8 skills · sorted by relevance
bu skill covers implementing code signing for build artifacts to ensure integrity and authenticity throughout the software supply chain. It addresses signing binaries, packages, and containers using GPG, Sigstore, and platform-specific signing tools, establishing trust chains, and verifying signatures in Dağıt:ment pipelines.
The English summary is being prepared. Showing the original description.
Build a two-tier certificate authority with OpenSSL and Python, separating the offline root from the issuing authority. Covers server and client certificates, revocation checks, and policies that define certificate usage and trust.
Configure code signing for macOS and Windows binaries with notarization.
The English summary is being prepared. Showing the original description.
Builds and ships iOS/macOS apps with XcodeGen, SwiftUI and SPM: Xcode build fixes, device deployment, Apple Developer signing/notarization, CI/CD pipelines. Use for XcodeGen project.yml setup, "Library not loaded @rpath" crashes, code-signing errors (Error -25294, adhoc fallback), or Electron notarization failures. Not for TCC permission dialogs (use macos-permissions) or disk cleanup (use macos-cleaner).
The English summary is being prepared. Showing the original description.
macOS attack hunting - foothold to root/persistence on a macOS host. TCC/Gatekeeper/SIP bypass, keychain + credential loot, code-signing/entitlements abuse, XPC/dylib/library injection, launch-constraint evasion, MDM/installer abuse. Wiki-first, FIND schema output.
The English summary is being prepared. Showing the original description.
Diagnose and fix iOS code-signing, provisioning, and entitlement failures — the "no signing certificate / no profiles / doesn't match / get-task-allow" family, using codesign/security to inspect what's actually signed. Use when an archive, upload, or CI build fails on signing.
The English summary is being prepared. Showing the original description.
Analyzes Windows Authenticode signatures on PE files: checking for a signature, reading the signer certificate chain, detecting revoked/expired/stolen certs, and recognizing signature-stripping and catalog-signing abuse. Activates for requests to analyze a code signature, verify Authenticode, or assess signer trust on a PE.
The English summary is being prepared. Showing the original description.
Statically analyzes macOS Mach-O malware: parsing the header and load commands, handling fat/universal binaries, reading linked dylibs and entitlements, and checking code signatures to infer capability and trust. Activates for requests to analyze a Mach-O binary, inspect macOS malware, or parse load commands and entitlements.
The English summary is being prepared. Showing the original description.