Repository navigation
feat(identity): Firmar con un certificado del Almacén de macOS - #2033
Merged
Merged
Conversation
added 2 commits
October 19, 2026 16:14
Implements #2005: Firmar con un certificado del Almacén de macOS - Rust resume y `SecKeyCreateSignature` firma el resumen: PKCS#1 v1.5, PSS y ECDSA en DER, con SHA-1 como rama explícita de la tabla de algoritmos. - Los errores de Security.framework, CryptoTokenKit y PC/SC se traducen por dominio y código.
…agent/developer/issue-2005
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2005
What changed
MacosTokenfirma con el llavero: busca la identidad por la huella SHA-1 de la referencia, Rust calcula el resumen (ecdsa::digest) ySecKeyCreateSignaturelo firma con el algoritmo Digest de Security.framework: PKCS#1 v1.5, PSS (sal del tamaño del resumen) y ECDSA X9.62, que ya sale en DER. SHA-1 tiene su rama explícita en la tablaover_a_digest.offerscomprueba la clase de clave del certificado frente al algoritmo, como en CNG.situation_of(domain, code)traduce por dominio delCFError:errSecUserCanceledyTKErrorCodeCanceledByUser→ cancelación;errSecAuthFailed,TKErrorCodeAuthenticationFailedySCARD_W_WRONG_CHV→ PIN incorrecto;SCARD_W_CHV_BLOCKED→ PIN bloqueado;TKErrorCodeTokenNotFound,SCARD_E_NO_SMARTCARDySCARD_W_REMOVED_CARD→ tarjeta retirada;errSecItemNotFoundyTKErrorCodeObjectNotFound→ certificado no encontrado.TKErrorCodeAuthenticationFailedsaldrá como PIN incorrecto. Lo confirmarán las sondas con tarjeta real.Test plan
signs_with_rsa_pkcs1_and_pss_through_the_keychain_with_every_hash_sha1_included, vista en rojosigns_with_ecdsa_through_the_keychain_in_der_with_every_hash_sha1_included, vista en rojoa_keychain_key_offers_only_the_algorithms_of_its_kind, vista en rojoa_certificate_gone_from_the_keychain_is_not_found_when_signing, vista en rojodenying_the_macos_dialog_is_the_person_cancelling,system_errors_map_to_their_situations, vistas en rojojust check-rust(clippy) no ha corrido en local: el pre-push no lo disparó; el veredicto es del carril de macOS del CI.