macho

const (
	// code signing attributes of a process
	None         CdFlag = 0x00000000 // no flags
	Valid        CdFlag = 0x00000001 // dynamically valid
	Adhoc        CdFlag = 0x00000002 // ad hoc signed
	GetTaskAllow CdFlag = 0x00000004 // has get-task-allow entitlement
	Installer    CdFlag = 0x00000008 // has installer entitlement

	ForcedLv       CdFlag = 0x00000010 // Library Validation required by Hardened System Policy
	InvalidAllowed CdFlag = 0x00000020 // (macOS Only) Page invalidation allowed by task port policy

	Hard            CdFlag = 0x00000100 // don't load invalid pages
	Kill            CdFlag = 0x00000200 // kill process if it becomes invalid
	CheckExpiration CdFlag = 0x00000400 // force expiration checking
	Restrict        CdFlag = 0x00000800 // tell dyld to treat restricted

	Enforcement           CdFlag = 0x00001000 // require enforcement
	RequireLv             CdFlag = 0x00002000 // require library validation
	EntitlementsValidated CdFlag = 0x00004000 // code signature permits restricted entitlements
	NvramUnrestricted     CdFlag = 0x00008000 // has com.apple.rootless.restricted-nvram-variables.heritable entitlement

	Runtime CdFlag = 0x00010000 // Apply hardened runtime policies

	LinkerSigned CdFlag = 0x20000 // type property

	AllowedMacho CdFlag = (Adhoc | Hard | Kill | CheckExpiration | Restrict | Enforcement | RequireLv | Runtime)

	ExecSetHard        CdFlag = 0x00100000 // set HARD on any exec'ed process
	ExecSetKill        CdFlag = 0x00200000 // set KILL on any exec'ed process
	ExecSetEnforcement CdFlag = 0x00400000 // set ENFORCEMENT on any exec'ed process
	ExecInheritSIP     CdFlag = 0x00800000 // set INSTALLER on any exec'ed process

	Killed         CdFlag = 0x01000000 // was killed by kernel for invalidity
	DyldPlatform   CdFlag = 0x02000000 // dyld used to load this is a platform binary
	PlatformBinary CdFlag = 0x04000000 // this is a platform binary
	PlatformPath   CdFlag = 0x08000000 // platform binary by the fact of path (osx only)

	Debugged            CdFlag = 0x10000000 // process is currently or has previously been debugged and allowed to run with invalid pages
	Signed              CdFlag = 0x20000000 // process has a signature (may have gone invalid)
	DevCode             CdFlag = 0x40000000 // code is dev signed, cannot be loaded into prod signed code (will go away with rdar://problem/28322552)
	DatavaultController CdFlag = 0x80000000 // has Data Vault controller entitlement

	EntitlementFlags CdFlag = (GetTaskAllow | Installer | DatavaultController | NvramUnrestricted)
)

const (
	EarliestVersion     CdVersion = 0x20001
	SupportsScatter     CdVersion = 0x20100
	SupportsTeamid      CdVersion = 0x20200
	SupportsCodelimit64 CdVersion = 0x20300
	SupportsExecseg     CdVersion = 0x20400
	SupportsRuntime     CdVersion = 0x20500
	SupportsLinkage     CdVersion = 0x20600
	CompatibilityLimit  CdVersion = 0x2F000 // "version 3 with wiggle room"
)

const (
	ExecsegMainBinary    ExecSegFlag = 0x1   // executable segment denotes main binary
	ExecsegAllowUnsigned ExecSegFlag = 0x10  // allow unsigned pages (for debugging)
	ExecsegDebugger      ExecSegFlag = 0x20  // main binary is debugger
	ExecsegJit           ExecSegFlag = 0x40  // JIT enabled
	ExecsegSkipLv        ExecSegFlag = 0x80  // OBSOLETE: skip library validation
	ExecsegCanLoadCdhash ExecSegFlag = 0x100 // can bless cdhash for execution
	ExecsegCanExecCdhash ExecSegFlag = 0x200 // can execute blessed cdhash
)

const (
	HashTypeNohash          HashType = 0
	HashTypeSha1            HashType = 1
	HashTypeSha256          HashType = 2
	HashTypeSha256Truncated HashType = 3
	HashTypeSha384          HashType = 4
	HashTypeSha512          HashType = 5
)

const LcCodeSignature LoadCommandType = 0x1d

const (
	// Magic numbers used by Code Signing
	MagicRequirement             Magic = 0xfade0c00 // single Requirement blob
	MagicRequirements            Magic = 0xfade0c01 // Requirements vector (internal requirements)
	MagicCodedirectory           Magic = 0xfade0c02 // CodeDirectory blob
	MagicEmbeddedSignature       Magic = 0xfade0cc0 // embedded form of signature data
	MagicEmbeddedSignatureOld    Magic = 0xfade0b02 /* XXX */
	MagicLibraryDependencyBlob   Magic = 0xfade0c05
	MagicEmbeddedEntitlements    Magic = 0xfade7171 /* embedded entitlements */
	MagicEmbeddedEntitlementsDer Magic = 0xfade7172 /* embedded entitlements */
	MagicDetachedSignature       Magic = 0xfade0cc1 // multi-arch collection of embedded signatures
	MagicBlobwrapper             Magic = 0xfade0b01 // used for the cms blob
)

const (
	HostRequirementType       RequirementType = 1 /* what hosts may run us */
	GuestRequirementType      RequirementType = 2 /* what guests we may run */
	DesignatedRequirementType RequirementType = 3 /* designated requirement */ // this is the only supported type
	LibraryRequirementType    RequirementType = 4 /* what libraries we may link against */
	PluginRequirementType     RequirementType = 5 /* what plug-ins we may load */
)

const (
	CsSlotCodedirectory               SlotType = 0
	CsSlotInfoslot                    SlotType = 1 // Info.plist
	CsSlotRequirements                SlotType = 2 // internal requirements
	CsSlotResourcedir                 SlotType = 3 // resource directory
	CsSlotApplication                 SlotType = 4 // Application specific slot/Top-level directory list
	CsSlotEntitlements                SlotType = 5 // embedded entitlement configuration
	CsSlotRepSpecific                 SlotType = 6 // for use by disk rep
	CsSlotEntitlementsDer             SlotType = 7 // DER representation of entitlements
	CsSlotAlternateCodedirectories    SlotType = 0x1000
	CsSlotAlternateCodedirectoryMax            = 5
	CsSlotAlternateCodedirectoryLimit          = CsSlotAlternateCodedirectories + CsSlotAlternateCodedirectoryMax
	CsSlotCmsSignature                SlotType = 0x10000
	CsSlotIdentificationslot          SlotType = 0x10001
	CsSlotTicketslot                  SlotType = 0x10002
)