[alexanderdibenedetto]

Also:

• Stop building arm64e and arm64e.x1 simulator slices
• Introduce Swift (internal only) to TrustKit (Read the certificate's SPKI in Swift)
• Replace the Python helper scripts

[claude]

Beyond the inline findings, I also checked the new DER walker in TrustKit/Swift/SubjectPublicKeyInfo.swift for out-of-bounds reads and length overflow. I found neither: every read stays inside the parent element's range, and long-form lengths are capped at 3 bytes, so the arithmetic can't overflow.

Extended reasoning...

This is a brief note on what was ruled out. It covers the bounds and length handling in readElement and subjectPublicKeyInfoRange, which the inline findings don't address.

Findings marked 🟡 are optional suggestions and need no follow-up push.

Additional findings (outside the current diff — GitHub can't attach inline comments there):

• 🟡 TrustKit/Pinning/TSKSPKIHashCache.m — Apps upgrading to this version keep pinning against hashes computed the old way, for any certificate already in the on-disk SPKI cache. The cache is keyed only by certificate bytes and is loaded from spki-hash.cache at init. So a hit at line 117 returns the old rebuilt-header hash and skips the new as-encoded hash at line 126. Fix: make sure no entry computed by the old algorithm is reused, for example by versioning the cache filename kTSKSPKISharedHashCacheIdentifier (TSKSPKIHashCache.h:28) or discarding the persisted file on upgrade.

  Why this was flagged

  The trigger is a device that ran an earlier TrustKit and cached a certificate whose SPKI as encoded differs from the old rebuilt form. Examples are an RSA key whose AlgorithmIdentifier is rsassaPss or omits the NULL parameter. The old code always prepended the fixed rsaEncryption header (rsa2048Asn1Header etc.). After upgrading, initWithIdentifier: loads the persisted dictionary via loadSPKICacheFromFileSystem (TSKSPKIHashCache.m:91, 177-190). _hashSubjectPublicKeyInfoFromCertificate: returns the cached old hash at lines 115-120 without calling TSKSubjectPublicKeyInfo. The cache is never evicted, so those devices pin against the old hash indefinitely. Fresh installs compute the new as-encoded hash, which matches what get_pin_from_certificate.sh produces. Devices with the same config therefore disagree: upgraded users can get pin failures (or matches) that fresh installs do not. No cache version or migration exists in the diff.

  Verification: nit. initWithIdentifier: loads the persisted dictionary at TSKSPKIHashCache.m:91, and the diff did not change that filename and added no version or format marker. A hit returns early at lines 117-120, so the new path at lines 126-134 never runs for those certificates. In the divergent cases the upgraded device behaves just as it does on the base branch.

[Copilot]

🟡 Changes recommended

Persisted hashes need invalidation, and the pin helper must preserve the same SPKI bytes as the runtime.

2 open issues

• Invalidate persisted SPKI cache after hash algorithm changes · New
• Hash original SPKI bytes instead of re-encoding the public key · New

What changed in this PR

This PR changes TrustKit to hash each certificate’s encoded Subject Public Key Info directly, replacing reconstruction from algorithm-specific headers.

Changes:

• Adds a Swift SPKI extractor with P-521 and malformed-input tests.
• Integrates Swift into package and Xcode builds and excludes arm64e simulator slices.
• Replaces the Python pin helper with a shell script and updates setup documentation.

File	Description
TrustKitTests/​TSKPublicKeyAlgorithmTests.m	Adds P-521 and malformed-certificate tests.
TrustKit/​Swift/​SubjectPublicKeyInfo.swift	Extracts the original SPKI DER bytes.
TrustKit/​Pinning/​TSKSPKIHashCache.m	Hashes extracted SPKI instead of rebuilding it.
TrustKit/​Pinning/​pinning_utils.m	Removes the unused public-key helper.
TrustKit/​Pinning/​pinning_utils.h	Removes the helper’s declaration.
TrustKit.xcodeproj/​project.pbxproj	Integrates Swift and test resources; excludes simulator architectures.
Package.swift	Adds the Swift target and requires Swift tools 6.0.
get_pin_from_certificate.sh	Adds an OpenSSL-based pin helper.
get_pin_from_certificate.py	Removes the Python pin helper.
generate_test_certificates.py	Removes the Python certificate generator.
docs/​getting-started.md	Documents the shell helper and static-framework Swift linking.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The pin helper can exit without printing a pin for large certificates because its byte-extraction pipeline triggers SIGPIPE.

1 open issue

• Avoid SIGPIPE when reading large certificate extensions · New

2 resolved since last review

• Hash original SPKI bytes instead of re-encoding the public key
• Invalidate persisted SPKI cache after hash algorithm changes

_{Review effort: Balanced}