Security tvOS xcode27.3 b1

#Security.framework

diff -ruN /Applications/Xcode_27.2.0.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/SDKs/AppleTVOS.sdk/System/Library/Frameworks/Security.framework/Headers/SecPolicy.h /Applications/Xcode_27.3.0-beta1.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/SDKs/AppleTVOS.sdk/System/Library/Frameworks/Security.framework/Headers/SecPolicy.h
--- /Applications/Xcode_27.2.0.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/SDKs/AppleTVOS.sdk/System/Library/Frameworks/Security.framework/Headers/SecPolicy.h	2026-10-08 06:13:38
+++ /Applications/Xcode_27.3.0-beta1.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/SDKs/AppleTVOS.sdk/System/Library/Frameworks/Security.framework/Headers/SecPolicy.h	2026-11-04 09:32:02
@@ -105,6 +105,8 @@
     API_AVAILABLE(macos(15.4), ios(18.4), watchos(11.4), tvos(18.4));
 extern const CFStringRef kSecPolicyAppleIPSecClient
     API_AVAILABLE(macos(15.4), ios(18.4), watchos(11.4), tvos(18.4));
+extern const CFStringRef kSecPolicyAppleQWACTLSBinding
+    SPI_AVAILABLE(anyappleos(27.3));
 
 
 /*!
@@ -195,6 +197,25 @@
  */
 SecPolicyRef SecPolicyCreateSSL(Boolean server, CFStringRef __nullable hostname)
     __OSX_AVAILABLE_STARTING(__MAC_10_6, __IPHONE_2_0);
+
+/*!
+ @function SecPolicyCreateQWACTLSBinding
+ @abstract Returns a policy object for verifying an EU 2-QWAC certificate (a QWAC
+ issued for TLS certificate binding).
+ @discussion Builds on the Basic X.509 policy: it checks validity, that the leaf
+ is issued for TLS certificate binding (the id-kp-tls-binding EKU and the
+ qualified certificate statements of ETSI TS 119 411-5), and that the chain
+ terminates at a QWAC-constrained EU Trusted List anchor. It validates the
+ certificate profile only; the binding to the TLS certificate is performed by
+ SecTrustCreateAndVerifyQWACTLSBinding (see <Security/SecQWACTLSBinding.h>).
+ @param hostname The policy will require the specified hostname to match the SAN
+ list in the leaf certificate.
+ @result A policy object. The caller is responsible for calling CFRelease on
+ this when it is no longer needed.
+ */
+__nullable CF_RETURNS_RETAINED
+SecPolicyRef SecPolicyCreateQWACTLSBinding(CFStringRef hostname)
+    SPI_AVAILABLE(anyappleos(27.3));
 
 /*!
      @enum Revocation Policy Constants
diff -ruN /Applications/Xcode_27.2.0.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/SDKs/AppleTVOS.sdk/System/Library/Frameworks/Security.framework/Headers/SecQWACTLSBinding.h /Applications/Xcode_27.3.0-beta1.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/SDKs/AppleTVOS.sdk/System/Library/Frameworks/Security.framework/Headers/SecQWACTLSBinding.h
--- /Applications/Xcode_27.2.0.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/SDKs/AppleTVOS.sdk/System/Library/Frameworks/Security.framework/Headers/SecQWACTLSBinding.h	1970-01-01 01:00:00
+++ /Applications/Xcode_27.3.0-beta1.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/SDKs/AppleTVOS.sdk/System/Library/Frameworks/Security.framework/Headers/SecQWACTLSBinding.h	2026-11-04 09:32:02
@@ -0,0 +1,144 @@
+/*
+ * Copyright (c) 2026 Apple Inc. All Rights Reserved.
+ *
+ * @APPLE_LICENSE_HEADER_START@
+ *
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ *
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * @APPLE_LICENSE_HEADER_END@
+ */
+
+/*!
+     @header SecQWACTLSBinding
+     The functions provided in SecQWACTLSBinding.h validate an EU 2-QWAC TLS
+     certificate binding: a qualified web authentication certificate delivered
+     out of band over HTTP and cryptographically bound to the TLS certificate
+     of a connection by a JAdES signature (ETSI TS 119 411-5). Unlike a 1-QWAC,
+     the 2-QWAC is not the TLS certificate; it is an additive credential that
+     never substitutes for standard TLS trust evaluation.
+ */
+
+#ifndef _SECURITY_SECQWACTLSBINDING_H_
+#define _SECURITY_SECQWACTLSBINDING_H_
+
+#include <CoreFoundation/CFBase.h>
+#include <CoreFoundation/CFData.h>
+#include <CoreFoundation/CFError.h>
+#include <Security/SecBase.h>
+#include <Security/SecTrust.h>
+
+__BEGIN_DECLS
+
+CF_ASSUME_NONNULL_BEGIN
+CF_IMPLICIT_BRIDGING_ENABLED
+
+/*!
+ @const kSecQWACTLSBindingErrorDomain
+ @abstract The CFError domain for errors returned by
+ SecTrustCreateAndVerifyQWACTLSBinding.
+ @discussion Errors in this domain carry a code from SecQWACTLSBindingError.
+ Where a failure originates below this layer, the underlying error is available
+ in the user info dictionary under kCFErrorUnderlyingErrorKey: in particular a
+ kSecQWACTLSBindingErrorCertificate carries the trust evaluation's own error,
+ which identifies the certificate at fault.
+ */
+extern const CFStringRef kSecQWACTLSBindingErrorDomain
+    API_AVAILABLE(anyappleos(27.3));
+
+/*!
+ @enum SecQWACTLSBindingError
+ @abstract Codes in kSecQWACTLSBindingErrorDomain, describing why a 2-QWAC TLS
+ certificate binding was rejected.
+ @constant kSecQWACTLSBindingErrorUnavailable Qualified web authentication
+ certificate validation is not enabled on this device. No validation was
+ attempted.
+ @constant kSecQWACTLSBindingErrorMalformed The binding could not be parsed as
+ the JWS Compact Serialization that ETSI TS 119 411-5 Annex B requires.
+ @constant kSecQWACTLSBindingErrorProfile The binding parsed but does not
+ conform to the Annex B profile, for example a wrong content type, a signed
+ detached-content descriptor that is absent or not marked critical, or an
+ unsupported digest algorithm.
+ @constant kSecQWACTLSBindingErrorSignature The JAdES signature over the binding
+ did not verify against the public key of the 2-QWAC.
+ @constant kSecQWACTLSBindingErrorCertificate The 2-QWAC certificate chain
+ carried by the binding did not validate. The underlying error describes the
+ trust failure.
+ @constant kSecQWACTLSBindingErrorNotBound The binding is well formed and
+ correctly signed by a valid 2-QWAC, but does not commit to the TLS certificate
+ of the connection that was passed in. The binding belongs to some other
+ connection.
+ @constant kSecQWACTLSBindingErrorExpired The binding is outside its validity
+ window, or is older than the maximum age accepted for a binding.
+ */
+typedef CF_ENUM(CFIndex, SecQWACTLSBindingError) {
+    kSecQWACTLSBindingErrorUnavailable  = 1,
+    kSecQWACTLSBindingErrorMalformed    = 2,
+    kSecQWACTLSBindingErrorProfile      = 3,
+    kSecQWACTLSBindingErrorSignature    = 4,
+    kSecQWACTLSBindingErrorCertificate  = 5,
+    kSecQWACTLSBindingErrorNotBound     = 6,
+    kSecQWACTLSBindingErrorExpired      = 7,
+};
+
+/*!
+ @function SecTrustCreateAndVerifyQWACTLSBinding
+ @abstract Validates a 2-QWAC TLS certificate binding against an established TLS
+ connection, and returns an evaluated trust object for the 2-QWAC.
+ @param bindingData The binding resource fetched from the server, a JWS Compact
+ Serialization carrying a JAdES signature (ETSI TS 119 411-5 Annex B).
+ @param tlsTrust The already-evaluated trust object for the TLS connection the
+ binding is claimed to bind to. The connection must have passed standard TLS
+ trust evaluation on its own before calling this function.
+ @param error On failure, set to an error describing why the binding was
+ rejected. Binding failures use kSecQWACTLSBindingErrorDomain with a
+ SecQWACTLSBindingError code; invalid arguments are reported as errSecParam in
+ kCFErrorDomainOSStatus. The caller is responsible for releasing it.
+ @result On success, returns an evaluated trust object for the 2-QWAC chain
+ taken from the binding's x5c header parameter. The caller is responsible for
+ calling CFRelease on a non-NULL return value when it is no longer needed. If
+ validating the binding or the 2-QWAC certificate chain fails, returns NULL.
+ @discussion Verifies the JAdES signature over the binding using the public key
+ of the 2-QWAC, evaluates the 2-QWAC chain with SecPolicyCreateQWACTLSBinding,
+ and checks the binding values required by ETSI TS 119 411-5 Annex B, including
+ that the TLS leaf certificate of tlsTrust appears in the signed list of bound
+ certificates. The 2-QWAC is additive: it never affects TLS trust, and success
+ requires both a valid TLS connection and a valid 2-QWAC.
+
+ A successful result describes the binding at the time of the call, and is not
+ recorded on either trust object.
+
+ This call does not access the network. ETSI TS 119 411-5 Annex B requires the
+ binding to carry the full 2-QWAC chain in its x5c header parameter, up to an
+ issuer on the EU Trusted List, and those issuers are already in the trust store,
+ so nothing needs to be fetched to build the chain. Network fetching is disabled
+ on the 2-QWAC trust before it is evaluated: a binding whose x5c is incomplete is
+ malformed and is rejected rather than completed from the network. Evaluation is
+ therefore bounded, and does not follow URLs taken from attacker-supplied
+ certificates.
+ */
+__nullable CF_RETURNS_RETAINED
+SecTrustRef SecTrustCreateAndVerifyQWACTLSBinding(
+    CFDataRef bindingData,
+    SecTrustRef tlsTrust,
+    CFErrorRef * _Nullable CF_RETURNS_RETAINED error)
+    API_AVAILABLE(anyappleos(27.3));
+
+CF_IMPLICIT_BRIDGING_DISABLED
+CF_ASSUME_NONNULL_END
+
+__END_DECLS
+
+#endif /* _SECURITY_SECQWACTLSBINDING_H_ */
diff -ruN /Applications/Xcode_27.2.0.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/SDKs/AppleTVOS.sdk/System/Library/Frameworks/Security.framework/Headers/Security.h /Applications/Xcode_27.3.0-beta1.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/SDKs/AppleTVOS.sdk/System/Library/Frameworks/Security.framework/Headers/Security.h
--- /Applications/Xcode_27.2.0.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/SDKs/AppleTVOS.sdk/System/Library/Frameworks/Security.framework/Headers/Security.h	2026-10-08 06:15:22
+++ /Applications/Xcode_27.3.0-beta1.app/Contents/Developer/Platforms/AppleTVOS.platform/Developer/SDKs/AppleTVOS.sdk/System/Library/Frameworks/Security.framework/Headers/Security.h	2026-11-04 09:32:02
@@ -31,6 +31,7 @@
 #include <Security/SecItem.h>
 #include <Security/SecKey.h>
 #include <Security/SecPolicy.h>
+#include <Security/SecQWACTLSBinding.h>
 #include <Security/SecRandom.h>
 #include <Security/SecImportExport.h>
 #include <Security/SecTrust.h>