1  import Foundation
  2  import os
  3  
  4  let logger = Logger(subsystem: "com.apple.security.trustedpeers", category: "tpctl")
  5  
  6  // This should definitely use the ArgumentParser library from the Utility package.
  7  // However, right now that's not accessible from this code due to build system issues.
  8  // Do it the hard way.
  9  
 10  let programName = CommandLine.arguments[0]
 11  var args: ArraySlice<String> = CommandLine.arguments[1...]
 12  
 13  var context: String = OTDefaultContext
 14  var container: String = "com.apple.security.keychain"
 15  
 16  // Only used for prepare, but in the absence of a real command line library this is the easiest way to get them
 17  var modelID: String?
 18  var machineID: String?
 19  var epoch: UInt64 = 1
 20  var bottleSalt: String = ""
 21  
 22  // Only used for join, establish and update
 23  var preapprovedKeys: [Data]?
 24  var deviceName: String?
 25  var serialNumber: String?
 26  var osVersion: String?
 27  var policySecrets: [String: Data]?
 28  
 29  enum Command {
 30      case dump
 31      case depart
 32      case distrust(Set<String>)
 33      case join(Data, Data)
 34      case establish
 35      case localReset
 36      case prepare
 37      case healthInquiry
 38      case update
 39      case reset
 40      case validate
 41      case viableBottles
 42      case vouch(String, Data, Data, Data, Data)
 43      case vouchWithBottle(String, Data, String)
 44      case allow(Set<String>, Bool)
 45      case supportApp
 46  }
 47  
 48  func printUsage() {
 49      print("Usage:", (CommandLine.arguments[0] as NSString).lastPathComponent,
 50            "[--container CONTAINER] [--context CONTEXT] COMMAND")
 51      print()
 52      print("Commands:")
 53      print("  allow [--idms] MACHINEID ...")
 54      print("                            Set the (space-separated) list of machine IDs allowed in the account. If --idms is provided, append the IDMS trusted device list")
 55      print("  dump                      Print the state of the world as this peer knows it")
 56      print("  depart                    Attempt to depart the account and mark yourself as untrusted")
 57      print("  distrust PEERID ...       Distrust one or more peers by peer ID")
 58      print("  establish                 Calls Cuttlefish Establish, creating a new account-wide trust arena with a single peer (previously generated with prepare")
 59      print("  healthInquiry             Request peers to check in with reportHealth")
 60      print("  join VOUCHER VOUCHERSIG   Join a circle using this (base64) voucher and voucherSig")
 61      print("  local-reset               Resets the local cuttlefish database, and ignores all previous information. Does not change anything off-device")
 62      print("  prepare [--modelid MODELID] [--machineid MACHINEID] [--epoch EPOCH] [--bottlesalt BOTTLESALT]")
 63      print("                            Creates a new identity and returns its attributes. If not provided, modelid and machineid will be given some defaults (ignoring the local device)")
 64      print("  supportApp                Get SupportApp information from Cuttlefish")
 65      print("  update                    Fetch new information from Cuttlefish, and perform any actions this node deems necessary")
 66      print("  validate                  Vvalidate SOS and Octagon data structures from server side")
 67      print("  viable-bottles            Show bottles in preference order of server")
 68      print("  vouch PEERID PERMANENTINFO PERMANENTINFOSIG STABLEINFO STABLEINFOSIG")
 69      print("                            Create a voucher for a new peer. permanentInfo, permanentInfoSig, stableInfo, stableInfoSig should be base64 data")
 70      print("  vouchWithBottle BOTTLEID ENTROPY SALT")
 71      print("                            Create a voucher for the ego peer using the given bottle. entropy should be base64 data.")
 72      print("  reset                     Resets Cuttlefish for this account")
 73      print()
 74      print("Options applying to `join', `establish' and `update'")
 75      print("  --preapprove KEY...       Sets the (space-separated base64) list of public keys that are preapproved.")
 76      print("  --device-name NAME        Sets the device name string.")
 77      print("  --os-version VERSION      Sets the OS version string.")
 78      print("  --policy-version VERSION  Sets the policy version.")
 79      print("  --policy-secret NAME DATA Adds a name-value pair to policy secrets. DATA must be base-64.")
 80      print("Options applying to `vouch' and `join'")
 81      print("  --config FILE             Configuration file with json data.")
 82      print()
 83  }
 84  
 85  func exitUsage(_ code: Int32) -> Never {
 86      printUsage()
 87      exit(code)
 88  }
 89  
 90  func extractJSONData(dictionary: [String: Any], key: String) -> Data? {
 91      guard let b64string = dictionary[key] as? String else {
 92          return nil
 93      }
 94      guard let data = Data(base64Encoded: b64string) else {
 95          return nil
 96      }
 97      return data
 98  }
 99  
100  func jsonFromFile(filename: String) -> [String: Any] {
101      let data: Data
102      let json: [String: Any]?
103      do {
104          data = try Data(contentsOf: URL(fileURLWithPath: filename), options: .mappedIfSafe)
105          json = try JSONSerialization.jsonObject(with: data) as? [String: Any]
106      } catch {
107          print("Error: failed to parse json file \(filename): \(error)")
108          exit(EXIT_FAILURE)
109      }
110      guard let dictionary = json else {
111          print("Error: failed to get dictionary in file \(filename)")
112          exit(EXIT_FAILURE)
113      }
114      return dictionary
115  }
116  
117  var commands: [Command] = []
118  var argIterator = args.makeIterator()
119  var configurationData: [String: Any]?
120  
121  while let arg = argIterator.next() {
122      switch arg {
123      case "--container":
124          let newContainer = argIterator.next()
125          guard newContainer != nil  else {
126              print("Error: --container takes a value")
127              print()
128              exitUsage(1)
129          }
130          container = newContainer!
131  
132      case "--context":
133          let newContext = argIterator.next()
134          guard newContext != nil  else {
135              print("Error: --context takes a value")
136              print()
137              exitUsage(1)
138          }
139          context = newContext!
140  
141      case "--modelid":
142          let newModelID = argIterator.next()
143          guard newModelID != nil else {
144              print("Error: --modelid takes a value")
145              print()
146              exitUsage(1)
147          }
148          modelID = newModelID!
149  
150      case "--machineid":
151          let newMachineID = argIterator.next()
152          guard newMachineID != nil else {
153              print("Error: --machineid takes a value")
154              print()
155              exitUsage(1)
156          }
157          machineID = newMachineID!
158  
159      case "--epoch":
160          let newEpoch = argIterator.next()
161          guard newEpoch != nil else {
162              print("Error: --epoch takes a value")
163              print()
164              exitUsage(1)
165          }
166          epoch = UInt64(newEpoch!)!
167  
168      case "--bottlesalt":
169          let salt = argIterator.next()
170          guard salt != nil else {
171              print("Error: --bottlesalt takes a value")
172              print()
173              exitUsage(1)
174          }
175          bottleSalt = salt!
176  
177      case "--preapprove":
178          var newPreapprovedKeys: [Data] = []
179          while let arg = argIterator.next() {
180              let data = Data(base64Encoded: arg)
181              guard let key = data else {
182                  print("Error: preapproved keys must be base-64 data")
183                  exitUsage(1)
184              }
185              newPreapprovedKeys.append(key)
186          }
187          preapprovedKeys = newPreapprovedKeys
188  
189      case "--device-name":
190          guard let newDeviceName = argIterator.next() else {
191              print("Error: --device-name takes a string argument")
192              exitUsage(1)
193          }
194          deviceName = newDeviceName
195  
196      case "--serial-number":
197          guard let newSerialNumber = argIterator.next() else {
198              print("Error: --serial-number takes a string argument")
199              exitUsage(1)
200          }
201          serialNumber = newSerialNumber
202  
203      case "--os-version":
204          guard let newOsVersion = argIterator.next() else {
205              print("Error: --os-version takes a string argument")
206              exitUsage(1)
207          }
208          osVersion = newOsVersion
209  
210      case "--policy-version":
211          guard let _ = UInt64(argIterator.next() ?? "") else {
212              print("Error: --policy-version takes an integer argument")
213              exitUsage(1)
214          }
215          // Option ignored for now
216  
217      case "--policy-secret":
218          guard let name = argIterator.next(), let dataBase64 = argIterator.next() else {
219              print("Error: --policy-secret takes a name and data")
220              exitUsage(1)
221          }
222          guard let data = Data(base64Encoded: dataBase64) else {
223              print("Error: --policy-secret data must be base-64")
224              exitUsage(1)
225          }
226          if policySecrets == nil {
227              policySecrets = [:]
228          }
229          policySecrets![name] = data
230  
231      case "--config":
232          guard let filename = argIterator.next() else {
233              print("Error: --config file argument missing")
234              exitUsage(1)
235          }
236  
237          configurationData = jsonFromFile(filename: filename)
238  
239      case "--help":
240          exitUsage(0)
241  
242      case "dump":
243          commands.append(.dump)
244  
245      case "depart":
246          commands.append(.depart)
247  
248      case "distrust":
249          var peerIDs = Set<String>()
250          while let arg = argIterator.next() {
251              peerIDs.insert(arg)
252          }
253          commands.append(.distrust(peerIDs))
254  
255      case "establish":
256          commands.append(.establish)
257  
258      case "join":
259          let voucher: Data
260          let voucherSig: Data
261  
262          if let configuration = configurationData {
263              guard let voucherData = extractJSONData(dictionary: configuration, key: "voucher") else {
264                  print("Error: join needs a voucher")
265                  exitUsage(EXIT_FAILURE)
266              }
267              guard let voucherSigData = extractJSONData(dictionary: configuration, key: "voucherSig") else {
268                  print("Error: join needs a voucherSig")
269                  exitUsage(EXIT_FAILURE)
270              }
271              voucher = voucherData
272              voucherSig = voucherSigData
273          } else {
274              guard let voucherBase64 = argIterator.next() else {
275                  print("Error: join needs a voucher")
276                  print()
277                  exitUsage(1)
278              }
279  
280              guard let voucherData = Data(base64Encoded: voucherBase64) else {
281                  print("Error: voucher must be base-64 data")
282                  print()
283                  exitUsage(1)
284              }
285  
286              guard let voucherSigBase64 = argIterator.next() else {
287                  print("Error: join needs a voucherSig")
288                  print()
289                  exitUsage(1)
290              }
291  
292              guard let voucherSigData = Data(base64Encoded: voucherSigBase64) else {
293                  print("Error: voucherSig must be base-64 data")
294                  print()
295                  exitUsage(1)
296              }
297  
298              voucher = voucherData
299              voucherSig = voucherSigData
300          }
301          commands.append(.join(voucher, voucherSig))
302  
303      case "local-reset":
304          commands.append(.localReset)
305  
306      case "prepare":
307          commands.append(.prepare)
308  
309      case "healthInquiry":
310          commands.append(.healthInquiry)
311  
312      case "reset":
313          commands.append(.reset)
314  
315      case "update":
316          commands.append(.update)
317  
318      case "supportApp":
319          commands.append(.supportApp)
320  
321      case "validate":
322          commands.append(.validate)
323  
324      case "viable-bottles":
325          commands.append(.viableBottles)
326  
327      case "vouch":
328          let peerID: String
329          let permanentInfo: Data
330          let permanentInfoSig: Data
331          let stableInfo: Data
332          let stableInfoSig: Data
333  
334          if let configuration = configurationData {
335              guard let peerIDString = configuration["peerID"] as? String else {
336                  print("Error: vouch needs a peerID")
337                  exitUsage(EXIT_FAILURE)
338              }
339  
340              guard let permanentInfoData = extractJSONData(dictionary: configuration, key: "permanentInfo") else {
341                  print("Error: vouch needs a permanentInfo")
342                  exitUsage(EXIT_FAILURE)
343              }
344              guard let permanentInfoSigData = extractJSONData(dictionary: configuration, key: "permanentInfoSig") else {
345                  print("Error: vouch needs a permanentInfoSig")
346                  exitUsage(EXIT_FAILURE)
347              }
348              guard let stableInfoData = extractJSONData(dictionary: configuration, key: "stableInfo") else {
349                  print("Error: vouch needs a stableInfo")
350                  exitUsage(EXIT_FAILURE)
351              }
352              guard let stableInfoSigData = extractJSONData(dictionary: configuration, key: "stableInfoSig") else {
353                  print("Error: vouch needs a stableInfoSig")
354                  exitUsage(EXIT_FAILURE)
355              }
356  
357              peerID = peerIDString
358              permanentInfo = permanentInfoData
359              permanentInfoSig = permanentInfoSigData
360              stableInfo = stableInfoData
361              stableInfoSig = stableInfoSigData
362          } else {
363              guard let peerIDString = argIterator.next() else {
364                  print("Error: vouch needs a peerID")
365                  print()
366                  exitUsage(1)
367              }
368              guard let permanentInfoBase64 = argIterator.next() else {
369                  print("Error: vouch needs a permanentInfo")
370                  print()
371                  exitUsage(1)
372              }
373              guard let permanentInfoSigBase64 = argIterator.next() else {
374                  print("Error: vouch needs a permanentInfoSig")
375                  print()
376                  exitUsage(1)
377              }
378              guard let stableInfoBase64 = argIterator.next() else {
379                  print("Error: vouch needs a stableInfo")
380                  print()
381                  exitUsage(1)
382              }
383              guard let stableInfoSigBase64 = argIterator.next() else {
384                  print("Error: vouch needs a stableInfoSig")
385                  print()
386                  exitUsage(1)
387              }
388  
389              guard let permanentInfoData = Data(base64Encoded: permanentInfoBase64) else {
390                  print("Error: permanentInfo must be base-64 data")
391                  print()
392                  exitUsage(1)
393              }
394  
395              guard let permanentInfoSigData = Data(base64Encoded: permanentInfoSigBase64) else {
396                  print("Error: permanentInfoSig must be base-64 data")
397                  print()
398                  exitUsage(1)
399              }
400              guard let stableInfoData = Data(base64Encoded: stableInfoBase64) else {
401                  print("Error: stableInfo must be base-64 data")
402                  print()
403                  exitUsage(1)
404              }
405  
406              guard let stableInfoSigData = Data(base64Encoded: stableInfoSigBase64) else {
407                  print("Error: stableInfoSig must be base-64 data")
408                  print()
409                  exitUsage(1)
410              }
411  
412              peerID = peerIDString
413              permanentInfo = permanentInfoData
414              permanentInfoSig = permanentInfoSigData
415              stableInfo = stableInfoData
416              stableInfoSig = stableInfoSigData
417          }
418  
419          commands.append(.vouch(peerID, permanentInfo, permanentInfoSig, stableInfo, stableInfoSig))
420  
421      case "vouchWithBottle":
422          guard let bottleID = argIterator.next() else {
423              print("Error: vouchWithBottle needs a bottleID")
424              print()
425              exitUsage(1)
426          }
427          guard let entropyBase64 = argIterator.next() else {
428              print("Error: vouchWithBottle needs entropy")
429              print()
430              exitUsage(1)
431          }
432          guard let salt = argIterator.next() else {
433              print("Error: vouchWithBottle needs a salt")
434              print()
435              exitUsage(1)
436          }
437  
438          guard let entropy = Data(base64Encoded: entropyBase64) else {
439              print("Error: entropy must be base-64 data")
440              print()
441              exitUsage(1)
442          }
443  
444          commands.append(.vouchWithBottle(bottleID, entropy, salt))
445  
446      case "allow":
447          var machineIDs = Set<String>()
448          var performIDMS = false
449          while let arg = argIterator.next() {
450              if arg == "--idms" {
451                  performIDMS = true
452              } else {
453                  machineIDs.insert(arg)
454              }
455          }
456          commands.append(.allow(machineIDs, performIDMS))
457  
458      default:
459          print("Unknown argument:", arg)
460          exitUsage(1)
461      }
462  }
463  
464  if commands.isEmpty {
465      exitUsage(0)
466  }
467  
468  // JSONSerialization has no idea how to handle NSData. Help it out.
469  func cleanDictionaryForJSON(_ d: [AnyHashable: Any]) -> [AnyHashable: Any] {
470      func cleanValue(_ value: Any) -> Any {
471          switch value {
472          case let subDict as [AnyHashable: Any]:
473              return cleanDictionaryForJSON(subDict)
474          case let subArray as [Any]:
475              return subArray.map(cleanValue)
476          case let data as Data:
477              return data.base64EncodedString()
478          default:
479              return value
480          }
481      }
482  
483      return d.mapValues(cleanValue)
484  }
485  
486  // Bring up a connection to TrustedPeersHelper
487  let connection = NSXPCConnection(serviceName: "com.apple.TrustedPeersHelper")
488  
489  connection.remoteObjectInterface = TrustedPeersHelperSetupProtocol(NSXPCInterface(with: TrustedPeersHelperProtocol.self))
490  connection.resume()
491  
492  let tpHelper = connection.synchronousRemoteObjectProxyWithErrorHandler { error in print("Unable to connect to TPHelper:", error) } as! TrustedPeersHelperProtocol
493  
494  for command in commands {
495      switch command {
496      case .dump:
497          logger.log("dumping (\(container), \(context))")
498          tpHelper.dump(withContainer: container, context: context) { reply, error in
499              guard error == nil else {
500                  print("Error dumping:", error!)
501                  return
502              }
503  
504              if let reply = reply {
505                  do {
506                      print(try TPCTLObjectiveC.jsonSerialize(cleanDictionaryForJSON(reply)))
507                  } catch {
508                      print("Error encoding JSON: \(error)")
509                  }
510              } else {
511                  print("Error: no results, but no error either?")
512              }
513          }
514  
515      case .depart:
516          logger.log("departing (\(container), \(context))")
517          tpHelper.departByDistrustingSelf(withContainer: container, context: context) { error in
518              guard error == nil else {
519                  print("Error departing:", error!)
520                  return
521              }
522  
523              print("Depart successful")
524          }
525  
526      case .distrust(let peerIDs):
527          logger.log("distrusting \(peerIDs.description) for (\(container), \(context))")
528          tpHelper.distrustPeerIDs(withContainer: container, context: context, peerIDs: peerIDs) { error in
529              guard error == nil else {
530                  print("Error distrusting:", error!)
531                  return
532              }
533              print("Distrust successful")
534          }
535  
536      case let .join(voucher, voucherSig):
537          logger.log("joining (\(container), \(context))")
538          tpHelper.join(withContainer: container,
539                        context: context,
540                        voucherData: voucher,
541                        voucherSig: voucherSig,
542                        ckksKeys: [],
543                        tlkShares: [],
544                        preapprovedKeys: preapprovedKeys ?? []) { peerID, _, _, error in
545                          guard error == nil else {
546                              print("Error joining:", error!)
547                              return
548                          }
549                          print("Join successful. PeerID:", peerID!)
550          }
551  
552      case .establish:
553          logger.log("establishing (\(container), \(context))")
554          tpHelper.establish(withContainer: container,
555                             context: context,
556                             ckksKeys: [],
557                             tlkShares: [],
558                             preapprovedKeys: preapprovedKeys ?? []) { peerID, _, _, error in
559                              guard error == nil else {
560                                  print("Error establishing:", error!)
561                                  return
562                              }
563                              print("Establish successful. Peer ID:", peerID!)
564          }
565  
566      case .healthInquiry:
567          logger.log("healthInquiry (\(container), \(context))")
568          tpHelper.pushHealthInquiry(withContainer: container, context: context) { error in
569              guard error == nil else {
570                  print("Error healthInquiry: \(String(describing: error))")
571                  return
572              }
573              print("healthInquiry successful")
574          }
575  
576      case .localReset:
577          logger.log("local-reset (\(container), \(context))")
578          tpHelper.localReset(withContainer: container, context: context) { error in
579              guard error == nil else {
580                  print("Error resetting:", error!)
581                  return
582              }
583  
584              logger.log("local-reset (\(container), \(context)): successful")
585              print("Local reset successful")
586          }
587  
588      case .supportApp:
589          logger.log("supportApp (\(container), \(context))")
590  
591          tpHelper.getSupportAppInfo(withContainer: container, context: context) { data, error in
592              guard error == nil else {
593                  print("Error getting supportApp:", error!)
594                  return
595              }
596  
597              if let data = data {
598                  do {
599                      let string = try GetSupportAppInfoResponse(serializedData: data).jsonString()
600                      print("\(string)")
601                  } catch {
602                      print("Error decoding protobuf: \(error)")
603                  }
604              } else {
605                  print("Error: no results, but no error either?")
606              }
607          }
608  
609      case .prepare:
610          logger.log("preparing (\(container), \(context))")
611  
612          if machineID == nil {
613              let anisetteController = AKAnisetteProvisioningController()
614  
615              let anisetteData = try anisetteController.anisetteData()
616              machineID = anisetteData.machineID
617              guard machineID != nil else {
618                  print("failed to get machineid from anisette data")
619                  abort()
620              }
621          }
622  
623          let deviceInfo = OTDeviceInformationActualAdapter()
624  
625          serialNumber = serialNumber ?? deviceInfo.serialNumber()
626          guard let serialNumber = serialNumber else {
627              print("failed to get serial number")
628              abort()
629          }
630  
631          tpHelper.prepare(withContainer: container,
632                           context: context,
633                           epoch: epoch,
634                           machineID: machineID!,
635                           bottleSalt: bottleSalt,
636                           bottleID: UUID().uuidString,
637                           modelID: modelID ?? deviceInfo.modelID(),
638                           deviceName: deviceName ?? deviceInfo.deviceName(),
639                           serialNumber: serialNumber,
640                           osVersion: osVersion ?? deviceInfo.osVersion(),
641                           policyVersion: nil,
642                           policySecrets: policySecrets,
643                           syncUserControllableViews: .UNKNOWN,
644                           signingPrivKeyPersistentRef: nil,
645                           encPrivKeyPersistentRef: nil) { peerID, permanentInfo, permanentInfoSig, stableInfo, stableInfoSig, syncingPolicy, error in
646                              guard error == nil else {
647                                  print("Error preparing:", error!)
648                                  return
649                              }
650  
651                              let result = [
652                                  "peerID": peerID!,
653                                  "permanentInfo": permanentInfo!.base64EncodedString(),
654                                  "permanentInfoSig": permanentInfoSig!.base64EncodedString(),
655                                  "stableInfo": stableInfo!.base64EncodedString(),
656                                  "stableInfoSig": stableInfoSig!.base64EncodedString(),
657                                  "machineID": machineID!,
658                                  "views": Array(syncingPolicy?.viewList ?? Set()),
659                                  ] as [String: Any]
660                              do {
661                                  print(try TPCTLObjectiveC.jsonSerialize(cleanDictionaryForJSON(result)))
662                              } catch {
663                                  print("Error encoding JSON: \(error)")
664                              }
665          }
666  
667      case .update:
668          logger.log("updating (\(container), \(context))")
669          tpHelper.update(withContainer: container,
670                          context: context,
671                          deviceName: deviceName,
672                          serialNumber: serialNumber,
673                          osVersion: osVersion,
674                          policyVersion: nil,
675                          policySecrets: policySecrets,
676                          syncUserControllableViews: nil) { _, _, error in
677                              guard error == nil else {
678                                  print("Error updating:", error!)
679                                  return
680                              }
681  
682                              print("Update complete")
683          }
684  
685      case .reset:
686          logger.log("resetting (\(container), \(context))")
687          tpHelper.reset(withContainer: container, context: context, resetReason: .userInitiatedReset) { error in
688              guard error == nil else {
689                  print("Error during reset:", error!)
690                  return
691              }
692  
693              print("Reset complete")
694          }
695  
696      case .validate:
697          logger.log("validate (\(container), \(context))")
698          tpHelper.validatePeers(withContainer: container, context: context) { reply, error in
699              guard error == nil else {
700                  print("Error validating:", error!)
701                  return
702              }
703  
704              if let reply = reply {
705                  do {
706                      print(try TPCTLObjectiveC.jsonSerialize(cleanDictionaryForJSON(reply)))
707                  } catch {
708                      print("Error encoding JSON: \(error)")
709                  }
710              } else {
711                  print("Error: no results, but no error either?")
712              }
713          }
714  
715      case .viableBottles:
716          logger.log("viableBottles (\(container), \(context))")
717          tpHelper.fetchViableBottles(withContainer: container, context: context) { sortedBottleIDs, partialBottleIDs, error in
718              guard error == nil else {
719                  print("Error fetching viable bottles:", error!)
720                  return
721              }
722              var result: [String: [String]] = [:]
723              result["sortedBottleIDs"] = sortedBottleIDs
724              result["partialBottleIDs"] = partialBottleIDs
725              do {
726                  print(try TPCTLObjectiveC.jsonSerialize(cleanDictionaryForJSON(result)))
727              } catch {
728                  print("Error encoding JSON: \(error)")
729              }
730          }
731  
732      case let .vouch(peerID, permanentInfo, permanentInfoSig, stableInfo, stableInfoSig):
733          logger.log("vouching (\(container), \(context))")
734          tpHelper.vouch(withContainer: container,
735                         context: context,
736                         peerID: peerID,
737                         permanentInfo: permanentInfo,
738                         permanentInfoSig: permanentInfoSig,
739                         stableInfo: stableInfo,
740                         stableInfoSig: stableInfoSig,
741                         ckksKeys: []
742          ) { voucher, voucherSig, error in
743              guard error == nil else {
744                  print("Error during vouch:", error!)
745                  return
746              }
747  
748              do {
749                  let result = ["voucher": voucher!.base64EncodedString(), "voucherSig": voucherSig!.base64EncodedString()]
750                  print(try TPCTLObjectiveC.jsonSerialize(cleanDictionaryForJSON(result)))
751              } catch {
752                  print("Error during processing vouch results: \(error)")
753              }
754          }
755  
756      case let .vouchWithBottle(bottleID, entropy, salt):
757          logger.log("vouching with bottle (\(container), \(context))")
758          tpHelper.vouchWithBottle(withContainer: container,
759                                   context: context,
760                                   bottleID: bottleID,
761                                   entropy: entropy,
762                                   bottleSalt: salt,
763                                   tlkShares: []) { voucher, voucherSig, _, _, error in
764                                      guard error == nil else {
765                                          print("Error during vouchWithBottle", error!)
766                                          return
767                                      }
768                                      do {
769                                          let result = ["voucher": voucher!.base64EncodedString(), "voucherSig": voucherSig!.base64EncodedString()]
770                                          print(try TPCTLObjectiveC.jsonSerialize(cleanDictionaryForJSON(result)))
771                                      } catch {
772                                          print("Error during processing vouch results: \(error)")
773                                      }
774          }
775  
776      case let .allow(machineIDs, performIDMS):
777          logger.log("allow-listing (\(container), \(context))")
778  
779          var idmsDeviceIDs: Set<String> = Set()
780          var accountIsDemo: Bool = false
781  
782          if performIDMS {
783              let store = ACAccountStore()
784              guard let account = store.aa_primaryAppleAccount() else {
785                  print("Unable to fetch primary Apple account!")
786                  abort()
787              }
788  
789              let requestArguments = AKDeviceListRequestContext()
790              requestArguments.altDSID = account.aa_altDSID
791              requestArguments.services = [AKServiceNameiCloud]
792  
793              let akManager = AKAccountManager.sharedInstance
794              let authKitAccount = akManager.authKitAccount(withAltDSID: account.aa_altDSID)
795              if let account = authKitAccount {
796                  accountIsDemo = akManager.demoAccount(for: account)
797              }
798  
799              guard let controller = AKAppleIDAuthenticationController() else {
800                  print("Unable to create AKAppleIDAuthenticationController!")
801                  abort()
802              }
803              let semaphore = DispatchSemaphore(value: 0)
804  
805              controller.fetchDeviceList(with: requestArguments) { deviceList, error in
806                  guard error == nil else {
807                      print("Unable to fetch IDMS device list: \(error!)")
808                      abort()
809                  }
810                  guard let deviceList = deviceList else {
811                      print("IDMS returned empty device list")
812                      return
813                  }
814  
815                  idmsDeviceIDs = Set(deviceList.map { $0.machineId })
816                  semaphore.signal()
817              }
818              semaphore.wait()
819          }
820          let allMachineIDs = machineIDs.union(idmsDeviceIDs)
821          print("Setting allowed machineIDs to \(allMachineIDs)")
822          tpHelper.setAllowedMachineIDsWithContainer(container, context: context, allowedMachineIDs: allMachineIDs, honorIDMSListChanges: accountIsDemo) { listChanged, error in
823              guard error == nil else {
824                  print("Error during allow:", error!)
825                  return
826              }
827  
828              print("Allow complete, differences: \(listChanged)")
829          }
830      }
831  }