From cb6365759fd97db1933c2e4fce3387c5c936e7e4 Mon Sep 17 00:00:00 2001 From: Alexander DiBenedetto Date: Thu, 22 Oct 2026 16:06:13 -0500 Subject: [PATCH 1/2] Skip files deleted from the working tree in lint.sh --- scripts/lint.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/scripts/lint.sh b/scripts/lint.sh index cbdc88f8..1fa51d88 100755 --- a/scripts/lint.sh +++ b/scripts/lint.sh @@ -14,8 +14,10 @@ esac # depot_tools ships clang-format and swift-format wrappers that shadow Homebrew's. PATH="/opt/homebrew/bin:$PATH" -swift_files() { git ls-files -z --cached --others --exclude-standard -- '*.swift'; } -objc_files() { git ls-files -z --cached --others --exclude-standard -- '*.h' '*.m' ':!TrustKit/Dependencies'; } +# --cached still lists files deleted from the working tree but not yet staged. +existing() { while IFS= read -r -d '' f; do if [[ -e "$f" ]]; then printf '%s\0' "$f"; fi; done; } +swift_files() { git ls-files -z --cached --others --exclude-standard -- '*.swift' | existing; } +objc_files() { git ls-files -z --cached --others --exclude-standard -- '*.h' '*.m' ':!TrustKit/Dependencies' | existing; } if ! $CHECK; then swift_files | xargs -0 xcrun swift format --in-place --parallel From af4d2b549c9f718fe48e3e9fc9f4899e2ce92f3e Mon Sep 17 00:00:00 2001 From: Alexander DiBenedetto Date: Thu, 22 Oct 2026 16:06:27 -0500 Subject: [PATCH 2/2] Remove the deprecated public key algorithm API kTSKPublicKeyAlgorithms, TSKSupportedAlgorithm and the kTSKAlgorithm* constants have been deprecated since 1.6.0. Configs that still set TSKPublicKeyAlgorithms keep working because the parser ignores unknown keys. Also delete the unused internal TSKPublicKeyAlgorithm.h and rename TSKPublicKeyAlgorithmTests to TSKSPKIHashCacheTests, after the class it tests. --- TrustKit.xcodeproj/project.pbxproj | 36 +++++--------- TrustKit/Pinning/TSKPublicKeyAlgorithm.h | 32 ------------- TrustKit/TSKTrustKitConfig.m | 7 --- TrustKit/public/TrustKit/TSKTrustKitConfig.h | 48 ------------------- ...gorithmTests.m => TSKSPKIHashCacheTests.m} | 8 ++-- 5 files changed, 16 insertions(+), 115 deletions(-) delete mode 100644 TrustKit/Pinning/TSKPublicKeyAlgorithm.h rename TrustKitTests/{TSKPublicKeyAlgorithmTests.m => TSKSPKIHashCacheTests.m} (98%) diff --git a/TrustKit.xcodeproj/project.pbxproj b/TrustKit.xcodeproj/project.pbxproj index c5d36371..12c1e01a 100644 --- a/TrustKit.xcodeproj/project.pbxproj +++ b/TrustKit.xcodeproj/project.pbxproj @@ -44,7 +44,6 @@ 471D3075E092FF03EDE1FE1B /* TSKEndToEndNSURLSessionTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CF27A931F01A0B8009369B0 /* TSKEndToEndNSURLSessionTests.m */; }; 4BE73A6828FEE74AAEE1AE7D /* anchor-ca.cert.pem in Resources */ = {isa = PBXBuildFile; fileRef = FCC1DD051EECD19E00AB3D81 /* anchor-ca.cert.pem */; }; 4E6AD6DA2971EAE720AECA6D /* RSSwizzle.h in Headers */ = {isa = PBXBuildFile; fileRef = 8CD5F7401BCB06F4005801D8 /* RSSwizzle.h */; }; - 527BEECA57D71B352F86A8F5 /* TSKPublicKeyAlgorithm.h in Headers */ = {isa = PBXBuildFile; fileRef = FC1A09121E57C6820055B12C /* TSKPublicKeyAlgorithm.h */; }; 5590B4624C6E6E9CACF9B41D /* TSKTrustKitConfig.m in Sources */ = {isa = PBXBuildFile; fileRef = FCE7D62C1EE9F6610081EEEF /* TSKTrustKitConfig.m */; }; 5B1F2F355CEFE2CCD05E772B /* TrustKit.m in Sources */ = {isa = PBXBuildFile; fileRef = 8C84806C1A896F660017C155 /* TrustKit.m */; }; 605E96623C3BEB5D679E248C /* RSSwizzle.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CD5F7411BCB06F4005801D8 /* RSSwizzle.m */; settings = {COMPILER_FLAGS = "-Wno-sign-conversion -Wno-sign-compare"; }; }; @@ -137,7 +136,7 @@ 8C84CBC31D6E1718009B3E7D /* TSKNSURLConnectionTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CD5F7371BCB02A7005801D8 /* TSKNSURLConnectionTests.m */; }; 8C84CBC41D6E1718009B3E7D /* TSKPinConfigurationTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 8C15F9A31B17564400F06C0E /* TSKPinConfigurationTests.m */; }; 8C84CBC51D6E1718009B3E7D /* TSKPinningValidatorTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 2FA2868CAFECA46ADE0B6E3E /* TSKPinningValidatorTests.m */; }; - 8C84CBC61D6E1718009B3E7D /* TSKPublicKeyAlgorithmTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CC78B241B1B616500523A25 /* TSKPublicKeyAlgorithmTests.m */; }; + 8C84CBC61D6E1718009B3E7D /* TSKSPKIHashCacheTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CC78B241B1B616500523A25 /* TSKSPKIHashCacheTests.m */; }; 8C84CBC71D6E1718009B3E7D /* TSKReporterTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 6B032D3F1AF1AEB600EAFA69 /* TSKReporterTests.m */; }; 8C84CBC81D6E1718009B3E7D /* TSKNSURLSessionTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CD5F7561BCB7219005801D8 /* TSKNSURLSessionTests.m */; }; 8C84CBC91D6E1718009B3E7D /* TSKCertificateUtils.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CC78B1F1B1B586F00523A25 /* TSKCertificateUtils.m */; }; @@ -166,7 +165,7 @@ 8CA6CC391BAE2C7200BDA419 /* TSKPinningValidatorTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 2FA2868CAFECA46ADE0B6E3E /* TSKPinningValidatorTests.m */; }; 8CA6CC3A1BAE2C7C00BDA419 /* TSKReporterTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 6B032D3F1AF1AEB600EAFA69 /* TSKReporterTests.m */; }; 8CA6CC3B1BAE2C7E00BDA419 /* TSKPinConfigurationTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 8C15F9A31B17564400F06C0E /* TSKPinConfigurationTests.m */; }; - 8CA6CC3C1BAE2C8100BDA419 /* TSKPublicKeyAlgorithmTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CC78B241B1B616500523A25 /* TSKPublicKeyAlgorithmTests.m */; }; + 8CA6CC3C1BAE2C8100BDA419 /* TSKSPKIHashCacheTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CC78B241B1B616500523A25 /* TSKSPKIHashCacheTests.m */; }; 8CA6CC3D1BAE2C8500BDA419 /* TSKCertificateUtils.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CC78B1F1B1B586F00523A25 /* TSKCertificateUtils.m */; }; 8CBA05C71E28AA6C0045D8B3 /* GlobalSignDomainValidationCA-SHA256-G2.der in Resources */ = {isa = PBXBuildFile; fileRef = 8CBA05C41E28AA6C0045D8B3 /* GlobalSignDomainValidationCA-SHA256-G2.der */; }; 8CBA05C81E28AA6C0045D8B3 /* GlobalSignDomainValidationCA-SHA256-G2.der in Resources */ = {isa = PBXBuildFile; fileRef = 8CBA05C41E28AA6C0045D8B3 /* GlobalSignDomainValidationCA-SHA256-G2.der */; }; @@ -225,7 +224,7 @@ 8CC5D2481D6E64D10074F515 /* TSKPinFailureReport.h in Headers */ = {isa = PBXBuildFile; fileRef = 8C15F99E1B16094D00F06C0E /* TSKPinFailureReport.h */; }; 8CC5D2491D6E64D10074F515 /* ssl_pin_verifier.h in Headers */ = {isa = PBXBuildFile; fileRef = 8CE919241AEA07C5002B29AE /* ssl_pin_verifier.h */; }; 8CC78B201B1B586F00523A25 /* TSKCertificateUtils.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CC78B1F1B1B586F00523A25 /* TSKCertificateUtils.m */; }; - 8CC78B251B1B616500523A25 /* TSKPublicKeyAlgorithmTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CC78B241B1B616500523A25 /* TSKPublicKeyAlgorithmTests.m */; }; + 8CC78B251B1B616500523A25 /* TSKSPKIHashCacheTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CC78B241B1B616500523A25 /* TSKSPKIHashCacheTests.m */; }; 8CCBD15B1B186D1100CB88AF /* reporting_utils.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CCBD15A1B186D1100CB88AF /* reporting_utils.m */; }; 8CD5F7311BC5ED4A005801D8 /* TSKNSURLConnectionDelegateProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 8CD5F72F1BC5ED4A005801D8 /* TSKNSURLConnectionDelegateProxy.h */; }; 8CD5F7321BC5ED4A005801D8 /* TSKNSURLConnectionDelegateProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 8CD5F72F1BC5ED4A005801D8 /* TSKNSURLConnectionDelegateProxy.h */; }; @@ -285,7 +284,7 @@ B6BD7DC62AFB487F0B8297CA /* TSKPinningValidatorTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 2FA2868CAFECA46ADE0B6E3E /* TSKPinningValidatorTests.m */; }; BA4033A9744CF186E7E38480 /* parse_configuration.m in Sources */ = {isa = PBXBuildFile; fileRef = 8C5D98B21CEFF079008E654B /* parse_configuration.m */; }; BC7CE2B74C1CFAFC6D99F7F5 /* TSKPinConfigurationTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 8C15F9A31B17564400F06C0E /* TSKPinConfigurationTests.m */; }; - BFD027E53B892EDA799EF0CD /* TSKPublicKeyAlgorithmTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CC78B241B1B616500523A25 /* TSKPublicKeyAlgorithmTests.m */; }; + BFD027E53B892EDA799EF0CD /* TSKSPKIHashCacheTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CC78B241B1B616500523A25 /* TSKSPKIHashCacheTests.m */; }; C0FB5C8BD2DB22A24B34A711 /* www.globalsign.com.der in Resources */ = {isa = PBXBuildFile; fileRef = 8CBA05C61E28AA6C0045D8B3 /* www.globalsign.com.der */; }; C4120A6A11EB97D7A9470EB3 /* TSKSPKIHashCache.m in Sources */ = {isa = PBXBuildFile; fileRef = FC1A09091E57AC450055B12C /* TSKSPKIHashCache.m */; }; C45309417C74C6EDC68DE6E2 /* TSKPinningValidatorResult.h in Headers */ = {isa = PBXBuildFile; fileRef = 7033D35A248FE84100BDFF50 /* TSKPinningValidatorResult.h */; settings = {ATTRIBUTES = (Public, ); }; }; @@ -303,7 +302,7 @@ DF5A4407C307655B110C27C6 /* TSKLoggerTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CF27AA11F01BB7B009369B0 /* TSKLoggerTests.m */; }; E15C22DAE08702BE64A8E07D /* PrivacyInfo.xcprivacy in Resources */ = {isa = PBXBuildFile; fileRef = DC6F28762BAB30A8001B604A /* PrivacyInfo.xcprivacy */; }; F32AC6A36A41521902BAFCBE /* TSKReportsRateLimiter.h in Headers */ = {isa = PBXBuildFile; fileRef = 8C9EBE001B619BBE00CA7EE0 /* TSKReportsRateLimiter.h */; }; - F87EBFE90EDBC278922F5EF8 /* TSKPublicKeyAlgorithmTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CC78B241B1B616500523A25 /* TSKPublicKeyAlgorithmTests.m */; }; + F87EBFE90EDBC278922F5EF8 /* TSKSPKIHashCacheTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 8CC78B241B1B616500523A25 /* TSKSPKIHashCacheTests.m */; }; FAA3FB81F243F2CABACCEB2E /* TSKReporterTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 6B032D3F1AF1AEB600EAFA69 /* TSKReporterTests.m */; }; FC049B3A1EECD1B000FDC5F4 /* anchor-ca.cert.pem in Resources */ = {isa = PBXBuildFile; fileRef = FCC1DD051EECD19E00AB3D81 /* anchor-ca.cert.pem */; }; FC049B3B1EECD1B000FDC5F4 /* anchor-fake.yahoo.com.cert.pem in Resources */ = {isa = PBXBuildFile; fileRef = FCC1DD061EECD19E00AB3D81 /* anchor-fake.yahoo.com.cert.pem */; }; @@ -333,10 +332,6 @@ FCE7D62E1EE9F6610081EEEF /* TSKTrustKitConfig.m in Sources */ = {isa = PBXBuildFile; fileRef = FCE7D62C1EE9F6610081EEEF /* TSKTrustKitConfig.m */; }; FCE7D62F1EE9F6610081EEEF /* TSKTrustKitConfig.m in Sources */ = {isa = PBXBuildFile; fileRef = FCE7D62C1EE9F6610081EEEF /* TSKTrustKitConfig.m */; }; FCE7D6301EE9F6610081EEEF /* TSKTrustKitConfig.m in Sources */ = {isa = PBXBuildFile; fileRef = FCE7D62C1EE9F6610081EEEF /* TSKTrustKitConfig.m */; }; - FCE7D6321EE9FDFD0081EEEF /* TSKPublicKeyAlgorithm.h in Headers */ = {isa = PBXBuildFile; fileRef = FC1A09121E57C6820055B12C /* TSKPublicKeyAlgorithm.h */; }; - FCE7D6331EE9FE080081EEEF /* TSKPublicKeyAlgorithm.h in Headers */ = {isa = PBXBuildFile; fileRef = FC1A09121E57C6820055B12C /* TSKPublicKeyAlgorithm.h */; }; - FCE7D6341EE9FE260081EEEF /* TSKPublicKeyAlgorithm.h in Headers */ = {isa = PBXBuildFile; fileRef = FC1A09121E57C6820055B12C /* TSKPublicKeyAlgorithm.h */; }; - FCE7D6351EE9FE2F0081EEEF /* TSKPublicKeyAlgorithm.h in Headers */ = {isa = PBXBuildFile; fileRef = FC1A09121E57C6820055B12C /* TSKPublicKeyAlgorithm.h */; }; FFC49089A5020656AD59592C /* TSKBackgroundReporter.h in Headers */ = {isa = PBXBuildFile; fileRef = 6B2B06AC1B05154A00FC749E /* TSKBackgroundReporter.h */; }; /* End PBXBuildFile section */ @@ -427,7 +422,7 @@ 8CC5D24E1D6E64D10074F515 /* TrustKit.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = TrustKit.framework; sourceTree = BUILT_PRODUCTS_DIR; }; 8CC78B1E1B1B586F00523A25 /* TSKCertificateUtils.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TSKCertificateUtils.h; sourceTree = ""; }; 8CC78B1F1B1B586F00523A25 /* TSKCertificateUtils.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = TSKCertificateUtils.m; sourceTree = ""; }; - 8CC78B241B1B616500523A25 /* TSKPublicKeyAlgorithmTests.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = TSKPublicKeyAlgorithmTests.m; sourceTree = ""; }; + 8CC78B241B1B616500523A25 /* TSKSPKIHashCacheTests.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = TSKSPKIHashCacheTests.m; sourceTree = ""; }; 8CCBD15A1B186D1100CB88AF /* reporting_utils.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; name = reporting_utils.m; path = Reporting/reporting_utils.m; sourceTree = ""; }; 8CD5F72F1BC5ED4A005801D8 /* TSKNSURLConnectionDelegateProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TSKNSURLConnectionDelegateProxy.h; path = Swizzling/TSKNSURLConnectionDelegateProxy.h; sourceTree = ""; }; 8CD5F7301BC5ED4A005801D8 /* TSKNSURLConnectionDelegateProxy.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; name = TSKNSURLConnectionDelegateProxy.m; path = Swizzling/TSKNSURLConnectionDelegateProxy.m; sourceTree = ""; }; @@ -452,7 +447,6 @@ FC1A08FF1E57A4BB0055B12C /* TSKPinningValidatorResult.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = TSKPinningValidatorResult.m; sourceTree = ""; }; FC1A09081E57AC450055B12C /* TSKSPKIHashCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TSKSPKIHashCache.h; path = Pinning/TSKSPKIHashCache.h; sourceTree = ""; }; FC1A09091E57AC450055B12C /* TSKSPKIHashCache.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; name = TSKSPKIHashCache.m; path = Pinning/TSKSPKIHashCache.m; sourceTree = ""; }; - FC1A09121E57C6820055B12C /* TSKPublicKeyAlgorithm.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = TSKPublicKeyAlgorithm.h; path = Pinning/TSKPublicKeyAlgorithm.h; sourceTree = ""; }; FC23F68E1EE73BE600397646 /* README.md */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = net.daringfireball.markdown; path = README.md; sourceTree = SOURCE_ROOT; }; FC23F68F1EE73BE600397646 /* ATTRIBUTIONS */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = ATTRIBUTIONS; sourceTree = SOURCE_ROOT; }; FC23F6901EE73BE600397646 /* AUTHORS */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = AUTHORS; sourceTree = SOURCE_ROOT; }; @@ -649,7 +643,7 @@ 8C15F9A31B17564400F06C0E /* TSKPinConfigurationTests.m */, 8CC78B1E1B1B586F00523A25 /* TSKCertificateUtils.h */, 8CC78B1F1B1B586F00523A25 /* TSKCertificateUtils.m */, - 8CC78B241B1B616500523A25 /* TSKPublicKeyAlgorithmTests.m */, + 8CC78B241B1B616500523A25 /* TSKSPKIHashCacheTests.m */, ); path = TrustKitTests; sourceTree = ""; @@ -728,7 +722,6 @@ 8CE919211AEA077F002B29AE /* ssl_pin_verifier.m */, FC1A09081E57AC450055B12C /* TSKSPKIHashCache.h */, FC1A09091E57AC450055B12C /* TSKSPKIHashCache.m */, - FC1A09121E57C6820055B12C /* TSKPublicKeyAlgorithm.h */, B005E3E729B85EBA007C3D84 /* pinning_utils.m */, 5E84F4FFC49B4AC9B23F1EF4 /* SubjectPublicKeyInfo.swift */, B005E3F029B85ED0007C3D84 /* pinning_utils.h */, @@ -836,7 +829,6 @@ buildActionMask = 2147483647; files = ( C45309417C74C6EDC68DE6E2 /* TSKPinningValidatorResult.h in Headers */, - 527BEECA57D71B352F86A8F5 /* TSKPublicKeyAlgorithm.h in Headers */, 2DE4EDE8D2FF32C8AE10E8F1 /* TSKPinningValidatorCallback.h in Headers */, 25AAA2F7803338E7E8FC2A2C /* TSKNSURLSessionDelegateProxy.h in Headers */, 3C34909C1FAD2602B9622ABD /* TSKTrustDecision.h in Headers */, @@ -861,7 +853,6 @@ buildActionMask = 2147483647; files = ( 7033D366248FE84100BDFF50 /* TSKPinningValidatorResult.h in Headers */, - FCE7D6321EE9FDFD0081EEEF /* TSKPublicKeyAlgorithm.h in Headers */, 7033D372248FE84100BDFF50 /* TSKPinningValidatorCallback.h in Headers */, 8CD5F7491BCB535E005801D8 /* TSKNSURLSessionDelegateProxy.h in Headers */, 7033D362248FE84100BDFF50 /* TSKTrustDecision.h in Headers */, @@ -886,7 +877,6 @@ buildActionMask = 2147483647; files = ( 7033D368248FE84100BDFF50 /* TSKPinningValidatorResult.h in Headers */, - FCE7D6341EE9FE260081EEEF /* TSKPublicKeyAlgorithm.h in Headers */, 7033D374248FE84100BDFF50 /* TSKPinningValidatorCallback.h in Headers */, 8C84CBA41D6E0981009B3E7D /* TSKNSURLSessionDelegateProxy.h in Headers */, 7033D364248FE84100BDFF50 /* TSKTrustDecision.h in Headers */, @@ -910,7 +900,6 @@ isa = PBXHeadersBuildPhase; buildActionMask = 2147483647; files = ( - FCE7D6331EE9FE080081EEEF /* TSKPublicKeyAlgorithm.h in Headers */, 8CD5F74A1BCB535E005801D8 /* TSKNSURLSessionDelegateProxy.h in Headers */, 8C4346D71E5B894A008023F9 /* configuration_utils.h in Headers */, 8CA6CC1B1BAE2B6600BDA419 /* TSKPinFailureReport.h in Headers */, @@ -937,7 +926,6 @@ buildActionMask = 2147483647; files = ( 7033D369248FE84100BDFF50 /* TSKPinningValidatorResult.h in Headers */, - FCE7D6351EE9FE2F0081EEEF /* TSKPublicKeyAlgorithm.h in Headers */, 7033D375248FE84100BDFF50 /* TSKPinningValidatorCallback.h in Headers */, 8CC5D23A1D6E64D10074F515 /* TSKNSURLSessionDelegateProxy.h in Headers */, 7033D365248FE84100BDFF50 /* TSKTrustDecision.h in Headers */, @@ -1375,7 +1363,7 @@ C609BBE1526B5FF0C7E2846D /* TSKReportsRateLimiterTests.m in Sources */, 36BE12327952B3352276CDC4 /* TSKPinConfigurationTests.m in Sources */, 4508276E17BD1E92AA4D5306 /* TSKPinningValidatorTests.m in Sources */, - F87EBFE90EDBC278922F5EF8 /* TSKPublicKeyAlgorithmTests.m in Sources */, + F87EBFE90EDBC278922F5EF8 /* TSKSPKIHashCacheTests.m in Sources */, FAA3FB81F243F2CABACCEB2E /* TSKReporterTests.m in Sources */, 174A936492D36337281482FF /* TSKNSURLSessionTests.m in Sources */, 1D873DDD451DE0997A499713 /* TSKSwizzlingTests.m in Sources */, @@ -1443,7 +1431,7 @@ 8CD5F7381BCB02A7005801D8 /* TSKNSURLConnectionTests.m in Sources */, 8C15F9A41B17564400F06C0E /* TSKPinConfigurationTests.m in Sources */, 075AA1091AC985FD00178223 /* TSKPinningValidatorTests.m in Sources */, - 8CC78B251B1B616500523A25 /* TSKPublicKeyAlgorithmTests.m in Sources */, + 8CC78B251B1B616500523A25 /* TSKSPKIHashCacheTests.m in Sources */, 6B032D401AF1AEC200EAFA69 /* TSKReporterTests.m in Sources */, 8CD5F7571BCB7219005801D8 /* TSKNSURLSessionTests.m in Sources */, FC4CAC7B1E958E0500DAC41E /* TSKReportsRateLimiterTests.m in Sources */, @@ -1488,7 +1476,7 @@ FC4CAC7D1E96891B00DAC41E /* TSKReportsRateLimiterTests.m in Sources */, 8C84CBC41D6E1718009B3E7D /* TSKPinConfigurationTests.m in Sources */, 8C84CBC51D6E1718009B3E7D /* TSKPinningValidatorTests.m in Sources */, - 8C84CBC61D6E1718009B3E7D /* TSKPublicKeyAlgorithmTests.m in Sources */, + 8C84CBC61D6E1718009B3E7D /* TSKSPKIHashCacheTests.m in Sources */, 8C84CBC71D6E1718009B3E7D /* TSKReporterTests.m in Sources */, 8C84CBC81D6E1718009B3E7D /* TSKNSURLSessionTests.m in Sources */, 8CF27A9A1F01B341009369B0 /* TSKSwizzlingTests.m in Sources */, @@ -1532,7 +1520,7 @@ FC4CAC7C1E96891A00DAC41E /* TSKReportsRateLimiterTests.m in Sources */, 8CA6CC3A1BAE2C7C00BDA419 /* TSKReporterTests.m in Sources */, 8CA6CC391BAE2C7200BDA419 /* TSKPinningValidatorTests.m in Sources */, - 8CA6CC3C1BAE2C8100BDA419 /* TSKPublicKeyAlgorithmTests.m in Sources */, + 8CA6CC3C1BAE2C8100BDA419 /* TSKSPKIHashCacheTests.m in Sources */, 8CA6CC3B1BAE2C7E00BDA419 /* TSKPinConfigurationTests.m in Sources */, 8CD5F7581BCB7219005801D8 /* TSKNSURLSessionTests.m in Sources */, 8CF27A991F01B341009369B0 /* TSKSwizzlingTests.m in Sources */, @@ -1576,7 +1564,7 @@ 73D49495390F7B95594E197E /* TSKReportsRateLimiterTests.m in Sources */, BC7CE2B74C1CFAFC6D99F7F5 /* TSKPinConfigurationTests.m in Sources */, B6BD7DC62AFB487F0B8297CA /* TSKPinningValidatorTests.m in Sources */, - BFD027E53B892EDA799EF0CD /* TSKPublicKeyAlgorithmTests.m in Sources */, + BFD027E53B892EDA799EF0CD /* TSKSPKIHashCacheTests.m in Sources */, C56A3DBE234848CFFC2A8D3A /* TSKReporterTests.m in Sources */, 1D9B0A12D6BCB92D1BC47C10 /* TSKNSURLSessionTests.m in Sources */, 439D401C8F9D03643C7405EA /* TSKSwizzlingTests.m in Sources */, diff --git a/TrustKit/Pinning/TSKPublicKeyAlgorithm.h b/TrustKit/Pinning/TSKPublicKeyAlgorithm.h deleted file mode 100644 index 3e93df2d..00000000 --- a/TrustKit/Pinning/TSKPublicKeyAlgorithm.h +++ /dev/null @@ -1,32 +0,0 @@ -/* - - TSKPublicKeyAlgorithm.h - TrustKit - - Copyright 2015 The TrustKit Project Authors - Licensed under the MIT license, see associated LICENSE file for terms. - See AUTHORS file for the list of project authors. - - */ - -#ifndef TSKPublicKeyAlgorithm_h -#define TSKPublicKeyAlgorithm_h - -#if __has_feature(modules) -@import Foundation; -#else -#import -#endif - -// The internal enum we use for public key algorithms; not to be confused with the exported TSKSupportedAlgorithm -typedef NS_ENUM(NSInteger, TSKPublicKeyAlgorithm) { - // Some assumptions are made about this specific ordering in public_key_utils.m - TSKPublicKeyAlgorithmRsa2048 = 0, - TSKPublicKeyAlgorithmRsa4096 = 1, - TSKPublicKeyAlgorithmEcDsaSecp256r1 = 2, - TSKPublicKeyAlgorithmEcDsaSecp384r1 = 3, - - TSKPublicKeyAlgorithmLast = TSKPublicKeyAlgorithmEcDsaSecp384r1 -} __deprecated_msg("Starting with TrustKit 1.6.0, key algorithms no longer need to be specified; remove TSKPublicKeyAlgorithms from your configuration."); - -#endif /* TSKPublicKeyAlgorithm_h */ diff --git a/TrustKit/TSKTrustKitConfig.m b/TrustKit/TSKTrustKitConfig.m index 8b307c0d..6fa13757 100644 --- a/TrustKit/TSKTrustKitConfig.m +++ b/TrustKit/TSKTrustKitConfig.m @@ -25,13 +25,6 @@ const TSKDomainConfigurationKey kTSKExcludeSubdomainFromParentPolicy = @"kSKExcludeSubdomainFromParentPolicy"; const TSKDomainConfigurationKey kTSKIncludeSubdomains = @"TSKIncludeSubdomains"; -const TSKDomainConfigurationKey kTSKPublicKeyAlgorithms = @"TSKPublicKeyAlgorithms"; const TSKDomainConfigurationKey kTSKReportUris = @"TSKReportUris"; const TSKDomainConfigurationKey kTSKDisableDefaultReportUri = @"TSKDisableDefaultReportUri"; const TSKDomainConfigurationKey kTSKExpirationDate = @"TSKExpirationDate"; - -#pragma mark Public key Algorithms Constants -const TSKSupportedAlgorithm kTSKAlgorithmRsa2048 = @"TSKAlgorithmRsa2048"; -const TSKSupportedAlgorithm kTSKAlgorithmRsa4096 = @"TSKAlgorithmRsa4096"; -const TSKSupportedAlgorithm kTSKAlgorithmEcDsaSecp256r1 = @"TSKAlgorithmEcDsaSecp256r1"; -const TSKSupportedAlgorithm kTSKAlgorithmEcDsaSecp384r1 = @"TSKAlgorithmEcDsaSecp384r1"; diff --git a/TrustKit/public/TrustKit/TSKTrustKitConfig.h b/TrustKit/public/TrustKit/TSKTrustKitConfig.h index 935afcc8..2ce5b613 100644 --- a/TrustKit/public/TrustKit/TSKTrustKitConfig.h +++ b/TrustKit/public/TrustKit/TSKTrustKitConfig.h @@ -94,20 +94,6 @@ FOUNDATION_EXPORT const TSKGlobalConfigurationKey kTSKIgnorePinningForUserDefine */ FOUNDATION_EXPORT const TSKDomainConfigurationKey kTSKPublicKeyHashes; -/** - DEPRECATED since 1.6.0: this configuration key is no longer needed. - - An array of `TSKSupportedAlgorithm` constants to specify the public key algorithms for the - keys to be pinned. - - TrustKit requires this information in order to compute SSL pins when validating a server's - certificate chain, because the `Security` framework does not provide APIs to extract the - key's algorithm from an SSL certificate. To minimize the performance impact of Trustkit, - only one algorithm should be enabled. - */ -FOUNDATION_EXPORT const TSKDomainConfigurationKey kTSKPublicKeyAlgorithms - __deprecated_msg("Starting with TrustKit 1.6.0, key algorithms no longer need to be specified; remove TSKPublicKeyAlgorithms from your configuration."); - #pragma mark Domain-Specific Configuration Keys - Optional /** @@ -189,37 +175,3 @@ FOUNDATION_EXPORT const TSKDomainConfigurationKey kTSKDisableDefaultReportUri; pin set, such as when the user disables App updates. */ FOUNDATION_EXPORT const TSKDomainConfigurationKey kTSKExpirationDate; - -#pragma mark DEPRECATED - Supported Public Key Algorithm Keys - -/** - DEPRECATED since 1.6.0: this configuration key is no longer needed. - - A public key algorithm supported by TrustKit for generating the SSL pin for a certificate. - */ -typedef NSString * - TSKSupportedAlgorithm __deprecated_msg("Starting with TrustKit 1.6.0, key algorithms no longer need to be specified; remove TSKSupportedAlgorithm from your configuration."); - -/** - RSA 2048. - */ -FOUNDATION_EXPORT const TSKSupportedAlgorithm kTSKAlgorithmRsa2048 - __deprecated_msg("Starting with TrustKit 1.6.0, key algorithms no longer need to be specified; remove TSKPublicKeyAlgorithms from your configuration."); - -/** - RSA 4096. - */ -FOUNDATION_EXPORT const TSKSupportedAlgorithm kTSKAlgorithmRsa4096 - __deprecated_msg("Starting with TrustKit 1.6.0, key algorithms no longer need to be specified; remove TSKPublicKeyAlgorithms from your configuration."); - -/** - ECDSA with secp256r1 curve. - */ -FOUNDATION_EXPORT const TSKSupportedAlgorithm kTSKAlgorithmEcDsaSecp256r1 - __deprecated_msg("Starting with TrustKit 1.6.0, key algorithms no longer need to be specified; remove TSKPublicKeyAlgorithms from your configuration."); - -/** - ECDSA with secp384r1 curve. - */ -FOUNDATION_EXPORT const TSKSupportedAlgorithm kTSKAlgorithmEcDsaSecp384r1 - __deprecated_msg("Starting with TrustKit 1.6.0, key algorithms no longer need to be specified; remove TSKPublicKeyAlgorithms from your configuration."); diff --git a/TrustKitTests/TSKPublicKeyAlgorithmTests.m b/TrustKitTests/TSKSPKIHashCacheTests.m similarity index 98% rename from TrustKitTests/TSKPublicKeyAlgorithmTests.m rename to TrustKitTests/TSKSPKIHashCacheTests.m index 149b4eb4..7bfe1b24 100644 --- a/TrustKitTests/TSKPublicKeyAlgorithmTests.m +++ b/TrustKitTests/TSKSPKIHashCacheTests.m @@ -1,6 +1,6 @@ /* - TSKPublicKeyAlgorithmTests.m + TSKSPKIHashCacheTests.m TrustKit Copyright 2015 The TrustKit Project Authors @@ -26,10 +26,10 @@ - (void)resetSubjectPublicKeyInfoDiskCache; - (NSMutableDictionary *)getSubjectPublicKeyInfoHashesCache; @end -@interface TSKPublicKeyAlgorithmTests : XCTestCase +@interface TSKSPKIHashCacheTests : XCTestCase @end -@implementation TSKPublicKeyAlgorithmTests { +@implementation TSKSPKIHashCacheTests { TSKSPKIHashCache *spkiCache; } @@ -57,7 +57,7 @@ - (void)testExtractRsa2048 { } - (void)testExtractRsa3072 { - // Ensure a RSA 2048 key is properly extracted from its certificate + // Ensure a RSA 3072 key is properly extracted from its certificate SecCertificateRef certificate = [TSKCertificateUtils createCertificateFromDer:@"Corporation Service Company RSA OV SSL CA"]; NSData *spkiHash = [spkiCache hashSubjectPublicKeyInfoFromCertificate:certificate];