ruby-macho 5.0.0 → 6.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 848be7615c0a26614ffc950ffd7a70b3efe594a4c2608aeb776d2f7a0fca472d
-  data.tar.gz: e8e084691a090ddd084196567ee80848b2cb546f9bff70ec9d43b8a8a45b0cef
+  metadata.gz: b0a72ccdc56030f0b2d9ed6fae89837685eea3397361c2fcb2c06d33409b79a7
+  data.tar.gz: f7a9a49865c6bb11b0edb6579d4fe8291b70a8077999ef3225d13cfde9d1180f
 SHA512:
-  metadata.gz: 2117ef6313e528a636b43b5c45c17729627cfae074957c6bfc7486040daf4c10b3f6ce74dc48a72a8375821f77de34d723c6c586eda27a5d0cc71d47a33cc42b
-  data.tar.gz: cc3a7f948e6d9f6ae71b7f0f96eef0945d5269c8e59ab09239a61ce8f8564c9faa8b4484940907dc6bb299435f54d9a1c5b89714c692b15a048b0c0c49f6f955
+  metadata.gz: c82c7a5b06136795d956510b48cc039a684d1782ac354f3c3ef49f6c2c1d904bf31cf18a7c93dc12244a8d5abbb81a0b232a867578a5e9f82efb34fefbec8d80
+  data.tar.gz: 3bbb1dfe665e7a6f2071cd41bfa094458a964b63bfd68d6d9976af1a1ad155875ff250048ff2d6a70e01c0258c711777471820581d57d0feade5b0299e812777

data/README.md

@@ -45,12 +45,25 @@ lc_vers = file[:LC_VERSION_MIN_MACOSX].first
 puts lc_vers.version_string # => "10.10.0"
 ```
 
+### Ad-hoc code signing
+
+Changing a Mach-O load command invalidates any existing code signature. This is
+especially important when Homebrew pours bottles on Apple Silicon, where native
+code must remain signed after its paths are rewritten. `MachO.codesign!` creates
+the required ad-hoc signature in Ruby instead of invoking `/usr/bin/codesign`:
+
+```ruby
+MachO.codesign!("/path/to/my/binary")
+```
+
+
 ### What works?
 
-* Reading data from x86/x86_64/PPC Mach-O files
+* Reading data from x86/x86_64/arm64/PPC Mach-O files (other architectures are unsupported, but may work)
 * Changing the IDs of Mach-O and Fat dylibs
 * Changing install names in Mach-O and Fat files
 * Adding, deleting, and modifying rpaths.
+* Parsing embedded code signatures and applying ad-hoc signatures in pure Ruby.
 
 ### What needs to be done?
 
@@ -73,6 +86,8 @@ overcommit --install
 * Constants were taken from Apple, Inc's
 [`loader.h` in `cctools/include/mach-o`](https://opensource.apple.com/source/cctools/cctools-973.0.1/include/mach-o/loader.h.auto.html).
 (Apple Public Source License 2.0).
+* Code-signing constants and structures follow Apple, Inc's
+[`cs_blobs.h` in XNU](https://github.com/apple-oss-distributions/xnu/blob/main/osfmk/kern/cs_blobs.h).
 * Binary files used for testing were taken from The LLVM Project. ([Apache License v2.0 with LLVM Exceptions](test/bin/llvm/LICENSE.txt)).
 
 ### License

data/lib/macho/code_signing.rb

@@ -0,0 +1,583 @@
+# frozen_string_literal: true
+
+require "digest/sha1"
+require "digest/sha2"
+
+module MachO
+  # Structures and helpers for embedded Mach-O code signatures.
+  module CodeSigning
+    CSMAGIC_REQUIREMENT = 0xfade0c00
+    CSMAGIC_REQUIREMENTS = 0xfade0c01
+    CSMAGIC_CODEDIRECTORY = 0xfade0c02
+    CSMAGIC_BLOBWRAPPER = 0xfade0b01
+    CSMAGIC_EMBEDDED_SIGNATURE = 0xfade0cc0
+    CSMAGIC_DETACHED_SIGNATURE = 0xfade0cc1
+    CSMAGIC_EMBEDDED_ENTITLEMENTS = 0xfade7171
+    CSMAGIC_EMBEDDED_DER_ENTITLEMENTS = 0xfade7172
+    CSMAGIC_EMBEDDED_LAUNCH_CONSTRAINT = 0xfade8181
+    CSMAGIC_ENTITLEMENT = CSMAGIC_EMBEDDED_ENTITLEMENTS
+    CSMAGIC_ENTITLEMENTDER = CSMAGIC_EMBEDDED_DER_ENTITLEMENTS
+
+    CS_MAGICS = {
+      CSMAGIC_REQUIREMENT => :CSMAGIC_REQUIREMENT,
+      CSMAGIC_REQUIREMENTS => :CSMAGIC_REQUIREMENTS,
+      CSMAGIC_CODEDIRECTORY => :CSMAGIC_CODEDIRECTORY,
+      CSMAGIC_BLOBWRAPPER => :CSMAGIC_BLOBWRAPPER,
+      CSMAGIC_EMBEDDED_SIGNATURE => :CSMAGIC_EMBEDDED_SIGNATURE,
+      CSMAGIC_DETACHED_SIGNATURE => :CSMAGIC_DETACHED_SIGNATURE,
+      CSMAGIC_EMBEDDED_ENTITLEMENTS => :CSMAGIC_EMBEDDED_ENTITLEMENTS,
+      CSMAGIC_EMBEDDED_DER_ENTITLEMENTS => :CSMAGIC_EMBEDDED_DER_ENTITLEMENTS,
+      CSMAGIC_EMBEDDED_LAUNCH_CONSTRAINT => :CSMAGIC_EMBEDDED_LAUNCH_CONSTRAINT,
+    }.freeze
+
+    CSSLOT_CODEDIRECTORY = 0
+    CSSLOT_INFOSLOT = 1
+    CSSLOT_REQUIREMENTS = 2
+    CSSLOT_ENTITLEMENTS = 5
+    CSSLOT_DER_ENTITLEMENTS = 7
+    CSSLOT_ALTERNATE_CODEDIRECTORIES = 0x1000
+    CSSLOT_SIGNATURESLOT = 0x10000
+
+    CS_HASHTYPE_SHA1 = 1
+    CS_HASHTYPE_SHA256 = 2
+    CS_HASHTYPE_SHA256_TRUNCATED = 3
+    CS_HASHTYPE_SHA384 = 4
+
+    CS_HASHTYPES = {
+      CS_HASHTYPE_SHA1 => :CS_HASHTYPE_SHA1,
+      CS_HASHTYPE_SHA256 => :CS_HASHTYPE_SHA256,
+      CS_HASHTYPE_SHA256_TRUNCATED => :CS_HASHTYPE_SHA256_TRUNCATED,
+      CS_HASHTYPE_SHA384 => :CS_HASHTYPE_SHA384,
+    }.freeze
+
+    CS_ADHOC = 0x2
+    CS_HARD = 0x100
+    CS_RUNTIME = 0x10000
+    CS_LINKER_SIGNED = 0x20000
+    CS_EXECSEG_MAIN_BINARY = 0x1
+    CS_EXECSEG_JIT = 0x40
+
+    CS_SUPPORTSCODELIMIT64 = 0x20300
+    CS_SUPPORTSEXECSEG = 0x20400
+    CS_SUPPORTSRUNTIME = 0x20500
+    CS_SUPPORTSLINKAGE = 0x20600
+
+    PAGE_SIZE = 4096
+    PRESERVED_COMPONENT_SLOTS = [
+      CSSLOT_REQUIREMENTS,
+      CSSLOT_ENTITLEMENTS,
+      CSSLOT_DER_ENTITLEMENTS,
+    ].freeze
+
+    HASHES = {
+      CS_HASHTYPE_SHA1 => [Digest::SHA1, 20],
+      CS_HASHTYPE_SHA256 => [Digest::SHA256, 32],
+    }.freeze
+
+    # An entry in a code-signing SuperBlob index.
+    BlobIndex = Struct.new(:type, :offset)
+
+    # A generic code-signing blob.
+    class Blob
+      # @return [Integer] the blob magic
+      attr_reader :magic
+
+      # @return [Integer] the complete blob length
+      attr_reader :length
+
+      # Parses the concrete blob type represented by `data`.
+      # @param data [String] raw blob data
+      # @return [Blob]
+      def self.parse(data)
+        raise CodeSigningError, "code-signing blob is truncated" if data.nil? || data.bytesize < 8
+
+        case data.unpack1("N")
+        when CSMAGIC_CODEDIRECTORY
+          CodeDirectory.new(data)
+        when CSMAGIC_EMBEDDED_SIGNATURE
+          SuperBlob.new(data)
+        else
+          new(data)
+        end
+      end
+
+      # @param data [String] raw blob data
+      def initialize(data)
+        raise CodeSigningError, "code-signing blob is truncated" if data.nil? || data.bytesize < 8
+
+        @magic, @length = data.unpack("N2")
+        raise CodeSigningError, "invalid code-signing blob length: #{length}" if length < 8 || length > data.bytesize
+
+        @raw_data = data.byteslice(0, length).freeze
+      end
+
+      # @return [String] raw blob data
+      def serialize
+        @raw_data
+      end
+
+      # @return [Symbol, nil] the symbolic blob magic
+      def magic_sym
+        CS_MAGICS[magic]
+      end
+
+      # @return [Hash] a hash representation of this blob
+      def to_h
+        {
+          "magic" => magic,
+          "magic_sym" => magic_sym,
+          "length" => length,
+        }
+      end
+    end
+
+    # An embedded-signature SuperBlob.
+    class SuperBlob < Blob
+      # @return [Integer] the number of indexed blobs
+      attr_reader :count
+
+      # @return [Array<BlobIndex>] the blob index
+      attr_reader :indices
+
+      # @return [Array<Blob>] the indexed blobs
+      attr_reader :blobs
+
+      # Builds a SuperBlob containing the given slot/blob pairs.
+      # @param entries [Hash<Integer, String>] blobs keyed by slot
+      # @return [String] serialised SuperBlob data
+      def self.build(entries)
+        entries = entries.sort_by(&:first)
+        offset = 12 + (entries.size * 8)
+        index = +"".b
+        payload = +"".b
+        entries.each do |type, blob|
+          index << [type, offset].pack("N2")
+          payload << blob
+          offset += blob.bytesize
+        end
+
+        [CSMAGIC_EMBEDDED_SIGNATURE, offset, entries.size].pack("N3") + index + payload
+      end
+
+      # @param data [String] raw SuperBlob data
+      def initialize(data)
+        super
+        raise CodeSigningError, "invalid embedded-signature magic: 0x#{magic.to_s(16)}" unless magic == CSMAGIC_EMBEDDED_SIGNATURE
+        raise CodeSigningError, "code-signing SuperBlob is truncated" if length < 12
+
+        @count = serialize.unpack1("N", :offset => 8)
+        raise CodeSigningError, "code-signing SuperBlob index is truncated" if 12 + (count * 8) > length
+
+        @indices = count.times.map do |index|
+          BlobIndex.new(*serialize.unpack("N2", :offset => 12 + (index * 8)))
+        end.freeze
+        @blobs = indices.map do |entry|
+          raise CodeSigningError, "code-signing blob offset is invalid: #{entry.offset}" if entry.offset < 12 + (count * 8) || entry.offset + 8 > length
+
+          Blob.parse(serialize.byteslice(entry.offset, length - entry.offset))
+        end.freeze
+      end
+
+      # Returns the blob stored in `type`, if present.
+      # @param type [Integer] the slot type
+      # @return [Blob, nil]
+      def blob(type)
+        index = indices.index { |entry| entry.type == type }
+        blobs[index] if index
+      end
+
+      # Yields every index entry.
+      # @yieldparam index [BlobIndex]
+      # @return [Enumerator, void]
+      def each_blob_index(&block)
+        return indices.each unless block
+
+        indices.each(&block)
+      end
+
+      # Yields every indexed blob.
+      # @yieldparam blob [Blob]
+      # @return [Enumerator, void]
+      def each_blob(&block)
+        return blobs.each unless block
+
+        blobs.each(&block)
+      end
+
+      # @return [Hash] a hash representation of this SuperBlob
+      def to_h
+        {
+          "count" => count,
+          "indices" => indices.map { |entry| { "type" => entry.type, "offset" => entry.offset } },
+          "blobs" => blobs.map(&:to_h),
+        }.merge super
+      end
+    end
+
+    # A CodeDirectory describing signed code pages and special components.
+    class CodeDirectory < Blob
+      attr_reader :version, :flags, :hash_offset, :ident_offset,
+                  :n_special_slots, :n_code_slots, :hash_size, :hash_type,
+                  :platform, :page_size, :scatter_offset, :team_offset,
+                  :code_limit64, :exec_seg_base, :exec_seg_limit,
+                  :exec_seg_flags, :runtime, :pre_encrypt_offset,
+                  :linkage_hash_type, :linkage_application_type,
+                  :linkage_application_subtype, :linkage_offset, :linkage_size
+
+      # Builds a CodeDirectory for `source`.
+      # @param source [String] bytes before the embedded signature
+      # @param identifier [String] the signing identifier
+      # @param hash_type [Integer] the hash algorithm
+      # @param flags [Integer] CodeDirectory flags
+      # @param special_slots [Hash<Integer, String>] special-slot contents
+      # @param exec_seg_base [Integer] executable segment offset
+      # @param exec_seg_limit [Integer] executable segment size
+      # @param exec_seg_flags [Integer] executable segment flags
+      # @param runtime [Integer] hardened runtime version
+      # @param hashes [Boolean] whether to calculate hashes
+      # @return [String] serialised CodeDirectory data
+      def self.build(source, identifier:, hash_type:, flags:, special_slots:,
+                     exec_seg_base:, exec_seg_limit:, exec_seg_flags:, runtime:, hashes: true)
+        digest, hash_size = HASHES.fetch(hash_type)
+        version = runtime.zero? ? CS_SUPPORTSEXECSEG : CS_SUPPORTSRUNTIME
+        fixed_size = runtime.zero? ? 88 : 96
+        identifier = "#{identifier.b.delete("\x00")}\x00".b
+        n_special_slots = special_slots.keys.max || 0
+        n_code_slots = (source.bytesize + PAGE_SIZE - 1) / PAGE_SIZE
+        hash_offset = fixed_size + identifier.bytesize + (n_special_slots * hash_size)
+        length = hash_offset + (n_code_slots * hash_size)
+        code_limit = [source.bytesize, 0xffffffff].min
+        code_limit64 = source.bytesize > 0xffffffff ? source.bytesize : 0
+
+        data = [CSMAGIC_CODEDIRECTORY, length, version, flags, hash_offset,
+                fixed_size, n_special_slots, n_code_slots, code_limit].pack("N9")
+        data << [hash_size, hash_type, 0, 12].pack("C4")
+        data << [0, 0, 0, 0].pack("N4")
+        data << [code_limit64, exec_seg_base, exec_seg_limit, exec_seg_flags].pack("Q>4")
+        data << [runtime, 0].pack("N2") unless runtime.zero?
+        data << identifier
+        if hashes
+          n_special_slots.downto(1) do |slot|
+            data << if special_slots.key?(slot)
+              digest.digest(special_slots.fetch(slot))
+            else
+              "\x00" * hash_size
+            end
+          end
+          0.step(source.bytesize - 1, PAGE_SIZE) do |offset|
+            data << digest.digest(source.byteslice(offset, PAGE_SIZE))
+          end
+        else
+          data << Utils.nullpad((n_special_slots + n_code_slots) * hash_size)
+        end
+        data
+      end
+
+      # @param data [String] raw CodeDirectory data
+      def initialize(data)
+        super
+        raise CodeSigningError, "invalid CodeDirectory magic: 0x#{magic.to_s(16)}" unless magic == CSMAGIC_CODEDIRECTORY
+        raise CodeSigningError, "CodeDirectory is truncated" if length < 44
+
+        _, _, @version, @flags, @hash_offset, @ident_offset,
+          @n_special_slots, @n_code_slots, @code_limit = serialize.unpack("N9")
+        @hash_size, @hash_type, @platform, @page_size = serialize.unpack("C4", :offset => 36)
+        fixed_size = 44
+        @scatter_offset = unpack_uint32(44) if version >= 0x20100
+        fixed_size = 48 if version >= 0x20100
+        @team_offset = unpack_uint32(48) if version >= 0x20200
+        fixed_size = 52 if version >= 0x20200
+        if version >= CS_SUPPORTSCODELIMIT64
+          raise CodeSigningError, "CodeDirectory is truncated" if length < 64
+
+          @code_limit64 = serialize.unpack1("Q>", :offset => 56)
+          fixed_size = 64
+        end
+        if version >= CS_SUPPORTSEXECSEG
+          raise CodeSigningError, "CodeDirectory is truncated" if length < 88
+
+          @exec_seg_base, @exec_seg_limit, @exec_seg_flags = serialize.unpack("Q>3", :offset => 64)
+          fixed_size = 88
+        end
+        if version >= CS_SUPPORTSRUNTIME
+          raise CodeSigningError, "CodeDirectory is truncated" if length < 96
+
+          @runtime, @pre_encrypt_offset = serialize.unpack("N2", :offset => 88)
+          fixed_size = 96
+        end
+        if version >= CS_SUPPORTSLINKAGE
+          raise CodeSigningError, "CodeDirectory is truncated" if length < 108
+
+          @linkage_hash_type, @linkage_application_type,
+            @linkage_application_subtype, @linkage_offset,
+            @linkage_size = serialize.unpack("CCnN2", :offset => 96)
+          fixed_size = 108
+        end
+        raise CodeSigningError, "CodeDirectory identifier offset is invalid" if ident_offset < fixed_size || ident_offset >= length
+
+        terminator = serialize.index("\x00", ident_offset)
+        raise CodeSigningError, "CodeDirectory identifier is unterminated" unless terminator && terminator < length
+        if hash_size.zero? ||
+           hash_offset < fixed_size ||
+           hash_offset - (n_special_slots * hash_size) < terminator + 1 ||
+           hash_offset + (n_code_slots * hash_size) > length
+          raise CodeSigningError, "CodeDirectory hash range is invalid"
+        end
+
+        @identifier = serialize.byteslice(ident_offset, terminator - ident_offset)
+      end
+
+      # @return [String] the signing identifier
+      attr_reader :identifier
+
+      # @return [Integer] the number of signed bytes
+      def code_limit
+        version >= CS_SUPPORTSCODELIMIT64 && code_limit64&.positive? ? code_limit64 : @code_limit
+      end
+
+      # Returns a code page hash.
+      # @param slot [Integer] a zero-based page slot
+      # @return [String, nil]
+      def code_hash(slot)
+        return if slot.negative? || slot >= n_code_slots
+
+        serialize.byteslice(hash_offset + (slot * hash_size), hash_size)
+      end
+
+      # @return [Symbol, nil] the symbolic hash type
+      def hash_type_sym
+        CS_HASHTYPES[hash_type]
+      end
+
+      # Returns a special-slot hash.
+      # @param slot [Integer] a positive special-slot number
+      # @return [String, nil]
+      def special_hash(slot)
+        return unless slot.positive? && slot <= n_special_slots
+
+        serialize.byteslice(hash_offset - (slot * hash_size), hash_size)
+      end
+
+      # @return [Hash] a hash representation of this CodeDirectory
+      def to_h
+        {
+          "version" => version,
+          "flags" => flags,
+          "identifier" => identifier,
+          "hash_offset" => hash_offset,
+          "n_special_slots" => n_special_slots,
+          "n_code_slots" => n_code_slots,
+          "code_limit" => code_limit,
+          "hash_size" => hash_size,
+          "hash_type" => hash_type,
+          "hash_type_sym" => hash_type_sym,
+          "page_size" => page_size,
+        }.merge super
+      end
+
+      private
+
+      def unpack_uint32(offset)
+        raise CodeSigningError, "CodeDirectory is truncated" if length < offset + 4
+
+        serialize.unpack1("N", :offset => offset)
+      end
+    end
+
+    # Generates and embeds an ad-hoc signature in one Mach-O slice.
+    class AdhocSigner
+      # @param macho [MachOFile] the slice to sign
+      # @param identifier [String] the signing identifier
+      def initialize(macho, identifier)
+        @macho = macho
+        @identifier = identifier
+      end
+
+      # Embeds a new signature.
+      # @return [void]
+      def sign!
+        signature_commands = @macho[:LC_CODE_SIGNATURE]
+        raise CodeSigningError, "Mach-O contains multiple LC_CODE_SIGNATURE commands" if signature_commands.size > 1
+
+        signature_command = signature_commands.first
+        metadata = metadata_from(signature_command)
+        remove_signature(signature_command) if signature_command&.datasize&.positive?
+        add_signature_command unless signature_command
+
+        signature_command = @macho[:LC_CODE_SIGNATURE].first
+        linkedit_segments = @macho.segments.select { |segment| segment.segname == "__LINKEDIT" }
+        raise CodeSigningError, "Mach-O must contain exactly one __LINKEDIT segment" unless linkedit_segments.one?
+
+        linkedit = linkedit_segments.first
+
+        @macho.serialize << Utils.nullpad(Utils.padding_for(@macho.serialize.bytesize, 16))
+        dataoff = @macho.serialize.bytesize
+        raise CodeSigningError, "code signature offset exceeds LC_CODE_SIGNATURE" if dataoff > 0xffffffff
+
+        entries = signature_entries(metadata, :hashes => false)
+        datasize = Utils.round(SuperBlob.build(entries).bytesize, 16)
+
+        update_linkedit_data_command(signature_command, dataoff, datasize)
+        update_linkedit_segment(linkedit, dataoff + datasize)
+
+        entries = signature_entries(metadata)
+        signature = SuperBlob.build(entries)
+        @macho.serialize << signature << Utils.nullpad(datasize - signature.bytesize)
+        @macho.populate_fields
+        nil
+      end
+
+      private
+
+      def metadata_from(signature_command)
+        return default_metadata unless signature_command&.datasize&.positive?
+
+        superblob = signature_command.superblob
+        code_directory = superblob.blobs.grep(CodeDirectory).find { |blob| blob.hash_type == CS_HASHTYPE_SHA256 } ||
+                         superblob.blobs.grep(CodeDirectory).first
+        return default_metadata unless code_directory
+        return default_metadata if code_directory.flags.anybits?(CS_LINKER_SIGNED)
+
+        components = PRESERVED_COMPONENT_SLOTS.to_h do |slot|
+          [slot, superblob.blob(slot)&.serialize]
+        end.compact
+        {
+          :components => components,
+          :exec_seg_flags => code_directory.exec_seg_flags.to_i,
+          :flags => (code_directory.flags & ~CS_LINKER_SIGNED) | CS_ADHOC,
+          :runtime => code_directory.runtime.to_i,
+        }
+      end
+
+      def default_metadata
+        {
+          :components => {},
+          :exec_seg_flags => 0,
+          :flags => CS_ADHOC,
+          :runtime => 0,
+        }
+      end
+
+      def remove_signature(signature_command)
+        end_offset = signature_command.dataoff + signature_command.datasize
+        trailing_data = @macho.serialize.byteslice(end_offset..).to_s
+        unless signature_command.dataoff <= @macho.serialize.bytesize &&
+               end_offset <= @macho.serialize.bytesize &&
+               trailing_data.bytesize <= 15 && trailing_data.bytes.all?(&:zero?)
+          raise CodeSigningError, "LC_CODE_SIGNATURE does not point to the end of the Mach-O"
+        end
+
+        @macho.serialize.slice!(signature_command.dataoff..)
+        @macho.populate_fields
+      end
+
+      def add_signature_command
+        @macho.add_command(LoadCommands::LoadCommand.create(:LC_CODE_SIGNATURE, 0, 0))
+      rescue ModificationError => e
+        raise CodeSigningError, e.message
+      end
+
+      def signature_entries(metadata, hashes: true)
+        components = metadata.fetch(:components).dup
+        components[CSSLOT_REQUIREMENTS] ||= [CSMAGIC_REQUIREMENTS, 12, 0].pack("N3")
+        special_slots = components.dup
+        if (info_plist = CodeSigning.info_plist(@macho))
+          special_slots[CSSLOT_INFOSLOT] = info_plist
+        end
+
+        text = @macho.segments.find { |segment| segment.segname == "__TEXT" }
+        exec_seg_flags = metadata.fetch(:exec_seg_flags)
+        if @macho.executable?
+          exec_seg_flags |= CS_EXECSEG_MAIN_BINARY
+        else
+          exec_seg_flags &= ~CS_EXECSEG_MAIN_BINARY
+        end
+        source = @macho.serialize
+        entries = {}
+        hash_types.each_with_index do |hash_type, index|
+          entries[index.zero? ? CSSLOT_CODEDIRECTORY : CSSLOT_ALTERNATE_CODEDIRECTORIES + index - 1] =
+            CodeDirectory.build(source,
+                                :identifier => @identifier,
+                                :hash_type => hash_type,
+                                :flags => metadata.fetch(:flags),
+                                :special_slots => special_slots,
+                                :exec_seg_base => text&.fileoff.to_i,
+                                :exec_seg_limit => text&.filesize.to_i,
+                                :exec_seg_flags => exec_seg_flags,
+                                :runtime => metadata.fetch(:runtime),
+                                :hashes => hashes)
+        end
+        components.each { |slot, blob| entries[slot] = blob }
+        entries[CSSLOT_SIGNATURESLOT] = [CSMAGIC_BLOBWRAPPER, 8].pack("N2")
+        entries
+      end
+
+      def hash_types
+        version = @macho[:LC_VERSION_MIN_MACOSX].first&.version
+        build_version = @macho[:LC_BUILD_VERSION].first
+        version ||= build_version.minos if build_version&.platform == 1
+        version && version < 0x000a0b04 ? [CS_HASHTYPE_SHA1, CS_HASHTYPE_SHA256] : [CS_HASHTYPE_SHA256]
+      end
+
+      def update_linkedit_data_command(command, dataoff, datasize)
+        format = Utils.specialize_format("L=", @macho.endianness)
+        @macho.serialize[command.view.offset + 8, 8] = [dataoff, datasize].pack(format * 2)
+      end
+
+      def update_linkedit_segment(segment, final_size)
+        filesize = final_size - segment.fileoff
+        raise CodeSigningError, "__LINKEDIT extends past the end of the Mach-O" if filesize.negative?
+        raise CodeSigningError, "__LINKEDIT exceeds its 32-bit filesize" if @macho.magic32? && filesize > 0xffffffff
+
+        if @macho.magic64?
+          format = Utils.specialize_format("Q=", @macho.endianness)
+          @macho.serialize[segment.view.offset + 48, 8] = [filesize].pack(format)
+          @macho.serialize[segment.view.offset + 32, 8] = [Utils.round(filesize, 2**@macho.segment_alignment)].pack(format) if filesize > segment.vmsize
+        else
+          format = Utils.specialize_format("L=", @macho.endianness)
+          @macho.serialize[segment.view.offset + 36, 4] = [filesize].pack(format)
+          @macho.serialize[segment.view.offset + 28, 4] = [Utils.round(filesize, 2**@macho.segment_alignment)].pack(format) if filesize > segment.vmsize
+        end
+      end
+    end
+
+    # Derives the identifier used by Apple's ad-hoc signer for a bare Mach-O.
+    # @param macho [MachOFile] a Mach-O slice
+    # @param filename [String, nil] its filename
+    # @return [String]
+    def self.identifier(macho, filename)
+      if (match = info_plist(macho)&.match(%r{<key>\s*CFBundleIdentifier\s*</key>\s*<string>\s*([^<]+?)\s*</string>}m))
+        return match[1]
+      end
+
+      filename = File.basename(filename || "adhoc")
+      filename = File.basename(filename, File.extname(filename))
+      return filename if filename.include?(".")
+
+      # Apple hex-encodes either "UUID" plus LC_UUID or, for legacy inputs,
+      # SHA-1 of the base Mach header and load-command region.
+      # https://github.com/apple-oss-distributions/Security/blob/db15acbe6a7f257a859ad9a3bb86097bfe0679d9/OSX/libsecurity_codesigning/lib/machorep.cpp#L232-L264
+      # https://github.com/apple-oss-distributions/Security/blob/db15acbe6a7f257a859ad9a3bb86097bfe0679d9/OSX/libsecurity_codesigning/lib/signer.cpp#L1025-L1047
+      uuid = macho[:LC_UUID].first
+      identity = if uuid
+        ("UUID".b + uuid.uuid.pack("C*")).unpack1("H*")
+      else
+        digest = Digest::SHA1.new
+        digest << macho.serialize.byteslice(0, Headers::MachHeader.bytesize)
+        digest << macho.serialize.byteslice(macho.header.class.bytesize, macho.sizeofcmds)
+        digest.hexdigest
+      end
+      "#{filename}-#{identity}"
+    end
+
+    # Returns an embedded Info.plist, if present.
+    # @param macho [MachOFile] a Mach-O slice
+    # @return [String, nil]
+    def self.info_plist(macho)
+      section = macho.segments.flat_map(&:sections).find do |candidate|
+        candidate.segname == "__TEXT" && candidate.sectname == "__info_plist"
+      end
+      macho.serialize.byteslice(section.offset, section.size) if section
+    end
+  end
+end

data/lib/macho/exceptions.rb

@@ -126,6 +126,14 @@ module MachO
     end
   end
 
+  # Raised when a load command has an invalid size.
+  class LoadCommandSizeError < NotAMachOError
+    # @param size [Integer] the invalid size
+    def initialize(size)
+      super("Invalid Mach-O load command size: #{size}")
+    end
+  end
+
   # Raised when a load command can't be created manually.
   class LoadCommandNotCreatableError < MachOError
     # @param cmd_sym [Symbol] the uncreatable load command's symbol

data/lib/macho/fat_file.rb

@@ -96,7 +96,12 @@ module MachO
 
       @filename = filename
       @options = opts
-      @raw_data = File.binread(@filename)
+      File.open(@filename, "rb") do |file|
+        @raw_data = file.read(Headers::FatHeader.bytesize)
+        @raw_data ||= ""
+        populate_fat_header
+        @raw_data << file.read.to_s
+      end
       populate_fields
     end
 
@@ -165,7 +170,7 @@ module MachO
     # All load commands responsible for loading dylibs in the file's Mach-O's.
     # @return [Array<LoadCommands::DylibCommand>] an array of DylibCommands
     def dylib_load_commands
-      machos.map(&:dylib_load_commands).flatten
+      machos.flat_map(&:dylib_load_commands)
     end
 
     # Changes the file's dylib ID to `new_id`. If the file is not a dylib,
@@ -199,7 +204,7 @@ module MachO
       # Individual architectures in a fat binary can link to different subsets
       # of libraries, but at this point we want to have the full picture, i.e.
       # the union of all libraries used by all architectures.
-      machos.map(&:linked_dylibs).flatten.uniq
+      machos.flat_map(&:linked_dylibs).uniq
     end
 
     # Changes all dependent shared library install names from `old_name` to
@@ -229,7 +234,7 @@ module MachO
     # @see MachOFile#rpaths
     def rpaths
       # Can individual architectures have different runtime paths?
-      machos.map(&:rpaths).flatten.uniq
+      machos.flat_map(&:rpaths).uniq
     end
 
     # Change the runtime path `old_path` to `new_path` in the file's Mach-Os.
@@ -283,6 +288,16 @@ module MachO
       repopulate_raw_machos
     end
 
+    # Replaces every embedded signature with a pure-Ruby ad-hoc signature.
+    # @param identifier [String, nil] the signing identifier
+    # @return [void]
+    def codesign!(identifier: nil)
+      identifier ||= CodeSigning.identifier(canonical_macho, filename)
+      machos.each { |macho| macho.codesign!(:identifier => identifier) }
+      repopulate_resized_raw_machos
+      nil
+    end
+
     # Extract a Mach-O with the given CPU type from the file.
     # @example
     #  file.extract(:i386) # => MachO::MachOFile
@@ -402,6 +417,37 @@ module MachO
       end
     end
 
+    # Rebuild the fat header and slice layout after internal Mach-Os change size.
+    # {#repopulate_raw_machos} assumes slice lengths are unchanged and writes at
+    # their recorded ranges. Signing appends data, so every architecture's size
+    # and each following aligned offset must be recalculated.
+    # @return [void]
+    # @api private
+    def repopulate_resized_raw_machos
+      fat_arch_class = Utils.fat_magic32?(header.magic) ? Headers::FatArch : Headers::FatArch64
+      header_size = Headers::FatHeader.bytesize + (fat_archs.size * fat_arch_class.bytesize)
+      header_data = @raw_data.byteslice(0, header_size)
+      slices = +"".b
+      offset = header_size
+
+      fat_archs.zip(machos).each_with_index do |(arch, macho), index|
+        macho_offset = Utils.round(offset, 2**arch.align)
+        slices << Utils.nullpad(macho_offset - offset) << macho.serialize
+        arch_offset = Headers::FatHeader.bytesize + (index * fat_arch_class.bytesize)
+        if fat_arch_class == Headers::FatArch
+          raise FatArchOffsetOverflowError, macho_offset if macho_offset > 0xffffffff
+
+          header_data[arch_offset + 8, 8] = [macho_offset, macho.serialize.bytesize].pack("N2")
+        else
+          header_data[arch_offset + 8, 16] = [macho_offset, macho.serialize.bytesize].pack("Q>2")
+        end
+        offset = macho_offset + macho.serialize.bytesize
+      end
+
+      @raw_data = header_data + slices
+      populate_fields
+    end
+
     # Yield each Mach-O object in the file, rescuing and accumulating errors.
     # @param options [Hash]
     # @option options [Boolean] :strict (true) whether or not to fail loudly

data/lib/macho/load_commands.rb

@@ -69,6 +69,7 @@ module MachO
       0x37 => :LC_FUNCTION_VARIANTS,
       0x38 => :LC_FUNCTION_VARIANT_FIXUPS,
       0x39 => :LC_TARGET_TRIPLE,
+      0x3a => :LC_LAZY_LOAD_DYLIB_INFO,
     }.freeze
 
     # association of symbol representations to load command constants
@@ -91,6 +92,7 @@ module MachO
       LC_ID_DYLIB
       LC_RPATH
       LC_LOAD_DYLINKER
+      LC_CODE_SIGNATURE
     ].freeze
 
     # association of load command symbols to string representations of classes
@@ -161,6 +163,7 @@ module MachO
       :LC_FUNCTION_VARIANTS => "LinkeditDataCommand",
       :LC_FUNCTION_VARIANT_FIXUPS => "LinkeditDataCommand",
       :LC_TARGET_TRIPLE => "TargetTripleCommand",
+      :LC_LAZY_LOAD_DYLIB_INFO => "LinkeditDataCommand",
     }.freeze
 
     # association of segment name symbols to names
@@ -330,6 +333,8 @@ module MachO
           view = lc.view
 
           if view
+            raise LCStrMalformedError, lc if lc_str < lc.class.bytesize || lc_str >= lc.cmdsize
+
             lc_str_abs = view.offset + lc_str
             lc_end = view.offset + lc.cmdsize - 1
             raw_string = view.raw_data.slice(lc_str_abs..lc_end)
@@ -1078,7 +1083,7 @@ module MachO
     # LC_SEGMENT_SPLIT_INFO, LC_FUNCTION_STARTS, LC_DATA_IN_CODE,
     # LC_DYLIB_CODE_SIGN_DRS, LC_LINKER_OPTIMIZATION_HINT, LC_DYLD_EXPORTS_TRIE,
     # LC_DYLD_CHAINED_FIXUPS, LC_ATOM_INFO, LC_FUNCTION_VARIANTS,
-    # or LC_FUNCTION_VARIANT_FIXUPS.
+    # LC_FUNCTION_VARIANT_FIXUPS, or LC_LAZY_LOAD_DYLIB_INFO.
     class LinkeditDataCommand < LoadCommand
       # @return [Integer] offset to the data in the __LINKEDIT segment
       field :dataoff, :uint32
@@ -1086,6 +1091,25 @@ module MachO
       # @return [Integer] size of the data in the __LINKEDIT segment
       field :datasize, :uint32
 
+      # @param context [SerializationContext] the context
+      # @return [String] the serialized fields of the load command
+      # @api private
+      def serialize(context)
+        raise LoadCommandNotSerializableError, type unless serializable?
+
+        format = Utils.specialize_format(self.class.format, context.endianness)
+        [cmd, self.class.bytesize, dataoff, datasize].pack(format)
+      end
+
+      # The embedded signature referenced by this command.
+      # @return [CodeSigning::SuperBlob]
+      # @raise [CodeSigningError] if this is not an LC_CODE_SIGNATURE command
+      def superblob
+        raise CodeSigningError, "#{type} does not contain a code signature" unless type == :LC_CODE_SIGNATURE
+
+        CodeSigning::SuperBlob.new(view.raw_data.byteslice(dataoff, datasize))
+      end
+
       # @return [Hash] a hash representation of this {LinkeditDataCommand}
       def to_h
         {

data/lib/macho/macho_file.rb

@@ -60,7 +60,12 @@ module MachO
 
       @filename = filename
       @options = opts
-      @raw_data = File.binread(@filename)
+      File.open(@filename, "rb") do |file|
+        @raw_data = file.read(Headers::MachHeader.bytesize)
+        @raw_data ||= ""
+        populate_mach_header if !opts.fetch(:decompress, false) || !Utils.compressed_magic?(@raw_data.unpack1("N"))
+        @raw_data << file.read.to_s
+      end
       populate_fields
     end
 
@@ -147,7 +152,7 @@ module MachO
     # @return [Array<LoadCommands::LoadCommand>] an array of load commands
     #  corresponding to `name`
     def command(name)
-      load_commands.select { |lc| lc.type == name.to_sym }
+      @load_commands_by_type.fetch(name.to_sym, []).dup
     end
 
     alias [] command
@@ -245,6 +250,7 @@ module MachO
     #  The exception to this rule is when methods like {#add_command} and
     #  {#delete_command} have been called with `repopulate = false`.
     def populate_fields
+      clear_memoization_cache
       @header = populate_mach_header
       @load_commands = populate_load_commands
     end
@@ -252,7 +258,8 @@ module MachO
     # All load commands responsible for loading dylibs.
     # @return [Array<LoadCommands::DylibCommand>] an array of DylibCommands
     def dylib_load_commands
-      load_commands.select { |lc| LoadCommands::DYLIB_LOAD_COMMANDS.include?(lc.type) }
+      @dylib_load_commands ||= load_commands.select { |lc| LoadCommands::DYLIB_LOAD_COMMANDS.include?(lc.type) }
+      @dylib_load_commands.dup
     end
 
     # All segment load commands in the Mach-O.
@@ -271,26 +278,7 @@ module MachO
     # @note This is **not** the same as {#alignment}!
     # @note See `get_align` and `get_align_64` in `cctools/misc/lipo.c`
     def segment_alignment
-      # special cases: 12 for x86/64/PPC/PP64, 14 for ARM/ARM64
-      return 12 if %i[i386 x86_64 ppc ppc64].include?(cputype)
-      return 14 if %i[arm arm64].include?(cputype)
-
-      cur_align = Sections::MAX_SECT_ALIGN
-
-      segments.each do |segment|
-        if filetype == :object
-          # start with the smallest alignment, and work our way up
-          align = magic32? ? 2 : 3
-          segment.sections.each do |section|
-            align = section.align unless section.align <= align
-          end
-        else
-          align = segment.guess_align
-        end
-        cur_align = align if align < cur_align
-      end
-
-      cur_align
+      @segment_alignment ||= calculate_segment_alignment
     end
 
     # The Mach-O's dylib ID, or `nil` if not a dylib.
@@ -338,7 +326,8 @@ module MachO
       # library, but at this point we're really only interested in a list of
       # unique libraries this Mach-O file links to, thus: `uniq`. (This is also
       # for consistency with `FatFile` that merges this list across all archs.)
-      dylib_load_commands.map(&:name).map(&:to_s).uniq
+      @linked_dylibs ||= dylib_load_commands.map { |lc| lc.name.to_s }.uniq
+      @linked_dylibs.dup
     end
 
     # Changes the shared library `old_name` to `new_name`
@@ -368,7 +357,8 @@ module MachO
     # All runtime paths searched by the dynamic linker for the Mach-O.
     # @return [Array<String>] an array of all runtime paths
     def rpaths
-      command(:LC_RPATH).map(&:path).map(&:to_s)
+      @rpaths ||= command(:LC_RPATH).map { |lc| lc.path.to_s }
+      @rpaths.dup
     end
 
     # Changes the runtime path `old_path` to `new_path`
@@ -448,6 +438,13 @@ module MachO
       rpath_cmds.reverse_each { |cmd| delete_command(cmd) }
     end
 
+    # Replaces the embedded signature with a pure-Ruby ad-hoc signature.
+    # @param identifier [String, nil] the signing identifier
+    # @return [void]
+    def codesign!(identifier: nil)
+      CodeSigning::AdhocSigner.new(self, identifier || CodeSigning.identifier(self, filename)).sign!
+    end
+
     # Write all Mach-O data to the given filename.
     # @param filename [String] the file to write to
     # @return [void]
@@ -475,6 +472,17 @@ module MachO
 
     private
 
+    # Clears all memoized values. Called when the file is repopulated.
+    # @return [void]
+    # @api private
+    def clear_memoization_cache
+      @linked_dylibs = nil
+      @rpaths = nil
+      @dylib_load_commands = nil
+      @load_commands_by_type = nil
+      @segment_alignment = nil
+    end
+
     # The file's Mach-O header structure.
     # @return [Headers::MachHeader] if the Mach-O is 32-bit
     # @return [Headers::MachHeader64] if the Mach-O is 64-bit
@@ -583,16 +591,27 @@ module MachO
 
     # All load commands in the file.
     # @return [Array<LoadCommands::LoadCommand>] an array of load commands
+    # @raise [TruncatedFileError] if the declared load command data is incomplete
     # @raise [LoadCommandError] if an unknown load command is encountered
+    # @raise [LoadCommandSizeError] if a load command's size is invalid
     # @api private
     def populate_load_commands
       permissive = options.fetch(:permissive, false)
       offset = header.class.bytesize
+      load_commands_end = offset + sizeofcmds
+      raise TruncatedFileError if load_commands_end > @raw_data.bytesize
+
       load_commands = []
+      @load_commands_by_type = Hash.new { |h, k| h[k] = [] }
 
       header.ncmds.times do
+        raise TruncatedFileError if offset + LoadCommands::LoadCommand.bytesize > load_commands_end
+
         fmt = Utils.specialize_format("L=", endianness)
         cmd = @raw_data.slice(offset, 4).unpack1(fmt)
+        cmdsize = @raw_data.slice(offset + 4, 4).unpack1(fmt)
+        raise LoadCommandSizeError, cmdsize if cmdsize % 4 != 0 || offset + cmdsize > load_commands_end
+
         cmd_sym = LoadCommands::LOAD_COMMANDS[cmd]
 
         raise LoadCommandError, cmd unless cmd_sym || permissive
@@ -605,16 +624,45 @@ module MachO
           LoadCommands::LoadCommand
         end
 
+        raise LoadCommandSizeError, cmdsize if cmdsize < klass.bytesize
+
         view = MachOView.new(self, @raw_data, endianness, offset)
         command = klass.new_from_bin(view)
 
         load_commands << command
+        @load_commands_by_type[command.type] << command
         offset += command.cmdsize
       end
 
       load_commands
     end
 
+    # Calculate the segment alignment for the Mach-O. Guesses conservatively.
+    # @return [Integer] the alignment, as a power of 2
+    # @api private
+    def calculate_segment_alignment
+      # special cases: 12 for x86/64/PPC/PP64, 14 for ARM/ARM64
+      return 12 if %i[i386 x86_64 ppc ppc64].include?(cputype)
+      return 14 if %i[arm arm64].include?(cputype)
+
+      cur_align = Sections::MAX_SECT_ALIGN
+
+      segments.each do |segment|
+        if filetype == :object
+          # start with the smallest alignment, and work our way up
+          align = magic32? ? 2 : 3
+          segment.sections.each do |section|
+            align = section.align unless section.align <= align
+          end
+        else
+          align = segment.guess_align
+        end
+        cur_align = align if align < cur_align
+      end
+
+      cur_align
+    end
+
     # The low file offset (offset to first section data).
     # @return [Integer] the offset
     # @api private
@@ -622,6 +670,9 @@ module MachO
       offset = @raw_data.size
 
       segments.each do |seg|
+        offset = seg.fileoff if seg.nsects.zero? && seg.fileoff.positive? &&
+                                seg.filesize.positive? && seg.fileoff < offset
+
         seg.sections.each do |sect|
           next if sect.empty?
           next if sect.type?(:S_ZEROFILL)

data/lib/macho.rb

@@ -1,11 +1,10 @@
 # frozen_string_literal: true
 
-require "open3"
-
 require_relative "macho/utils"
 require_relative "macho/structure"
 require_relative "macho/view"
 require_relative "macho/headers"
+require_relative "macho/code_signing"
 require_relative "macho/load_commands"
 require_relative "macho/sections"
 require_relative "macho/macho_file"
@@ -16,7 +15,7 @@ require_relative "macho/tools"
 # The primary namespace for ruby-macho.
 module MachO
   # release version
-  VERSION = "5.0.0"
+  VERSION = "6.0.0"
 
   # Opens the given filename as a MachOFile or FatFile, depending on its magic.
   # @param filename [String] the file being opened
@@ -42,20 +41,20 @@ module MachO
     file
   end
 
-  # Signs the dylib using an ad-hoc identity.
-  # Necessary after making any changes to a dylib, since otherwise
-  # changing a signed file invalidates its signature.
+  # Signs a thin or fat Mach-O using an ad-hoc identity.
+  # Necessary after changing signed Mach-O data because the signature covers
+  # the header, load commands and all bytes preceding the signature.
   # @param filename [String] the file being opened
   # @return [void]
-  # @raise [ModificationError] if the operation fails
+  # @raise [CodeSigningError] if the operation fails
   def self.codesign!(filename)
-    raise ArgumentError, "codesign binary is not available on Linux" if RUBY_PLATFORM !~ /darwin/
     raise ArgumentError, "#{filename}: no such file" unless File.file?(filename)
 
-    _, _, status = Open3.capture3("codesign", "--sign", "-", "--force",
-                                  "--preserve-metadata=entitlements,requirements,flags,runtime",
-                                  filename)
-
-    raise CodeSigningError, "#{filename}: signing failed!" unless status.success?
+    file = MachO.open(filename)
+    file.codesign!
+    file.write!
+    nil
+  rescue MachOError => e
+    raise CodeSigningError, "#{filename}: signing failed: #{e.message}"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby-macho
 version: !ruby/object:Gem::Version
-  version: 5.0.0
+  version: 6.0.0
 platform: ruby
 authors:
 - William Woodruff
@@ -19,6 +19,7 @@ files:
 - LICENSE
 - README.md
 - lib/macho.rb
+- lib/macho/code_signing.rb
 - lib/macho/exceptions.rb
 - lib/macho/fat_file.rb
 - lib/macho/headers.rb
@@ -49,7 +50,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.10
 specification_version: 4
 summary: ruby-macho - Mach-O file analyzer.
 test_files: []