I'm using rcodesign from apple-codesign-0.20.0-x86_64-apple-darwin.tar.gz
$ ./rcodesign verify rcodesign
insecure digest algorithm used in code directory: Sha1
Error: problems reported during verification
Meanwhile executable has both Sha1 and Sha256.
codesign -dvvv rcodesign
Executable=.../rcodesign
Identifier=rcodesign
Format=Mach-O thin (x86_64)
CodeDirectory v=20500 size=159573 flags=0x10000(runtime) hashes=4981+2 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha1=47332de323d9bed5128aa8b54e2d0e93a0945149
CandidateCDHashFull sha1=47332de323d9bed5128aa8b54e2d0e93a0945149
CandidateCDHash sha256=64b59ac235a217a6f192e294f32bac949a39ff8c
CandidateCDHashFull sha256=64b59ac235a217a6f192e294f32bac949a39ff8cd7f396643d450073681b509a
Hash choices=sha1,sha256
CMSDigest=9af4f134feff5ccd1fe1f3c6741b2b6b6c4eedf39b61b9149ca9fa7eefc019e1
CMSDigestType=2
CDHash=64b59ac235a217a6f192e294f32bac949a39ff8c
Signature size=9123
Authority=Developer ID Application: Gregory Szorc (MK22MZP987)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=2 Oct 2022, 21:45:48
Info.plist=not bound
TeamIdentifier=MK22MZP987
Runtime Version=12.1.0
Sealed Resources=none
Internal requirements count=1 size=172
Seems macho.code_signature() returns ony first signature? My knowledge of rust is subtle.
Probably verify_macho should check both code directories and not complain if one of them is using good enough algorithm (sha256).
I'm using
rcodesignfromapple-codesign-0.20.0-x86_64-apple-darwin.tar.gzMeanwhile executable has both Sha1 and Sha256.
Seems
macho.code_signature()returns ony first signature? My knowledge of rust is subtle.Probably
verify_machoshould check both code directories and not complain if one of them is using good enough algorithm (sha256).