Skip to content

Remove the deprecated public key algorithm API - #375

Merged
alexanderdibenedetto merged 2 commits into
adb/introduce-lintingfrom
adb/remove-deprecated-properties-and-fix-naming
Oct 23, 2026
Merged

alexanderdibenedetto merged 2 commits into
adb/introduce-lintingfrom
adb/remove-deprecated-properties-and-fix-naming

Conversation

@alexanderdibenedetto

Copy link
Copy Markdown
Contributor

Remove:
kTSKPublicKeyAlgorithms, TSKSupportedAlgorithm and the kTSKAlgorithm*
constants have been deprecated since 1.6.0. Configs that still set
TSKPublicKeyAlgorithms keep working because the parser ignores unknown keys.

Also delete the unused internal TSKPublicKeyAlgorithm.h and rename
TSKPublicKeyAlgorithmTests to TSKSPKIHashCacheTests, after the class it tests.

Alexander DiBenedetto added 2 commits October 22, 2026 16:06
kTSKPublicKeyAlgorithms, TSKSupportedAlgorithm and the kTSKAlgorithm*
constants have been deprecated since 1.6.0. Configs that still set
TSKPublicKeyAlgorithms keep working because the parser ignores unknown keys.

Also delete the unused internal TSKPublicKeyAlgorithm.h and rename
TSKPublicKeyAlgorithmTests to TSKSPKIHashCacheTests, after the class it tests.
@alexanderdibenedetto
alexanderdibenedetto added this pull request to stack #374 October 22, 2026 21:07

@claude claude Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I reviewed this PR and didn't find any bugs. It removes exported public symbols, though, so any client that still references them will stop compiling. A maintainer should confirm this goes into a release that's allowed to break source compatibility.

What was reviewed:

  • Searched for leftover references to kTSKPublicKeyAlgorithms, TSKSupportedAlgorithm, the kTSKAlgorithm* constants and TSKPublicKeyAlgorithm outside docs/. There are none in sources, tests, Package.swift or the project file.
  • Checked that configs which still set TSKPublicKeyAlgorithms keep working. parse_configuration.m looks up each known key by name, so an extra key is ignored. The only exception is a domain with TSKExcludeSubdomainFromParentPolicy set, which already rejected this key before the change.
  • Checked the test rename in all five test targets in the pbxproj (file reference IDs are kept), and the NUL-safe existing() filter in scripts/lint.sh.
  • The generated HTML in docs/documentation still lists the removed symbols until it is regenerated.
Extended reasoning...

The change deletes deprecated public constants and a typedef from TSKTrustKitConfig.h/.m, removes an unused internal header, renames a test file, and filters deleted paths out of lint.sh. It touches no runtime pinning or crypto logic: SPKI hashing and validation are unchanged, and the parser never read the removed key. The code is mechanical and consistent across the project file. I deferred because removing exported symbols breaks the public API for downstream clients, and whether to do that now is a versioning call for a maintainer.

@alexanderdibenedetto
alexanderdibenedetto merged commit 405c4a3 into v4-0-0 Oct 23, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants