signalapp/Signal-iOS
signalapp/Signal-iOS
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases 4 Wiki Activity

Enable Enhanced Security

Browse Source
This commit is contained in:
Max Radermacher 2025-12-04 11:39:05 -06:00 committed by GitHub
parent b755ee53aa
commit 337e40e83f
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
15 changed files with 84 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
Signal.xcodeproj/project.pbxproj
View File

@ -15593,7 +15593,7 @@
DefaultBuildSystemTypeForWorkspace = Original;
LastSwiftUpdateCheck = 1600;
LastTestingUpgradeCheck = 0600;
LastUpgradeCheck = 1600;
LastUpgradeCheck = 2600;
ORGANIZATIONNAME = "Open Whisper Systems";
TargetAttributes = {
342FFE8727245850000AC89F = {
@ -20941,6 +20941,8 @@
CLANG_ANALYZER_SECURITY_FLOATLOOPCOUNTER = YES;
CLANG_ANALYZER_SECURITY_INSECUREAPI_RAND = YES;
CLANG_ANALYZER_SECURITY_INSECUREAPI_STRCPY = YES;
CLANG_ENABLE_CPLUSPLUS_TYPED_ALLOCATOR_SUPPORT = NO;
CLANG_ENABLE_C_TYPED_ALLOCATOR_SUPPORT = NO;
CLANG_ENABLE_MODULES = YES;
CLANG_ENABLE_OBJC_ARC = YES;
CLANG_UNDEFINED_BEHAVIOR_SANITIZER_NULLABILITY = YES;
@ -20965,6 +20967,8 @@
CLANG_WARN__ARC_BRIDGE_CAST_NONARC = YES;
CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
DEVELOPMENT_TEAM = U68MSDN6DR;
ENABLE_ENHANCED_SECURITY = YES;
ENABLE_POINTER_AUTHENTICATION = NO;
ENABLE_STRICT_OBJC_MSGSEND = YES;
ENABLE_TESTABILITY = YES;
ENABLE_USER_SCRIPT_SANDBOXING = YES;
@ -21199,6 +21203,8 @@
CLANG_ANALYZER_SECURITY_FLOATLOOPCOUNTER = YES;
CLANG_ANALYZER_SECURITY_INSECUREAPI_RAND = YES;
CLANG_ANALYZER_SECURITY_INSECUREAPI_STRCPY = YES;
CLANG_ENABLE_CPLUSPLUS_TYPED_ALLOCATOR_SUPPORT = NO;
CLANG_ENABLE_C_TYPED_ALLOCATOR_SUPPORT = NO;
CLANG_ENABLE_MODULES = YES;
CLANG_ENABLE_OBJC_ARC = YES;
CLANG_UNDEFINED_BEHAVIOR_SANITIZER_NULLABILITY = YES;
@ -21223,6 +21229,8 @@
CLANG_WARN__ARC_BRIDGE_CAST_NONARC = YES;
CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
DEVELOPMENT_TEAM = U68MSDN6DR;
ENABLE_ENHANCED_SECURITY = YES;
ENABLE_POINTER_AUTHENTICATION = NO;
ENABLE_STRICT_OBJC_MSGSEND = YES;
ENABLE_USER_SCRIPT_SANDBOXING = YES;
GCC_ENABLE_OBJC_EXCEPTIONS = NO;
@ -21453,6 +21461,8 @@
CLANG_ANALYZER_SECURITY_FLOATLOOPCOUNTER = YES;
CLANG_ANALYZER_SECURITY_INSECUREAPI_RAND = YES;
CLANG_ANALYZER_SECURITY_INSECUREAPI_STRCPY = YES;
CLANG_ENABLE_CPLUSPLUS_TYPED_ALLOCATOR_SUPPORT = NO;
CLANG_ENABLE_C_TYPED_ALLOCATOR_SUPPORT = NO;
CLANG_ENABLE_MODULES = YES;
CLANG_ENABLE_OBJC_ARC = YES;
CLANG_UNDEFINED_BEHAVIOR_SANITIZER_NULLABILITY = YES;
@ -21478,6 +21488,8 @@
CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
DEBUG_INFORMATION_FORMAT = dwarf;
DEVELOPMENT_TEAM = U68MSDN6DR;
ENABLE_ENHANCED_SECURITY = YES;
ENABLE_POINTER_AUTHENTICATION = NO;
ENABLE_STRICT_OBJC_MSGSEND = YES;
ENABLE_TESTABILITY = YES;
ENABLE_USER_SCRIPT_SANDBOXING = YES;
@ -21558,6 +21570,8 @@
CLANG_ANALYZER_SECURITY_FLOATLOOPCOUNTER = YES;
CLANG_ANALYZER_SECURITY_INSECUREAPI_RAND = YES;
CLANG_ANALYZER_SECURITY_INSECUREAPI_STRCPY = YES;
CLANG_ENABLE_CPLUSPLUS_TYPED_ALLOCATOR_SUPPORT = NO;
CLANG_ENABLE_C_TYPED_ALLOCATOR_SUPPORT = NO;
CLANG_ENABLE_MODULES = YES;
CLANG_ENABLE_OBJC_ARC = YES;
CLANG_UNDEFINED_BEHAVIOR_SANITIZER_NULLABILITY = YES;
@ -21582,6 +21596,8 @@
CLANG_WARN__ARC_BRIDGE_CAST_NONARC = YES;
CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
DEVELOPMENT_TEAM = U68MSDN6DR;
ENABLE_ENHANCED_SECURITY = YES;
ENABLE_POINTER_AUTHENTICATION = NO;
ENABLE_STRICT_OBJC_MSGSEND = YES;
ENABLE_USER_SCRIPT_SANDBOXING = YES;
GCC_ENABLE_OBJC_EXCEPTIONS = NO;

2
Signal.xcodeproj/xcshareddata/xcschemes/Signal-Staging.xcscheme
View File

@ -1,6 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<Scheme
LastUpgradeVersion = "1600"
LastUpgradeVersion = "2600"
version = "1.8">
<BuildAction
parallelizeBuildables = "YES"

2
Signal.xcodeproj/xcshareddata/xcschemes/Signal.xcscheme
View File

@ -1,6 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<Scheme
LastUpgradeVersion = "1600"
LastUpgradeVersion = "2600"
version = "1.8">
<BuildAction
parallelizeBuildables = "YES"

2
Signal.xcodeproj/xcshareddata/xcschemes/SignalNSE.xcscheme
View File

@ -1,6 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<Scheme
LastUpgradeVersion = "1600"
LastUpgradeVersion = "2600"
wasCreatedForAppExtension = "YES"
version = "2.0">
<BuildAction

2
Signal.xcodeproj/xcshareddata/xcschemes/SignalServiceKit.xcscheme
View File

@ -1,6 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<Scheme
LastUpgradeVersion = "1600"
LastUpgradeVersion = "2600"
version = "1.7">
<BuildAction
parallelizeBuildables = "YES"

2
Signal.xcodeproj/xcshareddata/xcschemes/SignalShareExtension.xcscheme
View File

@ -1,6 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<Scheme
LastUpgradeVersion = "1600"
LastUpgradeVersion = "2600"
wasCreatedForAppExtension = "YES"
version = "2.0">
<BuildAction

8
Signal/Signal-AppStore.entitlements
View File

@ -38,6 +38,14 @@
<string>group.$(SIGNAL_BUNDLEID_PREFIX).signal.group</string>
<string>group.$(SIGNAL_BUNDLEID_PREFIX).signal.group.staging</string>
</array>
<key>com.apple.security.hardened-process</key>
<true/>
<key>com.apple.security.hardened-process.dyld-ro</key>
<true/>
<key>com.apple.security.hardened-process.enhanced-security-version</key>
<integer>1</integer>
<key>com.apple.security.hardened-process.platform-restrictions</key>
<integer>2</integer>
<key>keychain-access-groups</key>
<array>
<string>$(AppIdentifierPrefix)$(SIGNAL_BUNDLEID_PREFIX).signal</string>

8
Signal/Signal.entitlements
View File

@ -36,6 +36,14 @@
<string>group.$(SIGNAL_BUNDLEID_PREFIX).signal.group</string>
<string>group.$(SIGNAL_BUNDLEID_PREFIX).signal.group.staging</string>
</array>
<key>com.apple.security.hardened-process</key>
<true/>
<key>com.apple.security.hardened-process.dyld-ro</key>
<true/>
<key>com.apple.security.hardened-process.enhanced-security-version</key>
<integer>1</integer>
<key>com.apple.security.hardened-process.platform-restrictions</key>
<integer>2</integer>
<key>keychain-access-groups</key>
<array>
<string>$(AppIdentifierPrefix)$(SIGNAL_BUNDLEID_PREFIX).signal</string>

12
SignalNSE/SignalNSE-AppStore.entitlements
View File

@ -4,8 +4,6 @@
<dict>
<key>com.apple.developer.default-data-protection</key>
<string>NSFileProtectionComplete</string>
<key>com.apple.developer.usernotifications.filtering</key>
<true/>
<key>com.apple.developer.networking.carrier-constrained.app-optimized</key>
<true/>
<key>com.apple.developer.networking.carrier-constrained.appcategory</key>
@ -14,11 +12,21 @@
</array>
<key>com.apple.developer.pushkit.unrestricted-voip</key>
<true/>
<key>com.apple.developer.usernotifications.filtering</key>
<true/>
<key>com.apple.security.application-groups</key>
<array>
<string>group.$(SIGNAL_BUNDLEID_PREFIX).signal.group</string>
<string>group.$(SIGNAL_BUNDLEID_PREFIX).signal.group.staging</string>
</array>
<key>com.apple.security.hardened-process</key>
<true/>
<key>com.apple.security.hardened-process.dyld-ro</key>
<true/>
<key>com.apple.security.hardened-process.enhanced-security-version</key>
<integer>1</integer>
<key>com.apple.security.hardened-process.platform-restrictions</key>
<integer>2</integer>
<key>keychain-access-groups</key>
<array>
<string>$(AppIdentifierPrefix)$(SIGNAL_BUNDLEID_PREFIX).signal</string>

8
SignalNSE/SignalNSE.entitlements
View File

@ -15,6 +15,14 @@
<string>group.$(SIGNAL_BUNDLEID_PREFIX).signal.group</string>
<string>group.$(SIGNAL_BUNDLEID_PREFIX).signal.group.staging</string>
</array>
<key>com.apple.security.hardened-process</key>
<true/>
<key>com.apple.security.hardened-process.dyld-ro</key>
<true/>
<key>com.apple.security.hardened-process.enhanced-security-version</key>
<integer>1</integer>
<key>com.apple.security.hardened-process.platform-restrictions</key>
<integer>2</integer>
<key>keychain-access-groups</key>
<array>
<string>$(AppIdentifierPrefix)$(SIGNAL_BUNDLEID_PREFIX).signal</string>

3
SignalServiceKit/Messages/Interactions/TSErrorMessage.m
View File

@ -201,7 +201,10 @@ NSUInteger TSErrorMessageSchemaVersion = 2;
NSString *senderName =
[SSKEnvironment.shared.contactManagerObjcRef shortDisplayNameStringForAddress:self.sender
transaction:transaction];
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wformat-nonliteral"
return [[NSString alloc] initWithFormat:formatString, senderName];
#pragma clang diagnostic pop
} else {
return OWSLocalizedString(
@"ERROR_MESSAGE_DECRYPTION_FAILURE_UNKNOWN_SENDER", @"Error message for a decryption failure.");

6
SignalServiceKit/Messages/Interactions/TSInfoMessage.m
View File

@ -280,7 +280,10 @@ NSUInteger TSInfoMessageSchemaVersion = 2;
NSString *format = OWSLocalizedString(@"INFO_MESSAGE_USER_JOINED_SIGNAL_BODY_FORMAT",
@"Shown in inbox and conversation when a user joins Signal, embeds the new user's {{contact "
@"name}}");
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wformat-nonliteral"
return [NSString stringWithFormat:format, recipientName];
#pragma clang diagnostic pop
}
case TSInfoMessageSyncedThread:
return @"";
@ -298,7 +301,10 @@ NSUInteger TSInfoMessageSchemaVersion = 2;
NSString *format = OWSLocalizedString(@"INFO_MESSAGE_USER_CHANGED_PHONE_NUMBER_FORMAT",
@"Indicates that another user has changed their phone number. Embeds: {{ the user's name}}".);
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wformat-nonliteral"
return [NSString stringWithFormat:format, userName];
#pragma clang diagnostic pop
}
case TSInfoMessageRecipientHidden: {
/// This does not control whether to show the info message in the chat

3
SignalServiceKit/Messages/OWSRecoverableDecryptionPlaceholder.m
View File

@ -146,7 +146,10 @@ NS_ASSUME_NONNULL_BEGIN
OWSFailDebug(@"Should not be directly surfaced to user");
NSString *formatString = OWSLocalizedString(@"ERROR_MESSAGE_DECRYPTION_FAILURE",
@"Error message for a decryption failure. Embeds {{sender short name}}.");
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wformat-nonliteral"
return [[NSString alloc] initWithFormat:formatString, senderName];
#pragma clang diagnostic pop
} else {
OWSFailDebug(@"Should not be directly surfaced to user");
return OWSLocalizedString(

8
SignalShareExtension/SignalShareExtension-AppStore.entitlements
View File

@ -17,6 +17,14 @@
<string>group.$(SIGNAL_BUNDLEID_PREFIX).signal.group</string>
<string>group.$(SIGNAL_BUNDLEID_PREFIX).signal.group.staging</string>
</array>
<key>com.apple.security.hardened-process</key>
<true/>
<key>com.apple.security.hardened-process.dyld-ro</key>
<true/>
<key>com.apple.security.hardened-process.enhanced-security-version</key>
<integer>1</integer>
<key>com.apple.security.hardened-process.platform-restrictions</key>
<integer>2</integer>
<key>keychain-access-groups</key>
<array>
<string>$(AppIdentifierPrefix)$(SIGNAL_BUNDLEID_PREFIX).signal</string>

8
SignalShareExtension/SignalShareExtension.entitlements
View File

@ -15,6 +15,14 @@
<string>group.$(SIGNAL_BUNDLEID_PREFIX).signal.group</string>
<string>group.$(SIGNAL_BUNDLEID_PREFIX).signal.group.staging</string>
</array>
<key>com.apple.security.hardened-process</key>
<true/>
<key>com.apple.security.hardened-process.dyld-ro</key>
<true/>
<key>com.apple.security.hardened-process.enhanced-security-version</key>
<integer>1</integer>
<key>com.apple.security.hardened-process.platform-restrictions</key>
<integer>2</integer>
<key>keychain-access-groups</key>
<array>
<string>$(AppIdentifierPrefix)$(SIGNAL_BUNDLEID_PREFIX).signal</string>