Add a debug build that skips notarization

* Sign with Developer ID and notarize the package

* Name signing identities by type

* Say how signing identities are matched

* Notarize only when NOTARY_PROFILE is set

core/src/config/mod.rs

@@ -6,7 +6,6 @@ use std::io::{Error, ErrorKind};
 use std::path::PathBuf;
 
 pub const DEFAULT_PORT: u16 = 8080;
-const TOKEN_ENV: &str = "FIREWALL_GITHUB_TOKEN";
 
 #[derive(Debug, Deserialize)]
 #[serde(default, deny_unknown_fields)]
@@ -38,19 +37,11 @@ pub struct AllowedPackage {
 pub struct DenylistSource {
     /// One file per ecosystem lives under here, named the way OSV names it, in lowercase.
     pub base: String,
-    /// Falls back to `FIREWALL_GITHUB_TOKEN`, so a token need not be written to disk.
-    pub token: Option<String>,
     /// Polled for a new commit, which re-fetches every list in use.
     pub revision: String,
     pub poll_secs: u64,
 }
 
-impl DenylistSource {
-    pub fn token(&self) -> Option<String> {
-        self.token.clone().or_else(|| std::env::var(TOKEN_ENV).ok())
-    }
-}
-
 impl Default for FirewallConfig {
     fn default() -> Self {
         FirewallConfig {
@@ -69,7 +60,6 @@ impl Default for DenylistSource {
     fn default() -> Self {
         DenylistSource {
             base: "https://raw.githubusercontent.com/usestrix/malicious-packages/packages".into(),
-            token: None,
             revision: "https://api.github.com/repos/usestrix/malicious-packages/commits/packages"
                 .into(),
             poll_secs: 10,

core/src/firewall.rs

@@ -27,7 +27,7 @@ impl Firewall {
             patterns.insert(registry.prefix, compiled.collect());
         }
         let ecosystems = config.registries.iter().map(|r| r.osv_name);
-        let denylist = Denylist::new(config.denylist.clone(), config.denylist.token(), ecosystems);
+        let denylist = Denylist::new(config.denylist.clone(), ecosystems);
         let mut filters: Vec<Box<dyn Filter>> = vec![Box::new(denylist), Box::new(Osv)];
         if config.min_age_hours > 0 {
             filters.push(Box::new(Age::new(config.min_age_hours)));

core/src/os/macos/mod.rs

@@ -25,10 +25,10 @@ use std::sync::Arc;
 use tracing_subscriber::layer::SubscriberExt;
 use tracing_subscriber::util::SubscriberInitExt;
 
-const BUNDLE_ID: &str = "ai.strix.firewall";
+const BUNDLE_ID: &str = "com.usestrix.firewall";
 const KEYCHAIN_SERVICE: &str = BUNDLE_ID;
 const KEYCHAIN_ACCOUNT: &str = "ca";
-/// Must match `macos/LaunchAgents/ai.strix.firewall.env.plist`, which points npm at it.
+/// Must match `macos/LaunchAgents/com.usestrix.firewall.env.plist`, which points npm at it.
 const CA_FILE: &str = "/Library/Application Support/Firewall/ca.pem";
 
 #[derive(Clone)]
@@ -113,7 +113,7 @@ fn handler(exec: Executor) -> Result<Handler, BoxError> {
 }
 
 /// stderr is invisible in a system extension, so events go to the unified log:
-/// `log stream --predicate 'subsystem == "ai.strix.firewall"'`.
+/// `log stream --predicate 'subsystem == "com.usestrix.firewall"'`.
 fn init(_config: Option<&TransparentProxyInitConfig>) -> bool {
     // A panic crossing the FFI boundary aborts, and its message would go to stderr.
     std::panic::set_hook(Box::new(|panic| tracing::error!("{panic}")));

core/src/os/macos/uninstall.rs

@@ -7,7 +7,7 @@ use std::io::ErrorKind;
 use tracing::info;
 
 /// Installed by the pkg.
-const ENV_AGENT: &str = "/Library/LaunchAgents/ai.strix.firewall.env.plist";
+const ENV_AGENT: &str = "/Library/LaunchAgents/com.usestrix.firewall.env.plist";
 
 /// Removes what only root can: the CA, its enclave key and exported copy, and the env
 /// agent. Trust settings need an authorization dialog, so the installer drops those itself.

core/src/policies/filters/denylist.rs

@@ -3,7 +3,7 @@ use crate::config::DenylistSource;
 use crate::policies::registries::Registry;
 use crate::policies::Package;
 use rama::http::client::EasyHttpWebClient;
-use rama::http::header::{AUTHORIZATION, ETAG, IF_NONE_MATCH, USER_AGENT};
+use rama::http::header::{ETAG, IF_NONE_MATCH, USER_AGENT};
 use rama::http::service::client::HttpClientExt;
 use rama::http::{BodyExtractExt, StatusCode};
 use semver::Version;
@@ -37,20 +37,15 @@ type Lists = HashMap<&'static str, OnceCell<RwLock<Arc<FetchedDenylist>>>>;
 
 pub struct Denylist {
     source: DenylistSource,
-    token: Option<String>,
     lists: Arc<Lists>,
     watch: JoinHandle<()>,
 }
 
 impl Denylist {
-    pub fn new(
-        source: DenylistSource,
-        token: Option<String>,
-        ecosystems: impl Iterator<Item = &'static str>,
-    ) -> Self {
+    pub fn new(source: DenylistSource, ecosystems: impl Iterator<Item = &'static str>) -> Self {
         let lists: Arc<Lists> = Arc::new(ecosystems.map(|eco| (eco, OnceCell::new())).collect());
-        let watch = tokio::spawn(watch(source.clone(), token.clone(), Arc::clone(&lists)));
-        Denylist { source, token, lists, watch }
+        let watch = tokio::spawn(watch(source.clone(), Arc::clone(&lists)));
+        Denylist { source, lists, watch }
     }
 }
 
@@ -69,7 +64,7 @@ impl Filter for Denylist {
         Box::pin(async move {
             let eco = registry.osv_name;
             let load = || async {
-                RwLock::new(Arc::new(load(&self.source, self.token.as_deref(), eco).await))
+                RwLock::new(Arc::new(load(&self.source, eco).await))
             };
             let list = self.lists[eco].get_or_init(load).await;
             let list = Arc::clone(&list.read().expect("denylist lock"));
@@ -147,12 +142,12 @@ pub fn describe(advisories: &[&Advisory]) -> String {
 }
 
 /// A failed fetch leaves the last good list in place; a list that never loaded is retried every tick.
-async fn watch(source: DenylistSource, token: Option<String>, lists: Arc<Lists>) {
+async fn watch(source: DenylistSource, lists: Arc<Lists>) {
     let period = Duration::from_secs(source.poll_secs);
-    let mut seen = revision(&source, token.as_deref(), None).await;
+    let mut seen = revision(&source, None).await;
     loop {
         tokio::time::sleep(period).await;
-        let changed = revision(&source, token.as_deref(), seen.as_deref()).await;
+        let changed = revision(&source, seen.as_deref()).await;
         if let Some(current) = &changed {
             info!(revision = %current, "denylist source changed");
             seen = changed.clone();
@@ -163,7 +158,7 @@ async fn watch(source: DenylistSource, token: Option<String>, lists: Arc<Lists>)
             if changed.is_none() && !failed {
                 continue;
             }
-            if let Ok(packages) = load(&source, token.as_deref(), eco).await {
+            if let Ok(packages) = load(&source, eco).await {
                 *list.write().expect("denylist lock") = Arc::new(Ok(packages));
             }
         }
@@ -171,16 +166,9 @@ async fn watch(source: DenylistSource, token: Option<String>, lists: Arc<Lists>)
 }
 
 /// GitHub's 304 for an unchanged `If-None-Match` costs no rate limit.
-async fn revision(
-    source: &DenylistSource,
-    token: Option<&str>,
-    seen: Option<&str>,
-) -> Option<String> {
+async fn revision(source: &DenylistSource, seen: Option<&str>) -> Option<String> {
     let client = EasyHttpWebClient::default();
     let mut request = client.get(&source.revision).header(USER_AGENT, AGENT);
-    if let Some(token) = token {
-        request = request.header(AUTHORIZATION, format!("Bearer {token}"));
-    }
     if let Some(seen) = seen {
         request = request.header(IF_NONE_MATCH, seen);
     }
@@ -197,8 +185,8 @@ async fn revision(
     response.headers().get(ETAG)?.to_str().ok().map(str::to_owned)
 }
 
-async fn load(source: &DenylistSource, token: Option<&str>, eco: &'static str) -> FetchedDenylist {
-    let list = fetch(source, token, &eco.to_lowercase()).await;
+async fn load(source: &DenylistSource, eco: &'static str) -> FetchedDenylist {
+    let list = fetch(source, &eco.to_lowercase()).await;
     match &list {
         Ok(packages) => info!(%eco, packages = packages.len(), "denylist loaded"),
         Err(error) => warn!(%eco, %error, "denylist unavailable"),
@@ -206,13 +194,10 @@ async fn load(source: &DenylistSource, token: Option<&str>, eco: &'static str) -
     list
 }
 
-async fn fetch(source: &DenylistSource, token: Option<&str>, eco: &str) -> FetchedDenylist {
+async fn fetch(source: &DenylistSource, eco: &str) -> FetchedDenylist {
     let url = format!("{}/{eco}", source.base);
     let client = EasyHttpWebClient::default();
-    let mut request = client.get(&url).header(USER_AGENT, AGENT);
-    if let Some(token) = token {
-        request = request.header(AUTHORIZATION, format!("Bearer {token}"));
-    }
+    let request = client.get(&url).header(USER_AGENT, AGENT);
     let response = request.send().await.map_err(|e| e.to_string())?;
     if response.status() != StatusCode::OK {
         return Err(format!("{url} replied {}", response.status()));

core/tests/config.rs

@@ -8,7 +8,6 @@ fn a_file_only_has_to_set_what_it_changes() {
     let config: FirewallConfig = serde_json::from_str(r#"{"fail_open": false}"#).expect("parses");
     assert!(!config.fail_open);
     assert_eq!(config.port, firewall::DEFAULT_PORT);
-    assert_eq!(config.denylist.token, FirewallConfig::default().denylist.token);
 }
 
 #[test]

macos/Installer/FirewallIDs.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 enum FirewallIDs {
-    static let appBundleID = "ai.strix.firewall"
-    static let extensionBundleID = "ai.strix.firewall.extension"
+    static let appBundleID = "com.usestrix.firewall"
+    static let extensionBundleID = "com.usestrix.firewall.extension"
     static let caCommonName = "Strix Firewall"
 }

macos/LaunchAgents/com.usestrix.firewall.env.plist

@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
 	<key>Label</key>
-	<string>ai.strix.firewall.env</string>
+	<string>com.usestrix.firewall.env</string>
 	<key>ProgramArguments</key>
 	<array>
 		<string>/bin/launchctl</string>

macos/build.sh

@@ -1,8 +1,9 @@
 #!/bin/bash
 # Builds and signs Firewall.app, installs it to /Applications, and packages it as build/Firewall.pkg.
+# The package is notarized with the notarytool keychain profile in NOTARY_PROFILE; `build.sh debug`
+# makes a Debug build and skips notarization.
 #
-# Xcode builds the bundles unsigned; they are signed here because the granted NetworkExtension
-# entitlement has no -systemextension variant, so Xcode cannot sign them itself.
+# Xcode builds the bundles unsigned; they are signed here with Developer ID.
 set -euo pipefail
 cd "$(dirname "$0")"
 
@@ -10,13 +11,19 @@ cd "$(dirname "$0")"
 : "${TEAM:?set TEAM in macos/.env}"
 export TEAM
 
-APP_ID=ai.strix.firewall
-EXT_ID=ai.strix.firewall.extension
+CONFIGURATION=Release
+if [ "${1:-}" = debug ]; then CONFIGURATION=Debug; fi
+[ $CONFIGURATION = Debug ] || : "${NOTARY_PROFILE:?set NOTARY_PROFILE in macos/.env}"
+
+APP_ID=com.usestrix.firewall
+EXT_ID=com.usestrix.firewall.extension
 VERSION=0.1
-IDENTITY=${IDENTITY:-$(security find-identity -v -p codesigning | awk -F'"' '/Apple Development/ {print $2; exit}')}
+# Matched as a substring of the certificate name; set these if more than one certificate matches.
+IDENTITY=${IDENTITY:-Developer ID Application}
+INSTALLER_IDENTITY=${INSTALLER_IDENTITY:-Developer ID Installer}
 PROFILES="$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles"
 
-APP=build/Build/Products/Debug/Installer.app
+APP=build/Build/Products/$CONFIGURATION/Installer.app
 EXT=$APP/Contents/Library/SystemExtensions/$EXT_ID.systemextension
 PKG_ROOT=build/pkg-root
 
@@ -25,12 +32,13 @@ main() {
   sign
   install_app
   package
+  [ $CONFIGURATION = Debug ] || notarize
 }
 
 build() {
   echo "==> Building"
   xcodegen generate >/dev/null
-  xcodebuild -project Firewall.xcodeproj -scheme Installer -configuration Debug \
+  xcodebuild -project Firewall.xcodeproj -scheme Installer -configuration $CONFIGURATION \
     -derivedDataPath build CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO \
     CODE_SIGN_IDENTITY="" CODE_SIGN_ENTITLEMENTS="" build >/dev/null
 }
@@ -39,9 +47,9 @@ sign() {
   echo "==> Signing with $IDENTITY"
   cp "$(profile_for $APP_ID)" "$APP/Contents/embedded.provisionprofile"
   cp "$(profile_for $EXT_ID)" "$EXT/Contents/embedded.provisionprofile"
-  codesign --force --options runtime --timestamp=none \
+  codesign --force --options runtime --timestamp \
     --entitlements Extension/Extension.entitlements -s "$IDENTITY" "$EXT"
-  codesign --force --options runtime --timestamp=none \
+  codesign --force --options runtime --timestamp \
     --entitlements Installer/Installer.entitlements -s "$IDENTITY" "$APP"
   codesign --verify --deep --strict "$APP"
 }
@@ -59,12 +67,19 @@ package() {
   rm -rf "$PKG_ROOT"
   mkdir -p "$PKG_ROOT/Applications" "$PKG_ROOT/Library/LaunchAgents"
   cp -R "$APP" "$PKG_ROOT/Applications/Firewall.app"
-  cp LaunchAgents/ai.strix.firewall.env.plist "$PKG_ROOT/Library/LaunchAgents/"
+  cp LaunchAgents/com.usestrix.firewall.env.plist "$PKG_ROOT/Library/LaunchAgents/"
 
   pkgbuild --analyze --root "$PKG_ROOT" build/components.plist >/dev/null
   plutil -replace 0.BundleIsRelocatable -bool NO build/components.plist
   pkgbuild --root "$PKG_ROOT" --component-plist build/components.plist --scripts pkg \
-    --identifier $APP_ID --version $VERSION --install-location / build/Firewall.pkg >/dev/null
+    --identifier $APP_ID --version $VERSION --install-location / --sign "$INSTALLER_IDENTITY" \
+    build/Firewall.pkg >/dev/null
+}
+
+notarize() {
+  echo "==> Notarizing build/Firewall.pkg"
+  xcrun notarytool submit build/Firewall.pkg --keychain-profile "$NOTARY_PROFILE" --wait
+  xcrun stapler staple build/Firewall.pkg
 }
 
 # Prints the newest provisioning profile Xcode has downloaded for a bundle id.

macos/pkg/postinstall

@@ -3,7 +3,7 @@
 user=$(stat -f %Su /dev/console)
 [ "$user" = root ] && exit 0
 uid=$(id -u "$user")
-agent=/Library/LaunchAgents/ai.strix.firewall.env.plist
+agent=/Library/LaunchAgents/com.usestrix.firewall.env.plist
 launchctl bootout "gui/$uid" "$agent" 2>/dev/null
 launchctl bootstrap "gui/$uid" "$agent"
 launchctl asuser "$uid" sudo -u "$user" open -a /Applications/Firewall.app --args --install

macos/project.yml

@@ -1,6 +1,6 @@
 name: Firewall
 options:
-  bundleIdPrefix: ai.strix.firewall
+  bundleIdPrefix: com.usestrix.firewall
   deploymentTarget: { macOS: "13.0" }
   createIntermediateGroups: true
 
@@ -33,8 +33,8 @@ targets:
     sources: [Extension]
     settings:
       base:
-        PRODUCT_BUNDLE_IDENTIFIER: ai.strix.firewall.extension
-        PRODUCT_NAME: ai.strix.firewall.extension
+        PRODUCT_BUNDLE_IDENTIFIER: com.usestrix.firewall.extension
+        PRODUCT_NAME: com.usestrix.firewall.extension
         PRODUCT_MODULE_NAME: Extension
         OTHER_LDFLAGS: [-lfirewall, -framework, NetworkExtension, -lz]
     info:
@@ -44,7 +44,7 @@ targets:
         CFBundleShortVersionString: "0.1"
         NSSystemExtensionUsageDescription: Firewall uses a network extension to screen package downloads before they install.
         NetworkExtension:
-          NEMachServiceName: ${TEAM}.ai.strix.firewall.extension
+          NEMachServiceName: ${TEAM}.com.usestrix.firewall.extension
           NEProviderClasses:
             com.apple.networkextension.app-proxy: RamaAppleNetworkExtension.RamaTransparentProxyProvider
     entitlements:
@@ -52,13 +52,13 @@ targets:
       properties:
         # Xcode injects these from the profile; we sign by hand, and NE's IPC
         # check rejects a caller without them.
-        com.apple.application-identifier: ${TEAM}.ai.strix.firewall.extension
+        com.apple.application-identifier: ${TEAM}.com.usestrix.firewall.extension
         com.apple.developer.team-identifier: ${TEAM}
         com.apple.developer.networking.networkextension:
-          - app-proxy-provider
+          - app-proxy-provider-systemextension
         # NE requires NEMachServiceName to start with one of these.
         com.apple.security.application-groups:
-          - ${TEAM}.ai.strix.firewall
+          - ${TEAM}.com.usestrix.firewall
         com.apple.security.network.client: true
         com.apple.security.network.server: true
     dependencies:
@@ -96,7 +96,7 @@ targets:
         buildPhase: resources
     settings:
       base:
-        PRODUCT_BUNDLE_IDENTIFIER: ai.strix.firewall
+        PRODUCT_BUNDLE_IDENTIFIER: com.usestrix.firewall
     info:
       path: Installer/Info.plist
       properties:
@@ -107,11 +107,11 @@ targets:
     entitlements:
       path: Installer/Installer.entitlements
       properties:
-        com.apple.application-identifier: ${TEAM}.ai.strix.firewall
+        com.apple.application-identifier: ${TEAM}.com.usestrix.firewall
         com.apple.developer.team-identifier: ${TEAM}
         com.apple.developer.system-extension.install: true
         com.apple.developer.networking.networkextension:
-          - app-proxy-provider
+          - app-proxy-provider-systemextension
         com.apple.security.network.client: true
     dependencies:
       - target: Extension