location-spoofer/Shared/CertificateTrustVerifier.swift

import Foundation
import Security

final class CertificateTrustVerifier {
    /// Check whether a CA certificate (given as PEM data) is installed and fully trusted
    /// by the system. Uses SecTrust evaluation against system anchors only — no network needed.
    static func isCACertificateTrusted(certPEM: String) -> Bool {
        guard let pemData = certPEM.data(using: .utf8),
              let block = pemData.pemCertificateBlock,
              let cert = SecCertificateCreateWithData(nil, block as CFData) else {
            RuntimeLogger.error("APP", "Trust", "无法解析 CA 证书 PEM")
            return false
        }

        // Create a basic trust with the CA cert, using system anchor certificates only
        var trust: SecTrust?
        let createStatus = SecTrustCreateWithCertificates(
            [cert] as CFArray,
            SecPolicyCreateBasicX509(),
            &trust
        )
        guard createStatus == errSecSuccess, let trust = trust else {
            RuntimeLogger.error("APP", "Trust", "无法创建 SecTrust")
            return false
        }

        // Use system anchors only — if our CA is installed & trusted, evaluation passes
        SecTrustSetAnchorCertificatesOnly(trust, false)

        var error: CFError?
        let result = SecTrustEvaluateWithError(trust, &error)
        if let error {
            RuntimeLogger.warning("APP", "Trust", "SecTrust 评估返回错误", details: [
                "error": (error as Error).localizedDescription
            ])
        }

        RuntimeLogger.info("APP", "Trust", result ? "CA 证书已被系统信任" : "CA 证书未被系统信任")
        return result
    }
}

private extension Data {
    var pemCertificateBlock: Data? {
        guard let text = String(data: self, encoding: .utf8),
              let begin = text.range(of: "-----BEGIN CERTIFICATE-----"),
              let end = text.range(of: "-----END CERTIFICATE-----") else { return nil }
        let body = text[begin.upperBound..<end.lowerBound].components(separatedBy: .whitespacesAndNewlines).joined()
        return Data(base64Encoded: body)
    }
}