Release_iOS-17-0_macOS-14-0

declarative/declarations/assets/credentials/acme.yaml

@@ -0,0 +1,138 @@
+title: ACME Credential
+description: An ACME identity that should be generated by the device.
+payload:
+  credentialtype: com.apple.credential.acme
+  supportedOS:
+    iOS:
+      introduced: '17.0'
+    macOS:
+      introduced: '14.0'
+    tvOS:
+      introduced: '17.0'
+    watchOS:
+      introduced: '10.0'
+payloadkeys:
+- key: DirectoryURL
+  title: ACME directory URL
+  type: <string>
+  presence: required
+  content: Specifies the directory URL of the ACME server. Use the 'https' scheme
+    for the URL.
+- key: ClientIdentifier
+  title: Client identifier
+  type: <string>
+  presence: required
+  content: The server can use this as a nonce to prevent issuing multiple certificates.
+    It also indicates to the ACME server that the device has access to a valid client
+    identifier that the enterprise infrastructure issued. This can help the ACME server
+    determine whether to trust the device, however this is a relatively weak indication
+    because of the risk that an attacker may intercept and duplicate the client identifier.
+- key: KeySize
+  title: Key Size
+  type: <integer>
+  presence: required
+  content: The valid values for 'KeySize' depend on the values of 'KeyType' and 'HardwareBound'.
+    See those keys for specific requirements.
+- key: KeyType
+  title: Key Type
+  type: <string>
+  presence: required
+  rangelist:
+  - RSA
+  - ECSECPrimeRandom
+  content: |-
+    Specifies the type of key pair to generate.
+    'RSA' specifies an RSA key pair. If you set this value to 'RSA', set 'KeySize' in the range '[1024..4096]' inclusive and a multiple of '8', and set 'HardwareBound' to 'false'.
+    'ECSECPrimeRandom' specifies a key pair on the P-256, P-384 or P-521 curves as defined in FIPS Pub 186-4, and 'KeySize' determines the specific curve. If you set this value to 'ECSECPrimeRandom', set 'KeySize' to '256', '384', or '521'. The system only supports '256' and '384' for hardware bound keys.
+    The key size is '521', not '512', even though the other key sizes are multiples of '64'.
+- key: HardwareBound
+  title: Hardware Bound
+  type: <boolean>
+  presence: required
+  content: |-
+    If 'false', the private key isn't bound to the device.
+    If 'true', the private key is bound to the device. The Secure Enclave generates the key pair, and the private key is cryptographically entangled with a system key. This protects the private key from being exported.
+    If 'true', 'KeyType' needs to be 'ECSECPrimeRandom' and 'KeySize' needs to be '256' or '384'.
+    On macOS, this is a required key. Set the value to 'false'.
+- key: Subject
+  title: Subject
+  type: <array>
+  presence: required
+  content: |-
+    The device requests this subject for the certificate that the ACME server issues. The ACME server may override or ignore this field in the certificate it issues.
+    The representation of an X.500 name is an array of OID and value. For example, '/C=US/O=Apple Inc./CN=foo/1.2.5.3=bar' corresponds to:
+    '[ [ [”C”, “US”] ], [ [”O”, “Apple Inc.”] ], [ [ “CN”, “foo”] ], [ [ “1.2.5.3”, “bar” ] ] ]'
+    You can represent OIDs as dotted numbers or use shortcuts for country ('C'), locality ('L'), state ('ST'), organization ('O'), organizational unit ('OU'), and common name ('CN').
+  subkeys:
+  - key: ACMESubjectArrayInnerArray
+    title: Array Inside ACME Subject Array
+    type: <array>
+    subkeys:
+    - key: ACMESubjectArrayPair
+      title: Subject Array Pair
+      type: <array>
+      subkeys:
+      - key: ACMESubjectArrayPairItem
+        title: ACME Subject Array Pair Item
+        type: <string>
+        repetition:
+          min: 2
+          max: 2
+        content: One item in the array representing a pair of OID and value
+- key: SubjectAltName
+  title: Subject Alt Name
+  type: <dictionary>
+  presence: optional
+  content: Specifies the subject's alternative name that the device requests for the
+    certificate that the ACME server issues. The ACME server may override or ignore
+    this field in the certificate it issues.
+  subkeys:
+  - key: rfc822Name
+    title: RFC 822 Name
+    type: <string>
+    presence: optional
+    content: The RFC 822 email address.
+  - key: dNSName
+    title: DNS Name
+    type: <string>
+    presence: optional
+    content: The DNS name.
+  - key: uniformResourceIdentifier
+    title: URI
+    type: <string>
+    presence: optional
+    content: The uniform resource identifier.
+  - key: ntPrincipalName
+    title: NT Principal Name
+    type: <string>
+    presence: optional
+    content: The NT principal name.
+- key: UsageFlags
+  title: Key Usage
+  type: <integer>
+  presence: optional
+  content: |-
+    The device requests this key usage for the certificate that the ACME server issues. The ACME server may override or ignore this field in the certificate it issues.
+    The value is a bit field. Bit '0x01' indicates digital signature, and bit '0x04' indicates key encipherment.
+- key: ExtendedKeyUsage
+  title: Extended Key Usage
+  type: <array>
+  presence: optional
+  content: |-
+    The device requests this extended key usage for the certificate that the ACME server issues. The ACME server may override or ignore this field in the certificate it issues.
+    The value is an array of strings. Each string is an OID in dotted notation. For example, '[”1.3.6.1.5.5.7.3.2”, “1.3.6.1.5.5.7.3.4”]' indicates client authentication and email protection.
+  subkeys:
+  - key: OID
+    type: <string>
+    presence: optional
+- key: Attest
+  title: Attest
+  type: <boolean>
+  presence: optional
+  default: false
+  content: If 'true', the device provides attestations that describe the device and
+    the generated key to the ACME server. The server can use the attestations as strong
+    evidence that the key is bound to the device, and that the device has properties
+    listed in the attestation. The server can use that as part of a trust score to
+    decide whether to issue the requested certificate. When 'Attest' is 'true', set
+    'HardwareBound' to 'true'. On macOS, set this key, if present, to 'false'.

declarative/declarations/assets/credentials/identity.yaml

@@ -0,0 +1,22 @@
+title: Identity Credential
+description: 'Data for a PKCS #12 password-protected identity.'
+payload:
+  credentialtype: com.apple.credential.identity
+  supportedOS:
+    iOS:
+      introduced: '17.0'
+    macOS:
+      introduced: '14.0'
+    tvOS:
+      introduced: '17.0'
+    watchOS:
+      introduced: '10.0'
+payloadkeys:
+- key: Password
+  type: <string>
+  presence: required
+  content: 'The password required to decrypt the PKCS #12 identity data.'
+- key: Identity
+  type: <data>
+  presence: required
+  content: 'The PKCS #12 identity data.'

declarative/declarations/assets/credentials/scep.yaml

@@ -0,0 +1,125 @@
+title: SCEP Credential
+description: A SCEP identity that should be generated by the device.
+payload:
+  credentialtype: com.apple.credential.scep
+  supportedOS:
+    iOS:
+      introduced: '17.0'
+    macOS:
+      introduced: '14.0'
+    tvOS:
+      introduced: '17.0'
+    watchOS:
+      introduced: '10.0'
+payloadkeys:
+- key: URL
+  title: URL
+  type: <string>
+  presence: required
+  content: The SCEP URL.
+- key: Name
+  title: Name
+  type: <string>
+  presence: optional
+  content: Any string that the SCEP server recognizes. For example, it could be a
+    domain name such as 'example.org'. If a certificate authority has multiple CA
+    certificates, you can use this field to specify the required certificate.
+- key: Subject
+  title: Subject
+  type: <array>
+  presence: optional
+  content: |-
+    The representation of an X.500 name is an array of OID and value. For example, '/C=US/O=Apple Inc./CN=foo/1.2.5.3=bar' corresponds to:
+    '[ [ [”C”, “US”] ], [ [”O”, “Apple Inc.”] ], [ [ “CN”, “foo”] ], [ [ “1.2.5.3”, “bar” ] ] ]'
+    You can represent OIDs as dotted numbers or use shortcuts for country ('C'), locality ('L'), state ('ST'), organization ('O'), organizational unit ('OU'), and common name ('CN').
+  subkeys:
+  - key: SCEPSubjectArrayInnerArray
+    title: Array Inside SCEP Subject Array
+    type: <array>
+    subkeys:
+    - key: SCEPSubjectArrayPair
+      title: Subject Array Pair
+      type: <array>
+      subkeys:
+      - key: SCEPSubjectArrayPairItem
+        title: SCEP Subject Array Pair Item
+        type: <string>
+        repetition:
+          min: 2
+          max: 2
+        content: One item in the array representing a pair of OID and value
+- key: Challenge
+  title: Challenge
+  type: <string>
+  presence: optional
+  content: A preshared secret.
+- key: Keysize
+  title: Key Size
+  type: <integer>
+  presence: optional
+  rangelist:
+  - 1024
+  - 2048
+  - 4096
+  default: 1024
+  content: The key size in bits, either '1024', '2048', or '4096'.
+- key: Key Type
+  title: Key Type
+  type: <string>
+  presence: optional
+  default: RSA
+  content: The key type, which always has the value 'RSA'.
+- key: Key Usage
+  title: Key Usage
+  type: <integer>
+  presence: optional
+  default: 0
+  content: 'A bitmask that specifies the use of the key: ''1'' is signing, ''4'' is
+    encryption, and ''5'' is both signing and encryption. Some certificate authorities,
+    such as Windows CA, support only encryption or signing, but not both at the same
+    time.'
+- key: CAFingerprint
+  title: Fingerprint
+  type: <data>
+  presence: optional
+  content: The fingerprint of the Certificate Authority certificate.
+- key: Retries
+  title: Retries
+  type: <integer>
+  presence: optional
+  default: 3
+  content: The number of times the device should retry if the server sends a 'PENDING'
+    response.
+- key: RetryDelay
+  title: Retry Delay
+  type: <integer>
+  presence: optional
+  default: 10
+  content: The number of seconds to wait between subsequent retries. The system makes
+    the first retry without this delay.
+- key: SubjectAltName
+  title: Subject Alt Name
+  type: <dictionary>
+  presence: optional
+  content: The subject's alternative name for the certificate.
+  subkeys:
+  - key: rfc822Name
+    title: RFC 822 Name
+    type: <string>
+    presence: optional
+    content: The RFC 822 email address.
+  - key: dNSName
+    title: DNS Name
+    type: <string>
+    presence: optional
+    content: The DNS name.
+  - key: uniformResourceIdentifier
+    title: URI
+    type: <string>
+    presence: optional
+    content: The uniform resource identifier.
+  - key: ntPrincipalName
+    title: NT Principal Name
+    type: <string>
+    presence: optional
+    content: The NT principal name.

declarative/declarations/assets/credentials/usernameandpassword.yaml

@@ -1,4 +1,4 @@
-title: User Name and Password Credentials
+title: User Name and Password Credential
 description: Data describing a credential representing a user name and password.
 payload:
   credentialtype: com.apple.credential.usernameandpassword
@@ -9,12 +9,14 @@ payload:
       introduced: '13.0'
     tvOS:
       introduced: '16.0'
+    watchOS:
+      introduced: '10.0'
 payloadkeys:
 - key: UserName
   type: <string>
   presence: required
-  content: The user's user name for the credential.
+  content: The user name for this credential.
 - key: Password
   type: <string>
   presence: optional
-  content: The user's password for the credential.
+  content: The password for this credential.