.Op Fl d
.Op Fl E Ns Ar num : Ns Ar file
.Op Fl e
+.Op Fl H Ns Op Ar sha1 | Ar sha256
.Op Fl h
+.Op Fl I Ns Ar name
.Op Fl K Ns Ar key.p12 Op Fl U Ns Ar password
.Op Fl M
.Op Fl P
+.Op Fl Q Ns Ar requirements.xml
.Op Fl q
.Op Fl r | Fl S Ns Ar file.xml | Fl s
-.Op Fl T Ns Ar timestamp
.Op Fl u
+.Op Fl arch Ar arch_type
.Ar
.Sh DESCRIPTION
.Nm
adds SHA1 and SHA256 hashes to a Mach-O file so that they can be run
on a system that has validation but not signature verification.
.Bl -tag -width -indent
-.It Fl a
-Print the CPU types and subtypes in hexadecimal.
.It Fl A Ns Ar cputype : Ns Ar subtype
When used with
.Fl a , Fl D , Fl e , Fl h , Fl q ,
and
.Ar subtype
should both be integers.
+.It Fl a
+Print the CPU types and subtypes in hexadecimal.
+.It Fl arch Ar arch_type
+The same as
+.Fl A ,
+except the name of the architecture is used.
+The list of currently known
+.Ar arch_type Ns s
+can be found in
+.Xr arch 3 .
+This is a Procursus extension.
.It Fl C Ns Op Ar adhoc | Ar enforcement | Ar expires | Ar hard | Ar host | Ar kill | Ar library-validation | Ar restrict | Ar runtime
Specify the option flags to embed in the code signature.
See
.Fl A ,
to
.Ar stdout .
+.It Fl H Ns Op Ar sha1 | Ar sha256
+Disable the hash not specified.
+This is useful to replicate the default behavior of
+.Xr codesign 1 ,
+which only provides an sha256 signature.
.It Fl h
Print information about the signature, such as
hash types, flags, CDHash, and CodeDirectory version to
.Ar stdout .
+.It Fl I Ns Ar name
+Set the identifier used in the binaries signature to
+.Ar name .
+If not specified, the basename of the binary is used.
.It Fl K Ns Ar key.p12
Sign using the identity in
.Ar key.p12 .
handful of binaries.
.It Fl P
Mark the Mach-O as a platform binary.
-.It Fl Q Ns Ar file
+.It Fl Q Ns Ar requirements.xml
Embed the requirements found in
-.Ar file .
+.Ar requirements.xml .
.It Fl q
Print embedded requirements of the binaries.
.It Fl r
will be embedded in the Mach-O.
.It Fl s
Resign the Mach-O binaries while keeping the existing entitlements.
-.It Fl T Ns Ar timestamp
-When signing a dylib, set the timestamp to
-.Ar timestamp .
-.Ar timestamp
-should be an UNIX timestamp in seconds, if
-.Ar timestamp
-is a single dash
-.Pq Sq Fl ,
-the timestamp will be set to a hash of the Mach-O header.
.It Fl U Ns Ar password
Use
.Ar password
as the password for the p12 certificate instead of prompting.
+This is a Procursus extension.
.It Fl u
If the binary was linked against UIKit, then print the UIKit version that the
Mach-O binaries were linked against.