Apple Codesign 0.24.0

Release Info

• Documentation
• Known issues and limitations
• Debugging and bug filing instructions

Changelog

• Add a macho-universal-create command to assemble single-arch Mach-O
  binaries into a single multi-arch / universal / fat binary. The command
  can be used as a replacement for Apple's lipo -create.
• When signing bundles, the CodeResources file for nested Mach-O binaries
  now emits the code directory hashes for every code directory. Before, if
  a Mach-O contained both SHA-1 and SHA-256 code directories, only the
  SHA-256 hash would be emitted. The new behavior matches Apple's tooling.
  (#95)
• The generate-self-signed-certificate command has gained the --p12-file
  and --p12-password arguments to write a self-signed certificate to a
  PKCS#12 / p12 / PFX file.
• The generate-self-signed-certificate command now supports generating
  RSA certificates. RSA certificates are now the default, to match what
  Apple uses by default.
• Reworked how code requirements expressions are automatically derived.
  This should result in self-signed certificates having correct requirements
  expressions that no longer imply they were signed by Apple's CAs. In
  addition, some Apple signing certificates should now opt into using a
  more appropriate code requirements expression than before. This may have
  fixed validation errors with some signatures. (#99)
• Team name is no longer included in signature when signing with a non
  Apple signed certificate. This matches the behavior of Apple's tools. (#101)
• Fixed a bug where the AnchorCertificateHash code requirements expression
  was being incorrectly formatted as anchor <slot> H"<hash>" instead of
  certificate <slot> = H"<hash>".
• Added awareness of new Apple CA certificates:
  Apple Application Integration CA 7 - G1 Certificate,
  Worldwide Developer Relations - G7, and Worldwide Developer Relations - G8.
• print-signature-info now prints some integer values as strings containing
  both the integer and hex forms. Additional fields are added to help debug
  signature writing.
• Conflicting binary identifiers within a universal Mach-O are now reconciled
  to the initially seen value. This matches the behavior of Apple's tooling
  and fixes a bug where drift between the values could cause bundle validation
  to fail. (#103)
• Fixed a bug where bundle signing would fail to overwrite preexisting state
  in Mach-O binaries, leading to failed signature verification. This likely
  only occurred when attempting to re-sign already signed binaries. (#104)
• When signing bundles, non Mach-O resources files are no longer fully buffered
  in memory to compute their content digests. This can drastically cut down
  on memory usage when signing large resources files. Mach-O binaries are
  still fully buffered in memory. (#45)
• Removed verify warning about insecure code digests. The warning was spurious
  and didn't take into account the nuanced logic for emitting SHA-1 digests.
  (#50)
• cryptographic-message-syntax 0.25 -> 0.26.
• x509-certificate 0.22 -> 0.23.