I looked at open source of StaticCode API in security framework. It looks like the flags kSecCSConsiderExpiration and kSecCodeSignatureForceExpiration are both considered for expiration check.
void SecStaticCode::validateDirectory()
{
...
mValidationExpired = verifySignature();
...
#if TARGET_OS_OSX
if (mValidationResult == errSecSuccess) {
if (mValidationExpired)
if ((mValidationFlags & kSecCSConsiderExpiration)
|| (codeDirectory()->flags & kSecCodeSignatureForceExpiration))
MacOSError::throwMe(CSSMERR_TP_CERT_EXPIRED);
} else
MacOSError::throwMe(mValidationResult);
#endif
}
bool SecStaticCode::verifySignature()
{
...
MacOSError::check(SecTrustGetCssmResultCode(mTrust, &result));
// if we have a valid timestamp, CMS validates against (that) signing time and all is well.
// If we don't have one, may validate against *now*, and must be able to tolerate expiration.
if (mSigningTimestamp == 0) { // no timestamp available
if (((result == CSSMERR_TP_CERT_EXPIRED) || (result == CSSMERR_TP_CERT_NOT_VALID_YET))
&& !(actionData.ActionFlags & CSSM_TP_ACTION_ALLOW_EXPIRED)) {
CODESIGN_EVAL_STATIC_SIGNATURE_EXPIRED(this);
actionData.ActionFlags |= CSSM_TP_ACTION_ALLOW_EXPIRED; // (this also allows postdated certs)
continue; // retry validation while tolerating expiration
}
}
Security::Syslog::error("SecStaticCode: verification failed (trust result %d, error %d)", trustResult, (int)result);
MacOSError::throwMe(result);
....
return actionData.ActionFlags & CSSM_TP_ACTION_ALLOW_EXPIRED;
}
I am not sure if I use the API SecStaticCodeCheckValidity correctly. Does it require specific SecRequirementRef for expiration checking?
