Send command-prefix downloads to the configured mirrors

* Build, sign and notarize Firewall.pkg in the release workflow

* Stop publishing a Homebrew formula (#87)

.github/workflows/build-macos-pkg.yml

@@ -0,0 +1,54 @@
+name: Build Firewall.pkg
+
+on:
+  workflow_call:
+    inputs:
+      plan:
+        required: true
+        type: string
+
+jobs:
+  pkg:
+    runs-on: macos-26
+    env:
+      TEAM: ${{ vars.APPLE_TEAM }}
+      NOTARY_PROFILE: firewall
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - run: brew install xcodegen
+      - name: Install signing identities, profiles and notary key
+        env:
+          CERTIFICATES: ${{ secrets.MACOS_CERTIFICATES }}
+          CERTIFICATES_PASSWORD: ${{ secrets.MACOS_CERTIFICATES_PASSWORD }}
+          APP_PROFILE: ${{ secrets.MACOS_APP_PROFILE }}
+          EXTENSION_PROFILE: ${{ secrets.MACOS_EXTENSION_PROFILE }}
+          NOTARY_KEY: ${{ secrets.NOTARY_KEY }}
+          NOTARY_KEY_ID: ${{ secrets.NOTARY_KEY_ID }}
+          NOTARY_ISSUER: ${{ secrets.NOTARY_ISSUER }}
+        run: |
+          keychain="$RUNNER_TEMP/signing.keychain-db"
+          security create-keychain -p "" "$keychain"
+          security set-keychain-settings "$keychain"
+          security unlock-keychain -p "" "$keychain"
+          security default-keychain -s "$keychain"
+          security list-keychains -d user -s "$keychain" login.keychain
+          base64 --decode <<<"$CERTIFICATES" > "$RUNNER_TEMP/certificates.p12"
+          security import "$RUNNER_TEMP/certificates.p12" -k "$keychain" -P "$CERTIFICATES_PASSWORD" \
+            -T /usr/bin/codesign -T /usr/bin/pkgbuild
+          security set-key-partition-list -S apple-tool:,apple: -s -k "" "$keychain" >/dev/null
+
+          profiles="$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles"
+          mkdir -p "$profiles"
+          base64 --decode <<<"$APP_PROFILE" > "$profiles/app.provisionprofile"
+          base64 --decode <<<"$EXTENSION_PROFILE" > "$profiles/extension.provisionprofile"
+
+          printf '%s' "$NOTARY_KEY" > "$RUNNER_TEMP/notary.p8"
+          xcrun notarytool store-credentials "$NOTARY_PROFILE" \
+            --key "$RUNNER_TEMP/notary.p8" --key-id "$NOTARY_KEY_ID" --issuer "$NOTARY_ISSUER"
+      - run: macos/build.sh
+      - uses: actions/upload-artifact@v7
+        with:
+          name: artifacts-macos-pkg
+          path: macos/build/Firewall.pkg

.github/workflows/release.yml

@@ -211,14 +211,24 @@ jobs:
           path: |
             ${{ steps.cargo-dist.outputs.paths }}
             ${{ env.BUILD_MANIFEST_NAME }}
+
+  custom-build-macos-pkg:
+    needs:
+      - plan
+      - build-local-artifacts
+    uses: ./.github/workflows/build-macos-pkg.yml
+    with:
+      plan: ${{ needs.plan.outputs.val }}
+    secrets: inherit
   # Determines if we should publish/announce
   host:
     needs:
       - plan
       - build-local-artifacts
       - build-global-artifacts
+      - custom-build-macos-pkg
     # Only run if we're "publishing", and only if plan, local and global didn't fail (skipped is fine)
-    if: ${{ always() && needs.plan.result == 'success' && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }}
+    if: ${{ always() && needs.plan.result == 'success' && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.custom-build-macos-pkg.result == 'skipped' || needs.custom-build-macos-pkg.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }}
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     runs-on: "ubuntu-22.04"
@@ -278,52 +288,6 @@ jobs:
 
           gh release create "${{ needs.plan.outputs.tag }}" --target "$RELEASE_COMMIT" $PRERELEASE_FLAG --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/*
 
-  publish-homebrew-formula:
-    needs:
-      - plan
-      - host
-    runs-on: "ubuntu-22.04"
-    env:
-      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      PLAN: ${{ needs.plan.outputs.val }}
-      GITHUB_USER: "axo bot"
-      GITHUB_EMAIL: "[email protected]"
-    if: ${{ !fromJson(needs.plan.outputs.val).announcement_is_prerelease || fromJson(needs.plan.outputs.val).publish_prereleases }}
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: true
-          repository: "usestrix/homebrew-tap"
-          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-      # So we have access to the formula
-      - name: Fetch homebrew formulae
-        uses: actions/download-artifact@v8
-        with:
-          pattern: artifacts-*
-          path: Formula/
-          merge-multiple: true
-      # This is extra complex because you can make your Formula name not match your app name
-      # so we need to find releases with a *.rb file, and publish with that filename.
-      - name: Commit formula files
-        run: |
-          git config --global user.name "${GITHUB_USER}"
-          git config --global user.email "${GITHUB_EMAIL}"
-
-          for release in $(echo "$PLAN" | jq --compact-output '.releases[] | select([.artifacts[] | endswith(".rb")] | any)'); do
-            filename=$(echo "$release" | jq '.artifacts[] | select(endswith(".rb"))' --raw-output)
-            name=$(echo "$filename" | sed "s/\.rb$//")
-            version=$(echo "$release" | jq .app_version --raw-output)
-
-            export PATH="/home/linuxbrew/.linuxbrew/bin:$PATH"
-            brew update
-            # We avoid reformatting user-provided data such as the app description and homepage.
-            brew style --except-cops FormulaAudit/Homepage,FormulaAudit/Desc,FormulaAuditStrict --fix "Formula/${filename}" || true
-
-            git add "Formula/${filename}"
-            git commit -m "${name} ${version}"
-          done
-          git push
-
   custom-publish-crates:
     needs:
       - plan
@@ -342,12 +306,11 @@ jobs:
     needs:
       - plan
       - host
-      - publish-homebrew-formula
       - custom-publish-crates
     # use "always() && ..." to allow us to wait for all publish jobs while
     # still allowing individual publish jobs to skip themselves (for prereleases).
     # "host" however must run to completion, no skipping allowed!
-    if: ${{ always() && needs.host.result == 'success' && (needs.publish-homebrew-formula.result == 'skipped' || needs.publish-homebrew-formula.result == 'success') && (needs.custom-publish-crates.result == 'skipped' || needs.custom-publish-crates.result == 'success') }}
+    if: ${{ always() && needs.host.result == 'success' && (needs.custom-publish-crates.result == 'skipped' || needs.custom-publish-crates.result == 'success') }}
     runs-on: "ubuntu-22.04"
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

core/Cargo.lock

@@ -3370,7 +3370,7 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "strix-firewall"
-version = "0.1.0"
+version = "0.1.0-rc.1"
 dependencies = [
  "clap",
  "core-foundation 0.10.1",

core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "strix-firewall"
-version = "0.1.0"
+version = "0.1.0-rc.1"
 edition = "2021"
 license = "Apache-2.0"
 authors = ["Strix"]

core/src/aliasing/forward.rs

@@ -80,6 +80,7 @@ async fn handle(req: Request, firewall: &Firewall) -> Result<Response, Infallibl
         warn!(method = %req.method(), uri = %req.uri(), "unroutable, expected an absolute URL");
         return Ok(text(400, "firewall: expected an absolute URL\n"));
     };
+    let url = firewall.mirrored(url);
 
     let reason = policies::screen(&url, firewall).await;
     telemetry::screened(firewall, &url, reason.as_deref());
@@ -129,6 +130,9 @@ pub fn downgrade(firewall: &Firewall, body: Vec<u8>) -> Vec<u8> {
         Ok(text) => text,
         Err(raw) => return raw.into_bytes(),
     };
+    for (upstream, mirror) in firewall.mirrors() {
+        text = text.replace(mirror, upstream);
+    }
     for host in firewall.hosts() {
         text = text.replace(&format!("https://{host}"), &format!("http://{host}"));
     }

core/src/firewall.rs

@@ -69,6 +69,28 @@ impl Firewall {
         self.registries.iter().any(|r| r.index && r.host() == host_of(url))
     }
 
+    /// The URL at the first mirror of the built-in registry it is on, if one is configured.
+    pub fn mirrored(&self, url: String) -> String {
+        for (upstream, mirror) in self.mirrors() {
+            if let Some(rest) = url.strip_prefix(upstream) {
+                return format!("{mirror}{rest}");
+            }
+        }
+        url
+    }
+
+    /// Each built-in upstream with a mirror, paired with its first one.
+    pub fn mirrors(&self) -> Vec<(&'static str, &str)> {
+        let mut mirrors = Vec::new();
+        for registry in BUILT_IN {
+            let first = self.config.registries.get(registry.name()).and_then(|m| m.first());
+            if let Some(mirror) = first {
+                mirrors.push((registry.upstream, mirror.as_str()));
+            }
+        }
+        mirrors
+    }
+
     pub fn resolve(&self, registry: &'static Registry, rest: &str) -> Resolved {
         resolve(registry, rest, &self.patterns[registry.prefix])
     }

core/tests/forward.rs

@@ -64,3 +64,16 @@ async fn downgrade_touches_known_hosts_in_text_only() {
     let binary = vec![0x1f, 0x8b, 0xff, 0xfe];
     assert_eq!(downgrade(&firewall, binary.clone()), binary);
 }
+
+#[tokio::test]
+async fn a_mirror_stands_in_for_its_registry() {
+    let mut config = FirewallConfig::default();
+    config.registries.insert("pypi".into(), vec!["https://art.example.com/pypi/".into()]);
+    let firewall = Firewall::new(config);
+    let mirrored = firewall.mirrored("https://pypi.org/simple/six/".into());
+    assert_eq!(mirrored, "https://art.example.com/pypi/simple/six/");
+    let npm = "https://registry.npmjs.org/left-pad";
+    assert_eq!(firewall.mirrored(npm.into()), npm);
+    let links = b"https://art.example.com/pypi/packages/six.whl".to_vec();
+    assert_eq!(downgrade(&firewall, links), b"http://pypi.org/packages/six.whl".to_vec());
+}

dist-workspace.toml

@@ -4,10 +4,10 @@ members = ["cargo:core"]
 [dist]
 cargo-dist-version = "0.32.0"
 ci = "github"
-installers = ["shell", "powershell", "homebrew", "msi"]
+installers = ["shell", "powershell", "msi"]
 # core/wix/main.wxs is edited to install the service.
 allow-dirty = ["msi"]
 features = ["machine-wide"]
-tap = "usestrix/homebrew-tap"
-publish-jobs = ["homebrew", "./publish-crates"]
+publish-jobs = ["./publish-crates"]
+global-artifacts-jobs = ["./build-macos-pkg"]
 targets = ["aarch64-apple-darwin", "x86_64-apple-darwin", "aarch64-unknown-linux-gnu", "x86_64-unknown-linux-gnu", "x86_64-pc-windows-msvc"]

macos/build.sh

@@ -48,7 +48,7 @@ build() {
   xcodegen generate >/dev/null
   xcodebuild -project Firewall.xcodeproj -scheme StrixFirewall -configuration $CONFIGURATION \
     -destination generic/platform=macOS \
-    -derivedDataPath build CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO \
+    -derivedDataPath build CURRENT_PROJECT_VERSION="$(date +%s)" CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO \
     CODE_SIGN_IDENTITY="" CODE_SIGN_ENTITLEMENTS="" build >/dev/null
 }
 

macos/project.yml

@@ -19,6 +19,8 @@ settings:
     ENABLE_DEBUG_DYLIB: "NO"
     CODE_SIGN_STYLE: Automatic
     CODE_SIGN_IDENTITY: Apple Development
+    # build.sh sets a fresh one per build; macOS only replaces an installed extension whose version differs.
+    CURRENT_PROJECT_VERSION: "1"
 
 packages:
   Rama:
@@ -42,6 +44,7 @@ targets:
       properties:
         CFBundlePackageType: SYSX
         CFBundleShortVersionString: "0.1"
+        CFBundleVersion: $(CURRENT_PROJECT_VERSION)
         NSSystemExtensionUsageDescription: Firewall uses a network extension to screen package downloads before they install.
         NetworkExtension:
           NEMachServiceName: ${TEAM}.com.usestrix.firewall.extension
@@ -102,6 +105,7 @@ targets:
       path: App/Info.plist
       properties:
         CFBundleShortVersionString: "0.1"
+        CFBundleVersion: $(CURRENT_PROJECT_VERSION)
         LSMinimumSystemVersion: $(MACOSX_DEPLOYMENT_TARGET)
         NSSystemExtensionUsageDescription: Firewall uses a network extension to screen package downloads before they install.
         LSUIElement: true