autopkg/autopkg — pull request #92 by hjuutilainen (2014-05-21 06:27:28+00:00)
Title: Code signature verification

I'd like to start a discussion about verifying downloaded item code signature. This pull request includes a new processor (CodeSignatureVerifier) that verifies app bundle or installer package signatures (with codesign or pkgutil) and optionally verifies certificate name chain.

The processor always verifies the signature by using builtin system tools and raises if this fails. After the verification we can optionally get the certificate name chain and compare that to an expected value. I still haven't decided whether this name check is a good idea or not or if it provides any real security but here's my reasoning so far: I intentionally chose to verify names (instead of hashes etc.) since at this point we already have a properly signed item which is trusted by system. The situation that someone could create certs with the same name chain and get your computer to trust them is really far fetched. But the situation where a download could be intercepted and replaced by another properly signed binary is not. Thoughts?

Example usages in a recipe:
```

Processor
CodeSignatureVerifier
Arguments

input_path
%RECIPE_CACHE_DIR%/%NAME%/1Password 4.app

```
```

Processor
CodeSignatureVerifier
Arguments

input_path
%RECIPE_CACHE_DIR%/%NAME%/1Password 4.app
expected_authority_names

Developer ID Application: Agilebits Inc.
Developer ID Certification Authority
Apple Root CA

```

A successful run outputs:
```
CodeSignatureVerifier
CodeSignatureVerifier: Verifying application bundle signature...
CodeSignatureVerifier: ...autopkg-cache/io.github.hjuutilainen.munki.1Password/1Password/1Password 4.app: valid on disk
CodeSignatureVerifier: ...autopkg-cache/io.github.hjuutilainen.munki.1Password/1Password/1Password 4.app: satisfies its Designated Requirement
CodeSignatureVerifier: Signature is valid
CodeSignatureVerifier: Authority name chain is valid
```

A failed run outputs:
```
CodeSignatureVerifier
CodeSignatureVerifier: Verifying application bundle signature...
CodeSignatureVerifier: ...autopkg-cache/io.github.hjuutilainen.munki.Subler/Subler/Subler.app: code object is not signed at all
CodeSignatureVerifier: In architecture: i386
Code signature verification failed
Failed.
Receipt written to ...autopkg-cache/io.github.hjuutilainen.munki.Subler/receipts/Subler.munki-receipt-20140521-092107.plist

The following recipes failed:
Subler.munki.recipe
Error in io.github.hjuutilainen.munki.Subler: Processor: CodeSignatureVerifier: Error: Code signature verification failed
```

And a failed name check outputs:
```
CodeSignatureVerifier
CodeSignatureVerifier: Verifying application bundle signature...
CodeSignatureVerifier: ...autopkg-cache/io.github.hjuutilainen.munki.1Password/1Password/1Password 4.app: valid on disk
CodeSignatureVerifier: ...autopkg-cache/io.github.hjuutilainen.munki.1Password/1Password/1Password 4.app: satisfies its Designated Requirement
CodeSignatureVerifier: Signature is valid
CodeSignatureVerifier: Mismatch in authority names
CodeSignatureVerifier: Expected: Developer ID Application: Some random company. -> Developer ID Certification Authority -> Apple Root CA
CodeSignatureVerifier: Found: Developer ID Application: Agilebits Inc. -> Developer ID Certification Authority -> Apple Root CA
Mismatch in authority names
Failed.
Receipt written to ...autopkg-cache/io.github.hjuutilainen.munki.1Password/receipts/1Password.munki-receipt-20140521-082813.plist

The following recipes failed:
1Password.munki.recipe
Error in io.github.hjuutilainen.munki.1Password: Processor: CodeSignatureVerifier: Error: Mismatch in authority names
```