ldid.1

   1 .\"-
   2 .\" Copyright (c) 2021 Cameron Katri
   3 .\" SPDX-License-Identifier: AGPL-3.0-or-later
   4 .\"
   5 .Dd October 8, 2021
   6 .Dt LDID 1
   7 .Os
   8 .Sh NAME
   9 .Nm ldid
  10 .Nd Link Identity Editor
  11 .Sh SYNOPSIS
  12 .Nm
  13 .Op Fl A Ns Ar cputype : Ns Ar subtype
  14 .Op Fl a
  15 .Op Fl C Ns Op Ar adhoc | Ar enforcement | Ar expires | Ar hard | Ar host | Ar kill | Ar library-validation | Ar restrict | Ar runtime
  16 .Op Fl D
  17 .Op Fl d
  18 .Op Fl e
  19 .Op Fl h
  20 .Op Fl K Ns Ar key.p12 Op Fl U Ns Ar password
  21 .Op Fl M
  22 .Op Fl P
  23 .Op Fl q
  24 .Op Fl r | Fl S Ns Ar file.xml | Fl s
  25 .Op Fl T Ns Ar timestamp
  26 .Op Fl u
  27 .Ar
  28 .Sh DESCRIPTION
  29 .Nm
  30 adds SHA1 and SHA256 hashes to a Mach-O file so that they can be run on a system that has validation but not signature verification.
  31 .Bl -tag -width -indent
  32 .It Fl a
  33 Print the CPU types and subtypes in hexadecimal.
  34 .It Fl A Ns Ar cputype : Ns Ar subtype
  35 When used with
  36 .Fl a , Fl D , Fl e , Fl h , Fl q ,
  37 or
  38 .Fl u ,
  39 only act on the slice specified by
  40 .Ar cputype
  41 and
  42 .Ar subtype .
  43 .Ar cputype
  44 and
  45 .Ar subtype
  46 should both be integers.
  47 .It Fl C Ns Op Ar adhoc | Ar enforcement | Ar expires | Ar hard | Ar host | Ar kill | Ar library-validation | Ar restrict | Ar runtime
  48 Specify the option flags to embed in the code signature.
  49 See
  50 .Xr codesign 1
  51 for details about these options.
  52 .It Fl D
  53 Reset the cryptid.
  54 .It Fl d
  55 Print the cryptid in the binaries if it exists.
  56 For compatibility reasons it also acts as
  57 .Fl h ,
  58 but this will be removed in the future.
  59 .It Fl e
  60 Print the entitlements in each slice, or the slice specified by
  61 .Fl A ,
  62 to
  63 .Ar stdout .
  64 .It Fl h
  65 Print information about the signature, such as hash types, flags, CDHash, and CodeDirectory version to
  66 .Ar stdout .
  67 .It Fl K Ns Ar key.p12
  68 Sign using the identity in
  69 .Ar key.p12 .
  70 This will give the binary a valid signature so that it can be run on a system with signature validation.
  71 If
  72 .Ar key.p12
  73 has a password you will be prompted for it, or you can specify from the command line with
  74 .Fl U .
  75 .It Fl M
  76 When used with
  77 .Fl S ,
  78 merge the new and existing entitlements instead of replacing the existing entitlements, this is useful for adding a few specific entitlements to a handful of binaries.
  79 .It Fl P
  80 Mark the Mach-O as a platform binary.
  81 .It Fl Q Ns Ar file
  82 Embed the requirements found in
  83 .Ar file .
  84 .It Fl q
  85 Print embedded requirements of the binaries.
  86 .It Fl r
  87 Remove the signature from the Mach-O.
  88 .It Fl S Ns Op Ar file.xml
  89 Pseudo-sign the Mach-O binaries.
  90 If
  91 .Ar file.xml
  92 is specified then the entitlements found in
  93 .Ar file.xml
  94 will be embedded in the Mach-O.
  95 .It Fl s
  96 Resign the Mach-O binaries while keeping the existing entitlements.
  97 .It Fl T Ns Ar timestamp
  98 When signing a dylib, set the timestamp to
  99 .Ar timestamp .
 100 .Ar timestamp
 101 should be an UNIX timestamp in seconds, if
 102 .Ar timestamp
 103 is a single dash
 104 .Pq Sq Fl ,
 105 the timestamp will be set to a hash of the Mach-O header.
 106 .It Fl U Ns Ar password
 107 Use
 108 .Ar password
 109 as the password for the p12 certificate instead of prompting.
 110 .It Fl u
 111 If the binary was linked against UIKit, then print the UIKit version that the Mach-O binaries was linked against.
 112 .El
 113 .Sh EXAMPLES
 114 The command:
 115 .Pp
 116 .Dl "ldid -S file"
 117 .Pp
 118 will fakesign
 119 .Ar file
 120 with no entitlements.
 121 .Pp
 122 The command:
 123 .Pp
 124 .Dl "ldid -Cadhoc -K/path/to/key.p12 -Sent.xml file"
 125 .Pp
 126 will sign
 127 .Ar file
 128 using the key in
 129 .Ar /path/to/key.p12
 130 with the entitlements found in
 131 .Ar ent.xml ,
 132 and mark it as an adhoc signature.
 133 .Pp
 134 The command:
 135 .Pp
 136 .Dl "ldid -Sent.xml -M file"
 137 .Pp
 138 will add the entitlements in
 139 .Ar ent.xml
 140 to the entitlements already in
 141 .Ar file .
 142 .Pp
 143 The command:
 144 .Pp
 145 .Dl "ldid -e file > ent.xml"
 146 .Pp
 147 will save the entitlements found in each slice of
 148 .Ar file
 149 to
 150 .Ar ent.xml .
 151 .Sh SEE ALSO
 152 .Xr codesign 1
 153 .Sh HISTORY
 154 The
 155 .Nm
 156 utility was written by
 157 .An Jay \*qSaurik\*q Freeman .
 158 iPhoneOS 1.2.0 and 2.0 support was added on April 6, 2008.
 159 .Fl S
 160 was added on June 13, 2008.
 161 SHA256 support was added on August 25, 2016, fixing iOS 11 support.
 162 iOS 14 support was added on July 31, 2020 by
 163 .An Kabir Oberai .
 164 iOS 15 support was added on June 11, 2021.