This repository has been archived by the owner on Oct 30, 2023. It is now read-only.
forked from electron/electron
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: use stricter options in SecStaticCodeCheckValidity (electron#33368)
* fix: use stricter options in SecStaticCodeCheckValidity * Update patches/squirrel.mac/fix_use_kseccschecknestedcode_kseccsstrictvalidate_in_the_sec.patch Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org> Co-authored-by: John Kleinschmidt <jkleinsc@electronjs.org>
- Loading branch information
Showing
3 changed files
with
153 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,2 +1,3 @@ | ||
build_add_gn_config.patch | ||
fix_ensure_that_self_is_retained_until_the_racsignal_is_complete.patch | ||
fix_use_kseccschecknestedcode_kseccsstrictvalidate_in_the_sec.patch |
21 changes: 21 additions & 0 deletions
21
patches/squirrel.mac/fix_use_kseccschecknestedcode_kseccsstrictvalidate_in_the_sec.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,21 @@ | ||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 | ||
From: Samuel Attard <samuel.r.attard@gmail.com> | ||
Date: Mon, 21 Mar 2022 15:14:19 -0700 | ||
Subject: fix: use kSecCSCheckNestedCode | kSecCSStrictValidate in the Sec | ||
validate call | ||
|
||
This ensures that Squirrel.Mac validates the nested bundles (nested Frameworks) including the incoming Squirrel.Mac framework. | ||
|
||
diff --git a/Squirrel/SQRLCodeSignature.m b/Squirrel/SQRLCodeSignature.m | ||
index f8754dbd6a1490d2b50f1014e2daa5c1f71b2103..2f5e27c1ae5c5bd514abe33d4cd42c4724656c07 100644 | ||
--- a/Squirrel/SQRLCodeSignature.m | ||
+++ b/Squirrel/SQRLCodeSignature.m | ||
@@ -124,7 +124,7 @@ - (RACSignal *)verifyBundleAtURL:(NSURL *)bundleURL { | ||
} | ||
|
||
CFErrorRef validityError = NULL; | ||
- result = SecStaticCodeCheckValidityWithErrors(staticCode, kSecCSCheckAllArchitectures, (__bridge SecRequirementRef)self.requirement, &validityError); | ||
+ result = SecStaticCodeCheckValidityWithErrors(staticCode, kSecCSCheckNestedCode | kSecCSStrictValidate | kSecCSCheckAllArchitectures, (__bridge SecRequirementRef)self.requirement, &validityError); | ||
@onExit { | ||
if (validityError != NULL) CFRelease(validityError); | ||
}; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters