| raise ValueError('Cannot find identity', identity) |
| |
| valid_hashes = [h for h in hashes if h in unexpired_identities] |
| if not valid_hashes: |
| raise ValueError('Identity found, but expired', identity) |
| |
| return valid_hashes[0].decode('utf-8').lower() |
| |
| |
| class CodeSignedProduct(object): |
| """Represents a build product that will be signed with `codesign(1)`.""" |
| |
| def __init__( |
| self, |
| path, |
| identifier, |
| options=None, |
| requirements=None, |
| identifier_requirement=True, |
| sign_with_identifier=False, |
| entitlements=None, |
| verify_options=None, |
| ): |
| """A build product to be codesigned. |
| |
| Args: |
| path: The path to the product to be signed. This is relative to a |
| work directory containing the build products. |
| identifier: The unique identifier set when code signing. This is |
| only explicitly passed with the `--identifier` flag if |
| |sign_with_identifier| is True. |
| options: |CodeSignOptions| flags to pass to `codesign --options`. |
| requirements: String for additional `--requirements` to pass to the |
| `codesign` command. These are joined with a space to the |
| |config.CodeSignConfig.codesign_requirements_basic| string. See |
| |CodeSignedProduct.requirements_string()| for details. |
| identifier_requirement: If True, a designated identifier requirement |
| based on |identifier| will be inserted into the requirements |
| string. If False, then no designated requirement will be |
| generated based on the identifier. |
| sign_with_identifier: If True, then the identifier will be specified |
| when running the `codesign` command. If False, `codesign` will |
| infer the identifier itself. |
| entitlements: File name of the entitlements file to sign the product |
| with. The file should reside in the |Paths.packaging_dir|. |
| verify_options: |VerifyOptions| flags to pass to `codesign |
| --verify`. |
| """ |
| self.path = path |
| self.identifier = identifier |
| if options and not isinstance(options, CodeSignOptions): |
| raise ValueError('Must be a CodeSignOptions') |
| self.options = options |
| self.requirements = requirements |
| self.identifier_requirement = identifier_requirement |
| self.sign_with_identifier = sign_with_identifier |
| self.entitlements = entitlements |
| if verify_options and not isinstance(verify_options, VerifyOptions): |
| raise ValueError('Must be a VerifyOptions') |
| self.verify_options = verify_options |
| |
| def requirements_string(self, config): |
| """Produces a full requirements string for the product. |
| |
| Args: |
| config: A |config.CodeSignConfig| object. |
| |
| Returns: |
| A string for designated requirements of the product, which can be |
| passed to `codesign --requirements`. |
| """ |
| # If the signing identity indicates ad-hoc (i.e. no real signing |
| # identity), do not enforce any requirements. Ad hoc signing will append |
| # a hash to the identifier, which would violate the |
| # identifier_requirement and most other requirements that would be |
| # specified. |
| # |
| # Similarly, if no explicit requirements are available, let codesign |
| # --sign use its defaults, which should be appropriate in any case where |
| # requirement customization is unnecessary. |
| if config.identity == '-' or ( |
| not self.requirements and not config.codesign_requirements_basic |
| ): |
| return '' |
| |
| reqs = [] |
| if self.identifier_requirement: |
| reqs.append( |
| 'designated => identifier "{identifier}"'.format( |
| identifier=self.identifier |
| ) |
| ) |
| if self.requirements: |
| reqs.append(self.requirements) |
| if config.codesign_requirements_basic: |
| reqs.append(config.codesign_requirements_basic) |
| return ' '.join(reqs) |
| |
| def __repr__(self): |
| return ( |
| 'CodeSignedProduct(identifier={0.identifier}, ' |
| 'options={0.options}, path={0.path})'.format(self) |
| ) |
| |
| |
| class VerifyOptions(enum.Flag): |
| """Enum for the options that can be specified when validating the results of |
| code signing. |
| |
| These options are passed to `codesign --verify` after the |
| |CodeSignedProduct| has been signed. |
| """ |
| |
| DEEP = enum.auto() |
| STRICT = enum.auto() |
| NO_STRICT = enum.auto() |
| IGNORE_RESOURCES = enum.auto() |
| |
| def to_list(self): |
| result = [] |
| values = { |
| self.DEEP: '--deep', |
| self.STRICT: '--strict', |
| self.NO_STRICT: '--no-strict', |
| self.IGNORE_RESOURCES: '--ignore-resources', |
| } |
| |
| for key, value in values.items(): |
| if key & self: |
| result.append(value) |
| |
| return sorted(result) |
| |
| |
| class CodeSignOptions(enum.Flag): |
| """Enum for the options that can be specified when signing the code. |
| |
| These options are passed to `codesign --sign --options`. |
| """ |
| |
| RESTRICT = enum.auto() |
| LIBRARY_VALIDATION = enum.auto() |
| HARDENED_RUNTIME = enum.auto() |
| KILL = enum.auto() |
| # Specify the components of HARDENED_RUNTIME that are also available on |
| # older macOS versions. |
| FULL_HARDENED_RUNTIME_OPTIONS = ( |
| RESTRICT | LIBRARY_VALIDATION | HARDENED_RUNTIME | KILL |
| ) |
| |
| def to_comma_delimited_string(self): |
| result = [] |
| values = { |
| self.RESTRICT: 'restrict', |
| self.LIBRARY_VALIDATION: 'library', |
| self.HARDENED_RUNTIME: 'runtime', |
| self.KILL: 'kill', |
| } |
| |
| for key, value in values.items(): |
| if key & self: |
| result.append(value) |
| |
| return ','.join(sorted(result)) |
| |
| |
| class NotarizeAndStapleLevel(enum.Enum): |
| """An enum specifying the level of notarization and stapling to do. |
| |
| `NONE` means no notarization tasks should be performed. |
| |
| `WAIT_NOSTAPLE` means to submit the signed application and packaging to |
| Apple for notarization, and wait for a reply, but not to staple the |
| resulting notarization ticket. |
| |
| `STAPLE` means to submit the signed application and packaging to Apple for |
| notarization, wait for a reply, and staple the resulting notarization |
| ticket. |
| """ |
| |
| NONE = 0 |
| WAIT_NOSTAPLE = 1 |
| STAPLE = 2 |
| |
| def should_notarize(self): |
| return self.value > self.NONE.value |
| |
| def should_staple(self): |
| return self.value > self.WAIT_NOSTAPLE.value |
| |
| def __str__(self): |
| return self.name.lower().replace('_', '-') |
| |
| @classmethod |
| def from_string(cls, str): |
| try: |
| return cls[str.upper().replace('-', '_')] |
| except KeyError: |
| raise ValueError(f'Invalid NotarizeAndStapleLevel: {str}') |
| |
| |
| class Distribution(object): |
| """A Distribution represents a final, signed, and potentially channel- |
| customized Chrome product. |
| |
| Channel customization refers to modifying parts of the app bundle structure |
| to have different file names, internal identifiers, and assets. |
| """ |
| |
| def __init__( |
| self, |
| channel=None, |
| branding_code=None, |
| app_name_fragment=None, |
| packaging_name_fragment=None, |
| product_dirname=None, |
| creator_code=None, |
| channel_customize=False, |
| package_as_dmg=True, |
| package_as_pkg=False, |
| package_as_zip=False, |
| inflation_kilobytes=0, |
| direct_launch_scheme=None, |
| ): |
| """Creates a new Distribution object. All arguments are optional. |
| |
| Args: |
| channel: The release channel for the product. |
| branding_code: A branding code helps track how users acquired the |
| product from various marketing channels. |
| app_name_fragment: If present, this string fragment is appended to |
| the |config.CodeSignConfig.app_product|. This renames the binary |
| and outer app bundle. |
| packaging_name_fragment: If present, this is appended to the |
| |config.CodeSignConfig.packaging_basename| to help differentiate |
| different |branding_code|s. |
| product_dirname: If present, this string value is set in the app's |
| Info.plist with the key "CrProductDirName". This key influences |
| the browser's default user-data-dir location. |
| creator_code: If present, this will set a new macOS creator code |
| in the Info.plist "CFBundleSignature" key and in the PkgInfo |
| file. If this is not specified, the original values from the |
| build products will be kept. |
| channel_customize: If True, then the product will be modified in |
| several ways: |
| - The |channel| will be appended to the |
| |config.CodeSignConfig.base_bundle_id|. |
| - The product will be renamed with |app_name_fragment|. |
| - Different assets will be used for icons in the app. |
| package_as_dmg: If True, then a .dmg file will be created containing |
| the product. |
| package_as_pkg: If True, then a .pkg file will be created containing |
| the product. |
| package_as_zip: If True, then a .zip file will be created containing |
| the product. |
| inflation_kilobytes: If non-zero, a blob of this size will be |
| inserted into the DMG. Incompatible with package_as_pkg = True. |
| direct_launch_scheme: The URL scheme that launches this specific |
| product (e.g. "google-chrome"). If None, the scheme will be |
| removed from the Info.plist if present. |
| """ |
| if channel_customize: |
| # Side-by-side channels must have a distinct names and creator |
| # codes, as well as keep their user data in separate locations. |
| assert channel |
| assert app_name_fragment |
| assert product_dirname |
| assert creator_code |
| |
| self.channel = channel |
| self.branding_code = branding_code |
| self.app_name_fragment = app_name_fragment |
| self.packaging_name_fragment = packaging_name_fragment |
| self.product_dirname = product_dirname |
| self.creator_code = creator_code |
| self.channel_customize = channel_customize |
| self.package_as_zip = package_as_zip |
| self.package_as_dmg = package_as_dmg |
| self.package_as_pkg = package_as_pkg |
| self.inflation_kilobytes = inflation_kilobytes |
| self.direct_launch_scheme = direct_launch_scheme |
| |
| # inflation_kilobytes are only inserted into DMGs |
| assert not self.inflation_kilobytes or self.package_as_dmg |
| |
| def brandless_copy(self): |
| """Derives and returns a copy of this Distribution object, identical |
| except for not having a branding code. |
| |
| This is useful in the case where a non-branded app bundle needs to be |
| created with otherwise the same configuration. |
| """ |
| return Distribution( |
| self.channel, |
| None, |
| self.app_name_fragment, |
| self.packaging_name_fragment, |
| self.product_dirname, |
| self.creator_code, |
| self.channel_customize, |
| self.package_as_dmg, |
| self.package_as_pkg, |
| self.package_as_zip, |
| self.inflation_kilobytes, |
| self.direct_launch_scheme, |
| ) |
| |
| def to_config(self, base_config): |
| """Produces a derived |config.CodeSignConfig| for the Distribution. |
| |
| Args: |
| base_config: The base CodeSignConfig to derive. |
| |
| Returns: |
| A new CodeSignConfig instance that uses information in the |
| Distribution to alter various properties of the |base_config|. |
| """ |
| this = self |
| |
| class DistributionCodeSignConfig(base_config.__class__): |
| @property |
| def base_config(self): |
| return base_config |
| |
| @property |
| def distribution(self): |
| return this |
| |
| @property |
| def app_product(self): |
| if this.channel_customize: |
| return '{} {}'.format( |
| base_config.app_product, this.app_name_fragment |
| ) |
| return base_config.app_product |
| |
| @property |
| def base_bundle_id(self): |
| base_bundle_id = base_config.base_bundle_id |
| if this.channel_customize: |
| return base_bundle_id + '.' + this.channel |
| return base_bundle_id |
| |
| @property |
| def provisioning_profile_basename(self): |
| profile_basename = base_config.provisioning_profile_basename |
| if not profile_basename: |
| return profile_basename |
| |
| if this.channel_customize: |
| profile_basename = '{}_{}'.format( |
| profile_basename, this.app_name_fragment |
| ) |
| if base_config.identity: |
| profile_basename = '{}.{}'.format( |
| profile_basename, |
| _get_identity_hash(base_config.identity), |
| ) |
| |
| return profile_basename |
| |
| @property |
| def packaging_basename(self): |
| if this.packaging_name_fragment: |
| return '{}-{}-{}'.format( |
| self.app_product.replace(' ', ''), |
| self.version, |
| this.packaging_name_fragment, |
| ) |
| return super( |
| DistributionCodeSignConfig, self |
| ).packaging_basename |
| |
| return DistributionCodeSignConfig( |
| **pick( |
| base_config, |
| ( |
| 'invoker', |
| 'identity', |
| 'installer_identity', |
| 'codesign_requirements_basic', |
| ), |
| ) |
| ) |
| |
| |
| class Paths(object): |
| """Paths holds the three file path contexts for signing operations. |
| |
| The input directory always remains un-modified. |
| The output directory is where final, signed products are stored. |
| The work directory is set by internal operations. |
| """ |
| |
| def __init__(self, input, output, work): |
| self._input = os.path.abspath(input) |
| self._output = os.path.abspath(output) |
| self._work = work |
| if self._work: |
| self._work = os.path.abspath(self._work) |
| |
| @property |
| def input(self): |
| return self._input |
| |
| @property |
| def output(self): |
| return self._output |
| |
| @property |
| def work(self): |
| return self._work |
| |
| def packaging_dir(self, config): |
| """Returns the path to the product packaging directory, which contains |
| scripts and assets used in signing. |
| |
| Args: |
| config: The |config.CodeSignConfig| object. |
| |
| Returns: |
| Path to the packaging directory. |
| """ |
| return os.path.join(self.input, '{} Packaging'.format(config.product)) |
| |
| def replace_work(self, new_work): |
| """Creates a new Paths with the same input and output directories, but |
| with |work| set to |new_work|.""" |
| return Paths(self.input, self.output, new_work) |
| |
| def __eq__(self, other): |
| if not isinstance(other, self.__class__): |
| return False |
| return ( |
| self._input == other._input |
| and self._output == other._output |
| and self._work == other._work |
| ) |
| |
| def __repr__(self): |
| return ( |
| 'Paths(input={0.input}, output={0.output}, work={0.work})'.format( |
| self |
| ) |
| ) |
| |
| |
| def pick(o, keys): |
| """Returns a dictionary with the values of |o| from the keys specified |
| in |keys|. |
| |
| Args: |
| o: object or dictionary, An object to take values from. |
| keys: list of string, Keys to pick from |o|. |
| |
| Returns: |
| A new dictionary with keys from |keys| and values from |o|. Keys not |
| in |o| will be omitted. |
| """ |
| d = {} |
| iterable = hasattr(o, '__getitem__') |
| for k in keys: |
| if hasattr(o, k): |
| d[k] = getattr(o, k) |
| elif iterable and k in o: |
| d[k] = o[k] |
| return d |
