Security macOS xcode27.0 b5

#Security.framework

diff -ruN /Applications/Xcode_27.0.0-beta4.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/CSCommon.h /Applications/Xcode_27.0.0-beta5.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/CSCommon.h
--- /Applications/Xcode_27.0.0-beta4.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/CSCommon.h	2026-07-11 21:43:13
+++ /Applications/Xcode_27.0.0-beta5.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/CSCommon.h	2026-08-04 00:59:09
@@ -56,8 +56,15 @@
 
 CF_ASSUME_NONNULL_BEGIN
 
-// The maximum number of signatures allowed in a SuperBlob
-#define kSecCS_MAX_SIGNATURES 2
+/*!
+	@const kSecCSMaxSignatures
+	The maximum number of signatures a single code object can carry.
+	Defined as an enumerator so it remains an integer constant expression usable
+	for array sizes and switch labels.
+*/
+enum {
+	kSecCSMaxSignatures = 2,
+};
 
 /*
 	Code Signing specific OSStatus codes.
@@ -254,8 +261,37 @@
 	kSecCSApplyEmbeddedPolicy = 1 << 25, /* Apply Embedded (iPhone) policy regardless of the platform we're running on */
 	kSecCSStripDisallowedXattrs = 1 << 24, /* Strip disallowed xattrs, such as com.apple.FinderInfo and com.apple.ResourceFork */
 	kSecCSMatchGuestRequirementInKernel = 1 << 23, /* Request matching the provided requirement in kernel against the running guest rather than on disk*/
-	kSecCSUseSignature1 = 1 << 22, /* use signature slot 1 (RSA) for validation and information retrieval */
-	kSecCSUseSignature2 = 1 << 21, /* use signature slot 2 (PQ) for validation and information retrieval */
+#if !defined(__APPLE_BLEACH_SDK__) && !defined(__OPEN_SOURCE__)
+	/*!
+		@constant kSecCSUseClassicalSignature
+		When passed to a validation or inspection call on a dual-signed code
+		object, select the classical (RSA) signature slot for validation and
+		information retrieval. Mutually exclusive with kSecCSUsePostQuantumSignature;
+		passing both returns errSecCSInvalidFlags.
+	*/
+	kSecCSUseClassicalSignature
+		API_AVAILABLE(macos(27.0), ios(27.0), tvos(27.0), watchos(27.0), visionos(27.0))
+		= 1 << 22, /* use the classical (RSA) signature slot for validation and information retrieval */
+
+	/*!
+		@constant kSecCSUsePostQuantumSignature
+		When passed to a validation or inspection call on a dual-signed code
+		object, select the post-quantum (PQ) signature slot for validation and
+		information retrieval. Mutually exclusive with kSecCSUseClassicalSignature.
+	*/
+	kSecCSUsePostQuantumSignature
+		API_AVAILABLE(macos(27.0), ios(27.0), tvos(27.0), watchos(27.0), visionos(27.0))
+		= 1 << 21, /* use the post-quantum (PQ) signature slot for validation and information retrieval */
+
+	/* Deprecated aliases retained for source compatibility with existing internal
+	   adopters; prefer the semantic names above. */
+	kSecCSUseSignature1
+		API_UNAVAILABLE(macos, ios, tvos, watchos, visionos)
+		= kSecCSUseClassicalSignature,
+	kSecCSUseSignature2
+		API_UNAVAILABLE(macos, ios, tvos, watchos, visionos)
+		= kSecCSUsePostQuantumSignature,
+#endif // !defined(__APPLE_BLEACH_SDK__) && !defined(__OPEN_SOURCE__)
 };
 
 
diff -ruN /Applications/Xcode_27.0.0-beta4.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecCode.h /Applications/Xcode_27.0.0-beta5.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecCode.h
--- /Applications/Xcode_27.0.0-beta4.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecCode.h	2026-07-11 21:43:13
+++ /Applications/Xcode_27.0.0-beta5.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecCode.h	2026-08-04 00:59:09
@@ -478,7 +478,19 @@
 extern const CFStringRef kSecCodeInfoCertificates;	/* Signing */
 extern const CFStringRef kSecCodeInfoChangedFiles;	/* Content */
 extern const CFStringRef kSecCodeInfoCMS;			/* Signing */
+/*!
+	@const kSecCodeInfoTotalSignatures
+	Key in the dictionary returned by SecCodeCopySigningInformation. The value
+	is a CFNumber giving the total number of signature slots present on the code
+	object (ranging from 1 to kSecCSMaxSignatures).
+*/
 extern const CFStringRef kSecCodeInfoTotalSignatures; /* Signing */
+/*!
+	@const kSecCodeInfoChosenSignature
+	Key in the dictionary returned by SecCodeCopySigningInformation. The value
+	is a CFNumber containing the 1-based index of the signature slot that was
+	selected for validation and information retrieval.
+*/
 extern const CFStringRef kSecCodeInfoChosenSignature; /* Signing */
 extern const CFStringRef kSecCodeInfoDesignatedRequirement; /* Requirement */
 extern const CFStringRef kSecCodeInfoEntitlements;	/* generic */
@@ -505,6 +517,12 @@
 extern const CFStringRef kSecCodeInfoCdHashes;		/* generic */
 extern const CFStringRef kSecCodeInfoRuntimeVersion; /*generic */
 extern const CFStringRef kSecCodeInfoStapledNotarizationTicket; /* content */
+/*!
+	@const kSecCodeInfoSignerInfoSKID
+	Key in the dictionary returned by SecCodeCopySigningInformation. The value
+	is a CFData containing the Subject Key Identifier (SKID) of the leaf signing
+	certificate. Useful for looking up detached certificates.
+*/
 extern const CFStringRef kSecCodeInfoSignerInfoSKID; /* Signing */
 
 OSStatus SecCodeCopySigningInformation(SecStaticCodeRef code, SecCSFlags flags,