Function

SecStaticCodeCheckValidity

Validates a static code object.

Declaration

OSStatus SecStaticCodeCheckValidity(SecStaticCodeRef staticCode, SecCSFlags flags, SecRequirementRef requirement);

Parameters

staticCode

The static code object to be validated.

flags

Optional flags; see Static Code Validation Flags for possible values. Use kSecCSCheckAllArchitectures to validate all slices of a universal binary.

requirement

A code requirement specifying additional conditions the code must satisfy to be considered valid. Specify NULL if you don’t want to impose any additional requirements. Use the SecRequirementCreateWithString or SecRequirementCreateWithStringAndErrors function to create a code requirement object. See Code Signing Guide for a discussion of code requirements.

Return Value

Discussion

This function obtains and verifies the signature on the code specified by the code object. It checks the validity of all sealed components, including resources (if any). It validates the code against a code requirement if one is specified. The call succeeds if all these conditions are satisfactory.

This call is only secure if the code is not subject to concurrent modification, and the outcome is only valid as long as the code remains unmodified. If the underlying file system has dynamic characteristics, such as a network file system, union mount, or FUSE, you must consider how secure the code is from modification after validation.

When checking a universal binary, be sure to include the kSecCSCheckAllArchitectures flag. Otherwise the method verifies only one slice of the binary, potentially indicating success without testing all the slices.

See Also

Code Signature Validity

SecCodeCheckValidity

Performs dynamic validation of signed code.

SecCodeCheckValidityWithErrors

Performs dynamic validation of signed code and returns detailed error information in the case of failure.

SecStaticCodeCheckValidityWithErrors

Performs static validation of static signed code and returns detailed error information in the case of failure.

Static Code Validation Flags

Use these supplemental flags to test the validity of a static code signature.