mirror of
https://github.com/lucannez64/darling-lol.git
synced 2026-10-26 19:47:42 +00:00
lucannez64andClaude Opus 5.5
a1c00ee884
Security reads the system trust domain from /System/Library/Keychains/SystemRootCertificates.keychain and SystemTrustSettings.plist (TrustSettingsSchema.h). Darling ships neither, so SecTrustSettingsCopyCertificates(kSecTrustSettingsDomainSystem) returns errSecNoTrustSettings (-25263); Chromium's known_roots_mac and Riot's CertBundle then report that they cannot read the system roots. ensure-darling-root-certificates.py parses each host root with a minimal DER walker and writes the trust record keyed by the uppercase SHA-1, with the encoded issuer Name, the serial INTEGER's content octets, modDate and an empty (unrestricted) trustSettings array. The keychain is built with the guest security tool in one darling shell, in a private temporary directory, and published from inside the guest so a running Darling sees it, falling back to the host when the guest cannot write the directory. A digest stamp skips later runs without starting Darling. The launcher warns and continues on failure; install-runtime.sh runs it before stopping Darling. Co-Authored-By: Claude Opus 5.5 <[email protected]>