7 ms·

XAR signing is effectively just an RFC 5652 CMS signature plus some minimal data structure manipulation. Code at https://github.com/indygreg/PyOxidizer/blob/faa

XAR signing is effectively just an RFC 5652 CMS signature plus some minimal data structure manipulation. Code at https://github.com/indygreg/PyOxidizer/blob/faa7dfcea5d66bf50e985d7c5626971d5549ae62/apple-xar/src/signing.rs https://github.com/indygreg/PyOxidizer/blob/faa7dfcea5d66bf5.... Mach-O and bundles, by contrast, require a myriad of additional data structures requiring thousands of lines of code to support. To my knowledge, nobody else has implemented signing of these far-more-complicated primitives. (Existing Mach-O signing solutions just do ad-hoc signing and/or don't handle Mach-O in the context of a bundle.)

ckatri 4y ago
> Existing Mach-O signing solutions just do ad-hoc signing and/or don't handle Mach-O in the context of a bundle. I can assure you that saurik's ldid[0] does. Or the updated fork that I maintain at ProcursusTeam/ldid[1]. You can use -K to sign with a cert. You can find full documentation in the manpage[2]. [0] http://git.saurik.com/ldid.git http://git.saurik.com/ldid.git [1] https://github.com/ProcursusTeam/ldid https://github.com/ProcursusTeam/ldid [2] https://man.cameronkatri.com/ldid/ldid.1 https://man.cameronkatri.com/ldid/ldid.1