dandri/simplex-chat
1
0
Fork 0
mirror of https://github.com/simplex-chat/simplex-chat.git synced 2026-10-16 19:40:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

badge-service: accept a list of Apple roots (#7707)

Browse Source 
* badge-service: accept a list of Apple roots

* badge-service: document root_certificates

---------

Co-authored-by: spaced4ndy <8711996+spaced4ndy@users.noreply.github.com>
This commit is contained in:
sh
2026-10-14 10:43:53 +00:00
committed by GitHub
co-authored by spaced4ndy
parent 5db181c10e
commit daa7c4f3d8
10 changed files with 76 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/protocol/badges-rpc.md
+1 -1
View File
@@ -44,7 +44,7 @@ The client never states what is signed. The tier is that of whatever funded the
- **App Store.** Apple is verified offline, so it has no "not yet".
- `receipt_invalid`: a JWS that is not three base64url parts or names no `transactionId`; an `x5c` certificate that is not base64; a JWS signature that is not 64 bytes; a leaf whose signature does not verify against the intermediate; a JWS signature that does not verify against the leaf; a transaction with a `revocationDate`, refunded or revoked.
- `test_purchase`: refused by the service after the verifier vouched for it, a `Sandbox` transaction.
- `internal`: whatever this service's own configuration decides — an intermediate whose signature does not verify against the configured root, and another app's `bundleId`, since the configured root or bundle id may be the wrong one as likely as the receipt forged; a transaction from Xcode's StoreKit testing, which Xcode signs and not the App Store, so the configured root does not verify it; evidence in a shape this service does not know — a header that does not name `ES256` or carries no `x5c` of exactly three certificates, a certificate that does not decode, a leaf signature the intermediate's key cannot check, an algorithm or key type the library does not support, a chain without Apple's receipt-signing marker extensions, a leaf key that is not P-256, a payload with a missing or mistyped field or an unknown `environment`; the verifier's own failure or overrun; and, refused by the service, a verified transaction other than the one claimed, or a quantity other than 1.
- `internal`: whatever this service's own configuration decides — an intermediate whose signature verifies against none of the configured roots, and another app's `bundleId`, since a root may be missing or the bundle id wrong as likely as the receipt forged; a transaction from Xcode's StoreKit testing, which Xcode signs and not the App Store, so no configured root verifies it; evidence in a shape this service does not know — a header that does not name `ES256` or carries no `x5c` of exactly three certificates, a certificate that does not decode, a leaf signature the intermediate's key cannot check, an algorithm or key type the library does not support, a chain without Apple's receipt-signing marker extensions, a leaf key that is not P-256, a payload with a missing or mistyped field or an unknown `environment`; the verifier's own failure or overrun; and, refused by the service, a verified transaction other than the one claimed, or a quantity other than 1.
- `product_unavailable`: a product this service does not price — the verifier vouched for the transaction either way.
- `provider_not_configured`: the deployment has no `[apple]` section.
- **Google Play.** Only a purchase record is a verdict.