Merge pull request #34 from Rudde/check-signing-time

adding check on signatures signing time

Author: tomasmcguinness

PassValidator.Console/VerbosePrinter.cs

@@ -25,6 +25,7 @@ public static void PrintValidationResults(bool isVerbose, ValidationResult valid
         System.Console.WriteLine($"\tSigned By Apple: {validationResult.SignedByApple}");
         System.Console.WriteLine($"\tSignature Expiration Date: {validationResult.SignatureExpirationDate}");
         System.Console.WriteLine($"\tSignature Valid: {validationResult.SignatureValid}");
+        System.Console.WriteLine($"\tSigning Time: {validationResult.SigningTime?.ToString("o") ?? "<null>"}");
         System.Console.WriteLine($"\tHas Icon 3x: {validationResult.HasIcon3x}");
         System.Console.WriteLine($"\tHas Icon 2x: {validationResult.HasIcon2x}");
         System.Console.WriteLine($"\tHas Icon 1x: {validationResult.HasIcon1x}");

PassValidator.Validator/ValidationResult.cs

@@ -19,6 +19,8 @@ public class ValidationResult
     public string SignatureExpirationDate { get; set; }
 
     public bool SignatureValid { get; set; }
+    
+    public DateTime? SigningTime { get; set; }
 
     public bool HasIcon3x { get; set; }
 
@@ -69,4 +71,4 @@ public class ValidationResult
 
     public bool AuthenticationTokenCorrectLength { get; internal set; }
     public bool PassKitCertificateIssuedByApple { get; internal set; }
-}
+}

PassValidator.Validator/Validator.cs

@@ -1,6 +1,6 @@
 using System.IO.Compression;
+using System.Security.Cryptography;
 using System.Security.Cryptography.Pkcs;
-using System.Security.Cryptography.X509Certificates;
 using System.Text;
 using Newtonsoft.Json.Linq;
 using Org.BouncyCastle.Asn1;
@@ -157,6 +157,11 @@ public ValidationResult Validate(byte[] passContent)
             result.SignatureValid = false;
         }
 
+        if (result.SignatureValid)
+        {
+            result.SigningTime = GetSigningTime(signedCms);
+        }
+
         var signer = signedCms.SignerInfos[0];
 
         // There are two certificates attached. One is the PassType certificate. One is the WWDR certificate.
@@ -280,4 +285,31 @@ public static List<string> Parse(string data, string delimiter)
         }
         return result;
     }
-}
+
+    private static DateTime? GetSigningTime(SignedCms cms)
+    {
+        try
+        {
+            foreach (SignerInfo signer in cms.SignerInfos)
+            {
+                foreach (CryptographicAttributeObject attr in signer.SignedAttributes)
+                {
+                    if (attr.Oid.Value == "1.2.840.113549.1.9.5")
+                    {
+                        foreach (var value in attr.Values)
+                        {
+                            var pkcs9 = new Pkcs9SigningTime(value.RawData);
+                            return pkcs9.SigningTime;
+                        }
+                    }
+                }
+            }
+        }
+        catch (Exception)
+        {
+            // ignored
+        }
+
+        return null;
+    }
+}

PassValidator.Web/Views/Home/Index.cshtml

@@ -154,6 +154,7 @@
             <h3>Signature</h3>
             <ul>
                 <li><i data-bind="css: getStyle(hasMatchingPassTypeIdentifier())"></i>PassTypeIdentifier in signature matches value in pass.json</li>
+                <li><i data-bind="css: getStyle(hasSigningTime())"></i>Signature has signing time</li>
                 <li><i data-bind="css: getStyle(hasMatchingTeamIdentifier())"></i>TeamIdentifier in signature matches value in pass.json</li>
             </ul>
             <h3>WWDR Certificate</h3>
@@ -272,6 +273,7 @@
 
                             self.hasMatchingPassTypeIdentifier(jsonResponse.passTypeIdentifierMatches);
                             self.hasMatchingTeamIdentifier(jsonResponse.teamIdentifierMatches);
+                            self.hasSigningTime(jsonResponse.signingTime);
 
                             self.wwdrCertificateFound(jsonResponse.wwdrCertificateFound);
                             self.wwdrCertificateIsCorrectVersion(jsonResponse.wwdrCertificateIsCorrectVersion);
@@ -321,6 +323,7 @@
 
             self.hasMatchingPassTypeIdentifier = ko.observable(false);
             self.hasMatchingTeamIdentifier = ko.observable(false);
+            self.hasSigningTime = ko.observable(false);
             self.signedByApple = ko.observable(false);
 
             self.passKitCertificateFound = ko.observable(false);