SecTransform is deprecated in macOS 12

[michaeljtsai]

I don't think there are any other macOS APIs that currently support DSA. Time to bring back OpenSSL or is there a smaller third-party library that does DSA?

[glebd]

That's unfortunate. OpenSSL sounds like the easiest option.

[DivineDominion]

https://github.com/krzyzanowskim/OpenSSL might be the best dependency for this, no?

Other resources

My last personal encounter with OpenSSL was in https://github.com/SwiftGit2/SwiftGit2 -- it has an ugly way to build OpenSSL with build scripts that I regularly forget how to change :)

In contrast, https://github.com/light-tech/LibGit2-On-iOS sports a build script that builds OpenSSL with a single function. That can take a while, though!

https://github.com/nferruzzi/openssl pointed to

• ... a stand-alone build script repo: https://github.com/passepartoutvpn/openssl-apple
• ... and the https://github.com/Kitura/OpenSSL shim that wraps the OpenSSL package via apt (Linux) or brew. Interesting, but would only work as a dev dependency, not as a static library as part of a framework to use in an app if I understand this correctly.

[DivineDominion]

Swift package we might use:
https://github.com/krzyzanowskim/OpenSSL

[jeff-h]

Does this mean the current release of Cocoafob doesn't work on macOS 12+?

[DivineDominion]

@jeff-h It still works fine, but it's discouraged. As with most Apple API deprecations, this should be around for a couple of years, and might never be removed completely to not break old programs.

[apparentsoft]

There's the https://github.com/apple/swift-crypto library that appears to do digests (SHA1, for example). Could it be used?
By the way, my apps still use the OpenSSL-based verifier. I was looking to update it to not use OpenSSL and have discovered that it's not a good idea at this point :).

[DivineDominion]

@apparentsoft Does Apple CryptoKit or swift-crypto sport backwards-compatible DSA? Then this would be a good idea :)

[michaeljtsai]

I don’t think they support DSA, on the grounds that it’s too old and insecure. Personally, I still like it for license purposes because the signatures are short.