5
5
package x509
6
6
7
7
import (
8
- macOS "crypto/x509/internal/macos"
8
+ "crypto/x509/internal/macos"
9
9
"errors"
10
10
"fmt"
11
11
)
12
12
13
13
func (c * Certificate ) systemVerify (opts * VerifyOptions ) (chains [][]* Certificate , err error ) {
14
- certs := macOS .CFArrayCreateMutable ()
15
- defer macOS .ReleaseCFArray (certs )
16
- leaf , err := macOS .SecCertificateCreateWithData (c .Raw )
14
+ certs := macos .CFArrayCreateMutable ()
15
+ defer macos .ReleaseCFArray (certs )
16
+ leaf , err := macos .SecCertificateCreateWithData (c .Raw )
17
17
if err != nil {
18
18
return nil , errors .New ("invalid leaf certificate" )
19
19
}
20
- macOS .CFArrayAppendValue (certs , leaf )
20
+ macos .CFArrayAppendValue (certs , leaf )
21
21
if opts .Intermediates != nil {
22
22
for _ , lc := range opts .Intermediates .lazyCerts {
23
23
c , err := lc .getCert ()
24
24
if err != nil {
25
25
return nil , err
26
26
}
27
- sc , err := macOS .SecCertificateCreateWithData (c .Raw )
27
+ sc , err := macos .SecCertificateCreateWithData (c .Raw )
28
28
if err != nil {
29
29
return nil , err
30
30
}
31
- macOS .CFArrayAppendValue (certs , sc )
31
+ macos .CFArrayAppendValue (certs , sc )
32
32
}
33
33
}
34
34
35
- policies := macOS .CFArrayCreateMutable ()
36
- defer macOS .ReleaseCFArray (policies )
37
- sslPolicy , err := macOS .SecPolicyCreateSSL (opts .DNSName )
35
+ policies := macos .CFArrayCreateMutable ()
36
+ defer macos .ReleaseCFArray (policies )
37
+ sslPolicy , err := macos .SecPolicyCreateSSL (opts .DNSName )
38
38
if err != nil {
39
39
return nil , err
40
40
}
41
- macOS .CFArrayAppendValue (policies , sslPolicy )
41
+ macos .CFArrayAppendValue (policies , sslPolicy )
42
42
43
- trustObj , err := macOS .SecTrustCreateWithCertificates (certs , policies )
43
+ trustObj , err := macos .SecTrustCreateWithCertificates (certs , policies )
44
44
if err != nil {
45
45
return nil , err
46
46
}
47
- defer macOS .CFRelease (trustObj )
47
+ defer macos .CFRelease (trustObj )
48
48
49
49
if ! opts .CurrentTime .IsZero () {
50
- dateRef := macOS .TimeToCFDateRef (opts .CurrentTime )
51
- defer macOS .CFRelease (dateRef )
52
- if err := macOS .SecTrustSetVerifyDate (trustObj , dateRef ); err != nil {
50
+ dateRef := macos .TimeToCFDateRef (opts .CurrentTime )
51
+ defer macos .CFRelease (dateRef )
52
+ if err := macos .SecTrustSetVerifyDate (trustObj , dateRef ); err != nil {
53
53
return nil , err
54
54
}
55
55
}
@@ -59,27 +59,27 @@ func (c *Certificate) systemVerify(opts *VerifyOptions) (chains [][]*Certificate
59
59
// always enforce its SCT requirements, and there are still _some_ people
60
60
// using TLS or OCSP for that.
61
61
62
- if ret , err := macOS .SecTrustEvaluateWithError (trustObj ); err != nil {
62
+ if ret , err := macos .SecTrustEvaluateWithError (trustObj ); err != nil {
63
63
switch ret {
64
- case macOS .ErrSecCertificateExpired :
64
+ case macos .ErrSecCertificateExpired :
65
65
return nil , CertificateInvalidError {c , Expired , err .Error ()}
66
- case macOS .ErrSecHostNameMismatch :
66
+ case macos .ErrSecHostNameMismatch :
67
67
return nil , HostnameError {c , opts .DNSName }
68
- case macOS .ErrSecNotTrusted :
68
+ case macos .ErrSecNotTrusted :
69
69
return nil , UnknownAuthorityError {Cert : c }
70
70
default :
71
71
return nil , fmt .Errorf ("x509: %s" , err )
72
72
}
73
73
}
74
74
75
75
chain := [][]* Certificate {{}}
76
- chainRef , err := macOS .SecTrustCopyCertificateChain (trustObj )
76
+ chainRef , err := macos .SecTrustCopyCertificateChain (trustObj )
77
77
if err != nil {
78
78
return nil , err
79
79
}
80
- defer macOS .CFRelease (chainRef )
81
- for i := 0 ; i < macOS .CFArrayGetCount (chainRef ); i ++ {
82
- certRef := macOS .CFArrayGetValueAtIndex (chainRef , i )
80
+ defer macos .CFRelease (chainRef )
81
+ for i := 0 ; i < macos .CFArrayGetCount (chainRef ); i ++ {
82
+ certRef := macos .CFArrayGetValueAtIndex (chainRef , i )
83
83
cert , err := exportCertificate (certRef )
84
84
if err != nil {
85
85
return nil , err
@@ -88,7 +88,7 @@ func (c *Certificate) systemVerify(opts *VerifyOptions) (chains [][]*Certificate
88
88
}
89
89
if len (chain [0 ]) == 0 {
90
90
// This should _never_ happen, but to be safe
91
- return nil , errors .New ("x509: macOS certificate verification internal error" )
91
+ return nil , errors .New ("x509: macos certificate verification internal error" )
92
92
}
93
93
94
94
if opts .DNSName != "" {
@@ -118,8 +118,8 @@ func (c *Certificate) systemVerify(opts *VerifyOptions) (chains [][]*Certificate
118
118
}
119
119
120
120
// exportCertificate returns a *Certificate for a SecCertificateRef.
121
- func exportCertificate (cert macOS .CFRef ) (* Certificate , error ) {
122
- data , err := macOS .SecCertificateCopyData (cert )
121
+ func exportCertificate (cert macos .CFRef ) (* Certificate , error ) {
122
+ data , err := macos .SecCertificateCopyData (cert )
123
123
if err != nil {
124
124
return nil , err
125
125
}
0 commit comments