Hold a held-back download open so allowing it lets it through

* Screen mirrors listed in the config file

* Reject config values the firewall cannot use

core/Cargo.toml

@@ -90,6 +90,10 @@ path = "tests/tpm.rs"
 name = "managers"
 path = "tests/managers.rs"
 
+[[test]]
+name = "blocks"
+path = "tests/blocks.rs"
+
 [features]
 # Builds the machine-wide binaries: the Windows service and tray, and the macOS uninstaller.
 machine-wide = []
@@ -125,7 +129,7 @@ schannel = "0.1.29"
 tokio = { version = "1.53.1", features = ["net"] }
 tracing-appender = "0.2.5"
 tray-icon = { version = "0.26.1", default-features = false }
-windows = { version = "0.62", features = ["Win32_Foundation", "Win32_Security", "Win32_Security_Authorization", "Win32_Security_Cryptography", "Win32_System_Com", "Win32_System_Console", "Win32_System_Environment", "Win32_System_JobObjects", "Win32_System_Threading", "Win32_UI_Shell", "Win32_UI_WindowsAndMessaging"] }
+windows = { version = "0.62", features = ["Win32_Foundation", "Win32_Security", "Win32_Security_Authorization", "Win32_Security_Cryptography", "Win32_Storage_FileSystem", "Win32_System_Com", "Win32_System_Console", "Win32_System_Environment", "Win32_System_JobObjects", "Win32_System_Threading", "Win32_UI_Shell", "Win32_UI_WindowsAndMessaging"] }
 windows-registry = "0.6.1"
 windows-service = "0.8.0"
 

core/src/aliasing/managers/bun.rs

@@ -8,7 +8,7 @@ pub static BUN: Manager = Manager {
         ("https_proxy", PROXY),
         ("HTTP_PROXY", PROXY),
         ("HTTPS_PROXY", PROXY),
-        ("npm_config_registry", "http://{npm}/"),
+        ("npm_config_registry", "http://registry.npmjs.org/"),
     ],
     args: &[],
 };

core/src/aliasing/managers/cargo.rs

@@ -14,7 +14,7 @@ pub static CARGO: Manager = Manager {
             "--config",
             "source.crates-io.replace-with=\"firewall\"",
             "--config",
-            "source.firewall.registry=\"sparse+http://{cargo/index}/\"",
+            "source.firewall.registry=\"sparse+http://index.crates.io/\"",
         ],
     }],
 };

core/src/aliasing/managers/gem.rs

@@ -6,6 +6,6 @@ pub static GEM: Manager = Manager {
     // gem has no variable for the source list, and gem env and gem sources reject the flags.
     args: &[Args {
         when: &["install", "update", "fetch"],
-        flags: &["--clear-sources", "--source", "http://{gem}/"],
+        flags: &["--clear-sources", "--source", "http://rubygems.org/"],
     }],
 };

core/src/aliasing/managers/go.rs

@@ -6,7 +6,7 @@ pub static GO: Manager = Manager {
     env: &[
         ("HTTP_PROXY", PROXY),
         ("http_proxy", PROXY),
-        ("GOPROXY", "http://{go}"),
+        ("GOPROXY", "http://proxy.golang.org"),
         ("GOSUMDB", "off"),
         ("GOFLAGS", "-mod=mod"),
     ],

core/src/aliasing/managers/mod.rs

@@ -9,9 +9,6 @@ mod pipenv;
 mod pnpm;
 mod uv;
 
-use crate::policies::registries::{host_of, BUILT_IN};
-use crate::FirewallConfig;
-
 pub use bun::BUN;
 pub use cargo::CARGO;
 pub use gem::GEM;
@@ -23,7 +20,7 @@ pub use pipenv::PIPENV;
 pub use pnpm::PNPM;
 pub use uv::UV;
 
-pub const PYPI_SIMPLE: &str = "http://{pypi}/simple";
+pub const PYPI_SIMPLE: &str = "http://pypi.org/simple";
 
 pub const PROXY: &str = "{proxy}";
 
@@ -34,9 +31,7 @@ pub struct Args {
 }
 
 /// An https:// registry arrives as a CONNECT tunnel naming only the host, so each
-/// manager also overrides its registry URL to http://. `{npm}` and the like name a
-/// built-in registry, and expand to its first mirror, if any, without the scheme;
-/// `{host:npm}` to just its host.
+/// manager also overrides its registry URL to http://.
 pub struct Manager {
     pub command: &'static str,
     pub env: &'static [(&'static str, &'static str)],
@@ -47,36 +42,23 @@ pub static MANAGERS: &[&Manager] =
     &[&NPM, &PIP, &PIP3, &CARGO, &GO, &GEM, &UV, &PDM, &PIPENV, &PNPM, &BUN];
 
 /// Every manager's variables, so whichever the command starts is pointed at the firewall.
-pub fn variables(proxy: &str, config: &FirewallConfig) -> Vec<(String, String)> {
+pub fn variables(proxy: &str) -> Vec<(String, String)> {
     let env = MANAGERS.iter().flat_map(|manager| manager.env);
-    env.map(|(key, value)| (key.to_string(), expand(value, proxy, config))).collect()
+    env.map(|(key, value)| (key.to_string(), expand(value, proxy))).collect()
 }
 
-pub fn arguments(
-    proxy: &str,
-    config: &FirewallConfig,
-    manager: &Manager,
-    typed: &[String],
-) -> Vec<String> {
+pub fn arguments(proxy: &str, manager: &Manager, typed: &[String]) -> Vec<String> {
     let mut out = Vec::new();
     for args in manager.args {
         let wanted =
             args.when.is_empty() || typed.iter().any(|arg| args.when.contains(&arg.as_str()));
         if wanted {
-            out.extend(args.flags.iter().map(|flag| expand(flag, proxy, config)));
+            out.extend(args.flags.iter().map(|flag| expand(flag, proxy)));
         }
     }
     out
 }
 
-fn expand(value: &str, proxy: &str, config: &FirewallConfig) -> String {
-    let mut value = value.replace(PROXY, proxy);
-    for registry in BUILT_IN {
-        let mirror = config.registries.get(registry.name()).and_then(|mirrors| mirrors.first());
-        let upstream = mirror.map_or(registry.upstream, String::as_str);
-        let address = upstream.trim_start_matches("https://").trim_end_matches('/');
-        value = value.replace(&format!("{{{}}}", registry.name()), address);
-        value = value.replace(&format!("{{host:{}}}", registry.name()), host_of(upstream));
-    }
-    value
+fn expand(value: &str, proxy: &str) -> String {
+    value.replace(PROXY, proxy)
 }

core/src/aliasing/managers/npm.rs

@@ -5,7 +5,7 @@ pub static NPM: Manager = Manager {
     env: &[
         ("npm_config_proxy", PROXY),
         ("npm_config_https_proxy", PROXY),
-        ("npm_config_registry", "http://{npm}/"),
+        ("npm_config_registry", "http://registry.npmjs.org/"),
     ],
     args: &[],
 };

core/src/aliasing/managers/pip.rs

@@ -4,7 +4,7 @@ use super::{Manager, PROXY, PYPI_SIMPLE};
 const PIP_ENV: &[(&str, &str)] = &[
     ("PIP_PROXY", PROXY),
     ("PIP_INDEX_URL", PYPI_SIMPLE),
-    ("PIP_TRUSTED_HOST", "{host:pypi} {host:pypi-files}"),
+    ("PIP_TRUSTED_HOST", "pypi.org files.pythonhosted.org"),
     ("PIP_DISABLE_PIP_VERSION_CHECK", "1"),
 ];
 

core/src/aliasing/managers/pipenv.rs

@@ -10,7 +10,7 @@ pub static PIPENV: Manager = Manager {
         ("https_proxy", PROXY),
         ("PIPENV_PYPI_MIRROR", PYPI_SIMPLE),
         // pipenv installs through pip, which skips a plaintext index on a host it doesn't trust.
-        ("PIP_TRUSTED_HOST", "{host:pypi} {host:pypi-files}"),
+        ("PIP_TRUSTED_HOST", "pypi.org files.pythonhosted.org"),
     ],
     args: &[],
 };

core/src/aliasing/managers/pnpm.rs

@@ -6,7 +6,7 @@ pub static PNPM: Manager = Manager {
     env: &[
         ("pnpm_config_proxy", PROXY),
         ("pnpm_config_https_proxy", PROXY),
-        ("pnpm_config_registry", "http://{npm}/"),
+        ("pnpm_config_registry", "http://registry.npmjs.org/"),
     ],
     args: &[],
 };

core/src/aliasing/mod.rs

@@ -6,7 +6,6 @@ mod windows;
 pub use forward::spawn;
 pub use managers::*;
 
-use crate::FirewallConfig;
 use std::io::{Error, ErrorKind};
 use std::path::{Path, PathBuf};
 use std::process::Command;
@@ -22,12 +21,12 @@ impl Invocation {
     }
 
     /// What the program is run with: the typed arguments plus any its manager needs.
-    pub fn arguments(&self, proxy: &str, config: &FirewallConfig) -> Vec<String> {
+    pub fn arguments(&self, proxy: &str) -> Vec<String> {
         let mut args = self.args.clone();
         let Some(manager) = MANAGERS.iter().find(|manager| manager.command == self.program) else {
             return args;
         };
-        let ours = managers::arguments(proxy, config, manager, &args);
+        let ours = managers::arguments(proxy, manager, &args);
         // Anything after `--` belongs to another program, so ours go before it.
         let at = args.iter().position(|arg| arg == "--").unwrap_or(args.len());
         args.splice(at..at, ours);
@@ -35,20 +34,15 @@ impl Invocation {
     }
 }
 
-pub fn run(
-    port: u16,
-    config: &FirewallConfig,
-    invocation: &Invocation,
-    dir: Option<&Path>,
-) -> std::io::Result<i32> {
+pub fn run(port: u16, invocation: &Invocation, dir: Option<&Path>) -> std::io::Result<i32> {
     let proxy = crate::local_url(port, "");
     let program = resolve(&invocation.program)?;
     let mut command = Command::new(&program);
-    command.args(invocation.arguments(&proxy, config));
+    command.args(invocation.arguments(&proxy));
     if let Some(dir) = dir {
         command.current_dir(dir);
     }
-    for (key, value) in managers::variables(&proxy, config) {
+    for (key, value) in managers::variables(&proxy) {
         command.env(key, value);
     }
     #[cfg(windows)]

core/src/blocks.rs

@@ -1,14 +1,25 @@
+use crate::config::{self, AllowedPackage};
 use crate::policies::Package;
+use crate::Firewall;
+use rama::error::BoxError;
 use serde::Serialize;
+use std::path::Path;
 use std::sync::Mutex;
+use std::time::{Duration, Instant};
+use tokio::sync::watch;
 
-/// Bounded, so blocks pile up harmlessly while nothing collects them.
+/// So blocks can't pile up while no app collects them.
 const KEPT: usize = 50;
+/// Under pip's, pipenv's and pdm's 15 s read timeout, the shortest of the supported managers.
+const HOLD: Duration = Duration::from_secs(10);
+/// Only hold while an app is asking for blocks, so someone can answer.
+const WATCHED: Duration = Duration::from_secs(2);
+/// For a minute, so the rest of that install can fetch it too.
+const ONCE: Duration = Duration::from_secs(60);
 
-static RECENT: Mutex<Vec<BlockedPackage>> = Mutex::new(Vec::new());
-
-#[derive(Serialize)]
+#[derive(Clone, Serialize)]
 pub struct BlockedPackage {
+    pub id: u64,
     pub eco: &'static str,
     pub name: String,
     pub version: Option<String>,
@@ -16,21 +27,125 @@ pub struct BlockedPackage {
     pub reason: String,
 }
 
-pub fn record(eco: &'static str, pkg: &Package, filter: &'static str, reason: &str) {
-    let mut recent = RECENT.lock().unwrap_or_else(|e| e.into_inner());
-    if recent.len() == KEPT {
-        recent.remove(0);
+struct Blocks {
+    last_id: u64,
+    unsent: Vec<BlockedPackage>,
+    /// Age holds, the only blocks that can be allowed, each with what wakes its waiting downloads.
+    held: Vec<(BlockedPackage, watch::Sender<bool>)>,
+    polled: Option<Instant>,
+}
+
+static BLOCKS: Mutex<Blocks> =
+    Mutex::new(Blocks { last_id: 0, unsent: Vec::new(), held: Vec::new(), polled: None });
+
+/// Records a block and holds a new package's download for up to `HOLD`. Returns whether it was allowed.
+pub async fn block(eco: &'static str, pkg: &Package, filter: &'static str, reason: &str) -> bool {
+    let Some(mut answer) = record(eco, pkg, filter, reason) else {
+        return false;
+    };
+    let allowed = tokio::time::timeout(HOLD, answer.wait_for(|allowed| *allowed)).await;
+    matches!(allowed, Ok(Ok(_)))
+}
+
+/// The app's requests: `blocks`, `allow <id>` or `allow-once <id>`.
+/// An allow replies `late` if the download had stopped waiting.
+pub fn answer(firewall: &Firewall, config: &Path, request: &str) -> String {
+    if request == "blocks" {
+        return serde_json::to_string(&take()).expect("blocks serialize");
     }
-    recent.push(BlockedPackage {
+    let result = match request.split_once(' ').map(|(verb, id)| (verb, id.parse())) {
+        Some(("allow", Ok(id))) => trust(firewall, config, id),
+        Some(("allow-once", Ok(id))) => allow_once(firewall, id),
+        _ => Err(format!("unknown message {request}").into()),
+    };
+    match result {
+        Ok(true) => "ok".to_owned(),
+        Ok(false) => "late".to_owned(),
+        Err(error) => format!("error: {error}"),
+    }
+}
+
+/// Hands each block over once.
+fn take() -> Vec<BlockedPackage> {
+    let mut blocks = lock();
+    blocks.polled = Some(Instant::now());
+    std::mem::take(&mut blocks.unsent)
+}
+
+fn record(
+    eco: &'static str,
+    pkg: &Package,
+    filter: &'static str,
+    reason: &str,
+) -> Option<watch::Receiver<bool>> {
+    let mut blocks = lock();
+    let watched = blocks.polled.is_some_and(|polled| polled.elapsed() < WATCHED);
+    let holds = filter == "age" && watched;
+    // A repeat fetch of a held package waits on the same answer.
+    let waiting = blocks.held.iter().find(|(held, wake)| {
+        wake.receiver_count() > 0 && held.eco == eco && held.name == pkg.name && held.version == pkg.version
+    });
+    if let (true, Some((_, wake))) = (holds, waiting) {
+        return Some(wake.subscribe());
+    }
+    blocks.last_id += 1;
+    let block = BlockedPackage {
+        id: blocks.last_id,
         eco,
         name: pkg.name.clone(),
         version: pkg.version.clone(),
         filter,
         reason: reason.to_owned(),
-    });
+    };
+    push(&mut blocks.unsent, block.clone());
+    if filter != "age" {
+        return None;
+    }
+    let (wake, allowed) = watch::channel(false);
+    push(&mut blocks.held, (block, wake));
+    holds.then_some(allowed)
 }
 
-/// Hands each block over once.
-pub fn take() -> Vec<BlockedPackage> {
-    std::mem::take(&mut *RECENT.lock().unwrap_or_else(|e| e.into_inner()))
+/// Also saved to the config, so it survives a restart.
+fn trust(firewall: &Firewall, config: &Path, id: u64) -> Result<bool, BoxError> {
+    let block = held(id)?;
+    let version = block.version.ok_or("only a version can be trusted")?;
+    config::allow(config, block.eco, &block.name, &version)?;
+    let package = AllowedPackage { name: block.name, version: Some(version) };
+    firewall.lift_age_check(block.eco, package, None);
+    Ok(release(id))
+}
+
+fn allow_once(firewall: &Firewall, id: u64) -> Result<bool, BoxError> {
+    let block = held(id)?;
+    let package = AllowedPackage { name: block.name, version: block.version };
+    firewall.lift_age_check(block.eco, package, Some(Instant::now() + ONCE));
+    Ok(release(id))
+}
+
+fn held(id: u64) -> Result<BlockedPackage, BoxError> {
+    let blocks = lock();
+    let held = blocks.held.iter().find(|(held, _)| held.id == id);
+    Ok(held.ok_or(format!("no new package was held back as {id}"))?.0.clone())
+}
+
+/// Returns whether a download was still waiting.
+fn release(id: u64) -> bool {
+    let blocks = lock();
+    let Some((_, wake)) = blocks.held.iter().find(|(held, _)| held.id == id) else {
+        return false;
+    };
+    wake.send_replace(true);
+    wake.receiver_count() > 0
+}
+
+fn push<T>(list: &mut Vec<T>, item: T) {
+    if list.len() == KEPT {
+        list.remove(0);
+    }
+    list.push(item);
+}
+
+fn lock() -> std::sync::MutexGuard<'static, Blocks> {
+    BLOCKS.lock().unwrap_or_else(|e| e.into_inner())
 }

core/src/config/mod.rs

@@ -10,7 +10,7 @@ use std::path::{Path, PathBuf};
 
 pub const DEFAULT_PORT: u16 = 8080;
 
-#[derive(Debug, Clone, Deserialize)]
+#[derive(Debug, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 pub struct FirewallConfig {
     pub port: NonZeroU16,
@@ -26,7 +26,7 @@ pub struct FirewallConfig {
     pub registries: HashMap<String, Vec<String>>,
 }
 
-#[derive(Debug, Clone, Deserialize)]
+#[derive(Debug, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct AllowedPackage {
     pub name: String,
@@ -121,7 +121,7 @@ fn merge(base: &mut Map<String, Value>, top: Map<String, Value>) {
 }
 
 /// Adds an `allow` entry to the file, leaving the rest of it as written.
-pub fn allow(path: &Path, eco: &str, name: &str, version: Option<&str>) -> std::io::Result<()> {
+pub fn allow(path: &Path, eco: &str, name: &str, version: &str) -> std::io::Result<()> {
     let invalid = |e: String| Error::new(ErrorKind::InvalidData, format!("{}: {e}", path.display()));
     let mut config = match std::fs::read_to_string(path) {
         Ok(text) => serde_json::from_str(&text).map_err(|e| invalid(e.to_string()))?,

core/src/firewall.rs

@@ -1,4 +1,4 @@
-use crate::config::FirewallConfig;
+use crate::config::{AllowedPackage, FirewallConfig};
 use crate::policies::filters::age::Age;
 use crate::policies::filters::denylist::Denylist;
 use crate::policies::filters::osv::Osv;
@@ -6,12 +6,16 @@ use crate::policies::filters::Filter;
 use crate::policies::registries::*;
 use regex::Regex;
 use std::collections::HashMap;
+use std::sync::Mutex;
+use std::time::Instant;
 
 pub struct Firewall {
     pub config: FirewallConfig,
     registries: Vec<&'static Registry>,
     patterns: HashMap<&'static str, Vec<Regex>>,
     filters: Vec<Box<dyn Filter>>,
+    /// Each lift expires at its time, or lasts until the firewall stops. Never saved.
+    age_lifted: Mutex<Vec<(String, AllowedPackage, Option<Instant>)>>,
 }
 
 impl Default for Firewall {
@@ -34,7 +38,7 @@ impl Firewall {
         if config.min_age_hours > 0 {
             filters.push(Box::new(Age::new(config.min_age_hours)));
         }
-        Firewall { config, registries, patterns, filters }
+        Firewall { config, registries, patterns, filters, age_lifted: Mutex::default() }
     }
 
     pub fn match_on<'a>(
@@ -72,6 +76,19 @@ impl Firewall {
     pub fn filters(&self) -> &[Box<dyn Filter>] {
         &self.filters
     }
+
+    pub fn lift_age_check(&self, eco: &str, package: AllowedPackage, until: Option<Instant>) {
+        let mut lifted = self.age_lifted.lock().unwrap_or_else(|e| e.into_inner());
+        lifted.retain(|(_, _, until)| until.is_none_or(|until| until > Instant::now()));
+        lifted.push((eco.to_owned(), package, until));
+    }
+
+    pub fn age_check_lifted(&self, eco: &str, matches: impl Fn(&AllowedPackage) -> bool) -> bool {
+        let lifted = self.age_lifted.lock().unwrap_or_else(|e| e.into_inner());
+        lifted.iter().any(|(e, package, until)| {
+            e == eco && until.is_none_or(|until| until > Instant::now()) && matches(package)
+        })
+    }
 }
 
 /// The built-ins, then a copy of one per mirror. Leaked, as a `Registry` is `'static` everywhere.

core/src/main.rs

@@ -73,14 +73,13 @@ fn serve() -> ! {
 fn run(invocation: Invocation) -> ! {
     telemetry::set_mode("wrapper");
     let command = &invocation.program;
-    let config = load();
-    let port = match aliasing::spawn(0, config.clone()) {
+    let port = match aliasing::spawn(0, load()) {
         Ok(port) => port,
         Err(e) => fail("spawn", &format!("could not start the firewall: {e}")),
     };
     info!(url = %firewall::local_url(port, ""), "firewall listening");
 
-    let result = aliasing::run(port, &config, &invocation, None);
+    let result = aliasing::run(port, &invocation, None);
     telemetry::flush();
     match result {
         Ok(code) => exit(code),

core/src/os/macos/mod.rs

@@ -4,7 +4,7 @@ mod uninstall;
 
 pub use uninstall::uninstall;
 
-use crate::config::{self, FirewallConfig};
+use crate::config::FirewallConfig;
 use crate::{blocks, mitm, telemetry};
 use crate::Firewall;
 use rama::bytes::Bytes;
@@ -22,7 +22,6 @@ use rama::net::apple::networkextension::{transparent_proxy_ffi, NwTcpStream, Tcp
 use rama::rt::Executor;
 use rama::telemetry::tracing::apple::oslog::{OsLogLayer, Privacy};
 use rama::{Layer, Service};
-use serde::Deserialize;
 use std::convert::Infallible;
 use std::path::PathBuf;
 use std::sync::Arc;
@@ -40,6 +39,7 @@ const CONFIG_FILE: &str = "/Library/Application Support/Firewall/config.json";
 struct Handler {
     ca: Arc<mitm::CertificateAuthority>,
     hosts: Vec<&'static str>,
+    firewall: Arc<Firewall>,
     service: mitm::MitmService,
 }
 
@@ -59,12 +59,7 @@ impl TransparentProxyHandler for Handler {
         let message = String::from_utf8_lossy(&message).into_owned();
         Some(Bytes::from(match message.as_str() {
             "ca" => self.ca.pem.clone(),
-            "blocks" => serde_json::to_string(&blocks::take()).expect("blocks serialize"),
-            other => match other.strip_prefix("allow ").map(allow) {
-                Some(Ok(())) => "ok".to_owned(),
-                Some(Err(error)) => format!("error: {error}"),
-                None => format!("error: unknown message {other}"),
-            },
+            other => blocks::answer(&self.firewall, CONFIG_FILE.as_ref(), other),
         }))
     }
 
@@ -119,22 +114,8 @@ fn handler(exec: Executor) -> Result<Handler, BoxError> {
     let signer: mitm::CaSigner = Arc::new(key);
     let ca = install::certificate_authority(&hosts, &*signer);
     let ca = Arc::new(ca.inspect_err(|_| telemetry::error("ca"))?);
-    let service = mitm::mitm_service(firewall, &ca, signer, None, exec);
-    Ok(Handler { ca, hosts, service })
-}
-
-#[derive(Deserialize)]
-struct AllowRequest {
-    eco: String,
-    name: String,
-    version: Option<String>,
-}
-
-/// Takes effect when the provider restarts, which rebuilds it from the config.
-fn allow(request: &str) -> Result<(), BoxError> {
-    let request: AllowRequest = serde_json::from_str(request)?;
-    config::allow(CONFIG_FILE.as_ref(), &request.eco, &request.name, request.version.as_deref())?;
-    Ok(())
+    let service = mitm::mitm_service(firewall.clone(), &ca, signer, None, exec);
+    Ok(Handler { ca, hosts, firewall, service })
 }
 
 /// stderr is invisible in a system extension, so events go to the unified log:

core/src/os/windows/ca.rs

@@ -11,6 +11,7 @@ use std::time::{SystemTime, UNIX_EPOCH};
 use tracing::warn;
 use windows::Win32::Security::Authorization::{GetNamedSecurityInfoW, SE_FILE_OBJECT};
 use windows::Win32::Security::*;
+use windows::Win32::Storage::FileSystem::CreateDirectoryW;
 use windows_registry::Type;
 
 /// SYSTEM and admins write, users only read, so no one else can plant a CA for node.
@@ -65,25 +66,39 @@ pub fn load_or_create_ca(
     Ok(ca)
 }
 
-/// Created on first use, its owner and ACL reset every time. One a user made first, or a link,
+/// Created on first use with its ACL, which is reset every time. One a user made first, or a link,
 /// is replaced: its owner could grant itself access again, and a link would redirect our writes.
 pub(super) fn secure_data_dir() -> io::Result<PathBuf> {
     let dir = data_dir();
-    match std::fs::symlink_metadata(&dir) {
-        Ok(meta) if meta.file_type().is_symlink() => std::fs::remove_dir(&dir)?,
+    let exists = match std::fs::symlink_metadata(&dir) {
+        Ok(meta) if meta.file_type().is_symlink() => {
+            std::fs::remove_dir(&dir)?;
+            false
+        }
         Ok(_) if !owned_by_admins(&dir)? => {
             warn!(dir = %dir.display(), "replacing a data folder not created by an admin");
-            std::fs::remove_dir_all(&dir)?
+            std::fs::remove_dir_all(&dir)?;
+            false
         }
-        _ => {}
-    }
-    std::fs::create_dir_all(&dir)?;
+        Ok(_) => true,
+        Err(_) => false,
+    };
     let info = OWNER_SECURITY_INFORMATION
         | DACL_SECURITY_INFORMATION
         | PROTECTED_DACL_SECURITY_INFORMATION;
     let path = HSTRING::from(dir.as_path());
     let acl = security_descriptor(DATA_DIR_ACL)?;
-    unsafe { SetFileSecurityW(&path, info, PSECURITY_DESCRIPTOR(acl.0)).ok()? };
+    if exists {
+        unsafe { SetFileSecurityW(&path, info, PSECURITY_DESCRIPTOR(acl.0)).ok()? };
+    } else {
+        let attributes = SECURITY_ATTRIBUTES {
+            nLength: size_of::<SECURITY_ATTRIBUTES>() as u32,
+            lpSecurityDescriptor: acl.0,
+            bInheritHandle: false.into(),
+        };
+        // Never inherits ProgramData's ACL, which lets users add files; fails if it was recreated.
+        unsafe { CreateDirectoryW(&path, Some(&attributes))? };
+    }
     Ok(dir)
 }
 

core/src/policies/filters/mod.rs

@@ -3,6 +3,7 @@ pub mod denylist;
 pub mod osv;
 
 use super::registries::{Package, Registry};
+use crate::config::AllowedPackage;
 use crate::Firewall;
 use std::future::Future;
 use std::pin::Pin;
@@ -31,10 +32,11 @@ pub async fn consult(
     registry: &'static Registry,
     pkg: &Package,
 ) -> Option<(&'static str, Verdict)> {
-    let allowed = allowed(firewall, registry, pkg);
+    let lifted = allowed(firewall, registry, pkg)
+        || firewall.age_check_lifted(registry.eco, |entry| matches(registry, pkg, entry));
     let mut unsure = None;
     for filter in firewall.filters() {
-        if allowed && filter.name() == "age" {
+        if lifted && filter.name() == "age" {
             continue;
         }
         match filter.check(registry, pkg).await {
@@ -51,13 +53,15 @@ fn allowed(firewall: &Firewall, registry: &Registry, pkg: &Package) -> bool {
     let Some(entries) = firewall.config.allow.get(registry.eco) else {
         return false;
     };
-    entries.iter().any(|entry| {
-        let name_matches = match registry.normalize {
-            Some(normalize) => normalize(&entry.name) == pkg.name,
-            None => entry.name == pkg.name,
-        };
-        // Go writes a leading v that the parsed version drops, and PEP 440 ignores one.
-        let version = entry.version.as_deref().map(|v| v.strip_prefix('v').unwrap_or(v));
-        name_matches && (version.is_none() || version == pkg.version.as_deref())
-    })
+    entries.iter().any(|entry| matches(registry, pkg, entry))
+}
+
+fn matches(registry: &Registry, pkg: &Package, entry: &AllowedPackage) -> bool {
+    let name_matches = match registry.normalize {
+        Some(normalize) => normalize(&entry.name) == pkg.name,
+        None => entry.name == pkg.name,
+    };
+    // Go writes a leading v that the parsed version drops, and PEP 440 ignores one.
+    let version = entry.version.as_deref().map(|v| v.strip_prefix('v').unwrap_or(v));
+    name_matches && (version.is_none() || version == pkg.version.as_deref())
 }

core/src/policies/mod.rs

@@ -70,7 +70,10 @@ pub async fn screen(url: &str, firewall: &Firewall) -> Option<String> {
     info!(eco = registry.eco, pkg = %pkg.label(), %url, "screening");
     match consult(firewall, registry, &pkg).await {
         Some((filter, Verdict::Deny(reason))) => {
-            crate::blocks::record(registry.eco, &pkg, filter, &reason);
+            if crate::blocks::block(registry.eco, &pkg, filter, &reason).await {
+                info!(eco = registry.eco, pkg = %pkg.label(), "allowed while held");
+                return None;
+            }
             Some(format!("{} {reason}", pkg.label()))
         }
         Some((filter, Verdict::Unknown(e))) if !firewall.config.fail_open => {

core/tests/blocks.rs

@@ -0,0 +1,27 @@
+use firewall::blocks::{answer, block};
+use firewall::policies::Package;
+use firewall::Firewall;
+use std::path::Path;
+use std::time::Duration;
+
+#[tokio::test]
+async fn allowing_once_releases_the_held_download() {
+    let firewall = Firewall::default();
+    let config = Path::new("/nonexistent/config.json");
+    let pkg = Package { name: "left-pad".into(), version: Some("1.3.0".into()) };
+    assert!(!block("npm", &pkg, "age", "is new").await, "held while nothing was asking");
+    answer(&firewall, config, "blocks");
+
+    let held = tokio::spawn(async move { block("npm", &pkg, "age", "is new").await });
+    let id = loop {
+        let blocks: serde_json::Value = serde_json::from_str(&answer(&firewall, config, "blocks")).unwrap();
+        if let Some(id) = blocks[0]["id"].as_u64() {
+            break id;
+        }
+        tokio::time::sleep(Duration::from_millis(10)).await;
+    };
+    assert_eq!(answer(&firewall, config, &format!("allow-once {id}")), "ok");
+    assert!(held.await.unwrap(), "the waiting download goes through");
+    assert!(firewall.age_check_lifted("npm", |p| p.name == "left-pad"), "and the rest of the install");
+    assert!(!block("npm", &Package { name: "evil".into(), version: None }, "denylist", "is malware").await);
+}

core/tests/config.rs

@@ -1,4 +1,4 @@
-use firewall::config::path;
+use firewall::config::{path, AllowedPackage};
 use firewall::policies::filters::consult;
 use firewall::policies::{screen, Package};
 use firewall::{Firewall, FirewallConfig};
@@ -95,12 +95,23 @@ async fn failing_closed_blocks_what_could_not_be_checked() {
     assert!(blocked.contains("could not be checked"), "{blocked:?}");
 }
 
+#[tokio::test]
+async fn lifting_the_age_check_still_checks_for_malware() {
+    let config = r#"{"denylist": {"base": "http://127.0.0.1:1"}}"#;
+    let firewall = Firewall::new(serde_json::from_str(config).expect("parses"));
+    let (registry, _) = firewall.match_on("/go/golang.org/x/net/@v/list", |r| r.prefix).expect("go");
+    let pkg = Package { name: "golang.org/x/net".into(), version: Some("0.20.0".into()) };
+    firewall.lift_age_check("go", AllowedPackage { name: pkg.name.clone(), version: None }, None);
+    let (filter, _) = consult(&firewall, registry, &pkg).await.expect("the denylist still runs");
+    assert_eq!(filter, "denylist");
+}
+
 #[test]
 fn allowing_keeps_the_rest_of_the_file() {
     let path = std::env::temp_dir().join(format!("firewall-allow-{}.json", std::process::id()));
     std::fs::write(&path, r#"{"fail_open": false}"#).expect("write");
     for _ in 0..2 {
-        firewall::config::allow(&path, "npm", "left-pad", Some("1.3.0")).expect("allow");
+        firewall::config::allow(&path, "npm", "left-pad", "1.3.0").expect("allow");
     }
     let text = std::fs::read_to_string(&path).expect("read");
     std::fs::remove_file(&path).ok();

core/tests/managers.rs

@@ -1,11 +1,11 @@
 use firewall::aliasing::managers::*;
 use firewall::aliasing::Invocation;
-use firewall::{Firewall, FirewallConfig};
+use firewall::Firewall;
 
 #[test]
 fn arguments_after_a_double_dash_reach_the_program() {
     let typed = ["run", "--", "--release"].map(String::from).to_vec();
-    let args = Invocation::new("cargo".into(), typed).arguments("http://127.0.0.1:9000", &FirewallConfig::default());
+    let args = Invocation::new("cargo".into(), typed).arguments("http://127.0.0.1:9000");
     assert_eq!(args.first().map(String::as_str), Some("run"));
     assert_eq!(args[args.len() - 2..], ["--", "--release"]);
 }
@@ -13,23 +13,12 @@ fn arguments_after_a_double_dash_reach_the_program() {
 #[test]
 fn recipes_expand_into_the_environment() {
     let var = |name: &str, value: &str| (name.to_string(), value.to_string());
-    let config = FirewallConfig::default();
-    let npm = variables("http://127.0.0.1:9000", &config);
+    let npm = variables("http://127.0.0.1:9000");
     assert!(npm.contains(&var("npm_config_proxy", "http://127.0.0.1:9000")));
     assert!(npm.contains(&var("npm_config_registry", "http://registry.npmjs.org/")));
-    let gem = arguments("http://127.0.0.1:9000", &config, &GEM, &["install".to_string()]);
+    let gem = arguments("http://127.0.0.1:9000", &GEM, &["install".to_string()]);
     assert_eq!(gem, ["--clear-sources", "--source", "http://rubygems.org/"]);
-    assert!(arguments("http://127.0.0.1:9000", &config, &GEM, &["sources".to_string()]).is_empty());
-}
-
-#[test]
-fn a_mirror_replaces_the_registry_it_copies() {
-    let var = |name: &str, value: &str| (name.to_string(), value.to_string());
-    let config = r#"{"registries": {"npm": ["https://npm.example.com/"], "pypi": ["https://art.example.com/pypi/"]}}"#;
-    let env = variables("http://127.0.0.1:9000", &serde_json::from_str(config).expect("parses"));
-    assert!(env.contains(&var("npm_config_registry", "http://npm.example.com/")));
-    assert!(env.contains(&var("PIP_INDEX_URL", "http://art.example.com/pypi/simple")));
-    assert!(env.contains(&var("PIP_TRUSTED_HOST", "art.example.com files.pythonhosted.org")));
+    assert!(arguments("http://127.0.0.1:9000", &GEM, &["sources".to_string()]).is_empty());
 }
 
 #[test]
@@ -45,17 +34,15 @@ fn no_two_managers_set_a_variable_differently() {
 
 #[tokio::test]
 async fn every_overridden_registry_is_known() {
-    let config = FirewallConfig::default();
     let hosts = Firewall::default().hosts();
-    let values = variables("", &config).into_iter().map(|(_, value)| value);
-    let flags = MANAGERS.iter().flat_map(|manager| {
-        let typed: Vec<String> = manager.args.iter().flat_map(|args| args.when).map(|arg| arg.to_string()).collect();
-        arguments("", &config, manager, &typed)
-    });
-    for value in values.chain(flags) {
-        for (_, after) in value.match_indices("http://").map(|(i, _)| value.split_at(i + 7)) {
-            let host = after.split(['/', '"']).next().unwrap_or(after);
-            assert!(hosts.contains(&host), "{value} points at {host}");
+    for manager in MANAGERS {
+        let values = manager.env.iter().map(|(_, value)| *value);
+        let flags = manager.args.iter().flat_map(|args| args.flags.iter().copied());
+        for value in values.chain(flags) {
+            for (_, after) in value.match_indices("http://").map(|(i, _)| value.split_at(i + 7)) {
+                let host = after.split(['/', '"']).next().unwrap_or(after);
+                assert!(hosts.contains(&host), "{} points at {host}", manager.command);
+            }
         }
     }
 }

core/tests/proxy-test/main.rs

@@ -6,11 +6,10 @@ use probe::Outcome;
 
 fn main() -> std::io::Result<()> {
     firewall::init_logging("info");
-    let config = FirewallConfig::load()?;
-    let port = aliasing::spawn(0, config.clone())?;
+    let port = aliasing::spawn(0, FirewallConfig::load()?)?;
     println!("firewall proxy on {}\n", firewall::local_url(port, ""));
 
-    let results = probe::all(port, &config);
+    let results = probe::all(port);
     println!();
     let mut failed = 0;
     for (name, outcome) in &results {

core/tests/proxy-test/probe.rs

@@ -1,5 +1,4 @@
 use firewall::aliasing::{self, Invocation, Manager, CARGO, GEM, GO, NPM, PIP, PIP3, UV};
-use firewall::FirewallConfig;
 use std::path::PathBuf;
 
 struct Probe {
@@ -30,14 +29,14 @@ static PROBES: &[Probe] = &[
     },
 ];
 
-pub fn all(port: u16, config: &FirewallConfig) -> Vec<(&'static str, Outcome)> {
-    PROBES.iter().map(|probe| (probe.manager.command, run(probe, port, config))).collect()
+pub fn all(port: u16) -> Vec<(&'static str, Outcome)> {
+    PROBES.iter().map(|probe| (probe.manager.command, run(probe, port))).collect()
 }
 
-fn run(probe: &Probe, port: u16, config: &FirewallConfig) -> Outcome {
+fn run(probe: &Probe, port: u16) -> Outcome {
     let args = probe.args.iter().map(|arg| arg.to_string()).collect();
     let dir = probe.setup.and_then(|prepare| prepare());
-    match aliasing::run(port, config, &Invocation::new(probe.manager.command.into(), args), dir.as_deref()) {
+    match aliasing::run(port, &Invocation::new(probe.manager.command.into(), args), dir.as_deref()) {
         Ok(0) => Outcome::Ok,
         Ok(_) => Outcome::Failed,
         Err(e) if e.kind() == std::io::ErrorKind::NotFound => Outcome::Absent,