Add a debug build that skips notarization

core/src/config/mod.rs

@@ -59,8 +59,8 @@ impl Default for FirewallConfig {
 impl Default for DenylistSource {
     fn default() -> Self {
         DenylistSource {
-            base: "https://raw.githubusercontent.com/usestrix/firewall-blocklist/main".into(),
-            revision: "https://api.github.com/repos/usestrix/firewall-blocklist/commits/main"
+            base: "https://raw.githubusercontent.com/usestrix/malicious-packages/packages".into(),
+            revision: "https://api.github.com/repos/usestrix/malicious-packages/commits/packages"
                 .into(),
             poll_secs: 10,
         }

macos/build.sh

@@ -3,8 +3,7 @@
 # The package is notarized with the notarytool keychain profile in NOTARY_PROFILE; `build.sh debug`
 # makes a Debug build and skips notarization.
 #
-# Xcode builds the bundles unsigned; they are signed here. Debug builds use Apple Development signing
-# because macOS refuses to activate a Developer ID extension that is not notarized.
+# Xcode builds the bundles unsigned; they are signed here with Developer ID.
 set -euo pipefail
 cd "$(dirname "$0")"
 
@@ -12,23 +11,15 @@ cd "$(dirname "$0")"
 : "${TEAM:?set TEAM in macos/.env}"
 export TEAM
 
-# Identities are matched as a substring of the certificate name; set them if more than one matches.
-# Development profiles grant only the plain NetworkExtension values, Developer ID ones only -systemextension.
-if [ "${1:-}" = debug ]; then
-  CONFIGURATION=Debug
-  IDENTITY=${DEBUG_IDENTITY:-Apple Development}
-  NE_PROVIDER=app-proxy-provider
-else
-  CONFIGURATION=Release
-  IDENTITY=${IDENTITY:-Developer ID Application}
-  NE_PROVIDER=app-proxy-provider-systemextension
-  : "${NOTARY_PROFILE:?set NOTARY_PROFILE in macos/.env}"
-fi
-export NE_PROVIDER
+CONFIGURATION=Release
+if [ "${1:-}" = debug ]; then CONFIGURATION=Debug; fi
+[ $CONFIGURATION = Debug ] || : "${NOTARY_PROFILE:?set NOTARY_PROFILE in macos/.env}"
 
 APP_ID=com.usestrix.firewall
 EXT_ID=com.usestrix.firewall.extension
 VERSION=0.1
+# Matched as a substring of the certificate name; set these if more than one certificate matches.
+IDENTITY=${IDENTITY:-Developer ID Application}
 INSTALLER_IDENTITY=${INSTALLER_IDENTITY:-Developer ID Installer}
 PROFILES="$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles"
 
@@ -91,15 +82,12 @@ notarize() {
   xcrun stapler staple build/Firewall.pkg
 }
 
-# Prints the newest provisioning profile Xcode has downloaded for a bundle id that grants NE_PROVIDER.
+# Prints the newest provisioning profile Xcode has downloaded for a bundle id.
 profile_for() {
-  local want=$TEAM.$1 newest= newest_time=0 profile id t
+  local want=$TEAM.$1 newest= newest_time=0 id t
   for p in "$PROFILES"/*.provisionprofile; do
-    profile=$(security cms -D -i "$p")
-    id=$(plutil -extract Entitlements.com\\.apple\\.application-identifier raw -o - - <<<"$profile")
+    id=$(security cms -D -i "$p" | plutil -extract Entitlements.com\\.apple\\.application-identifier raw -o - -)
     [ "$id" = "$want" ] || continue
-    plutil -extract Entitlements.com\\.apple\\.developer\\.networking\\.networkextension json -o - - <<<"$profile" |
-      grep -q "\"$NE_PROVIDER\"" || continue
     t=$(stat -f %m "$p")
     if [ "$t" -gt "$newest_time" ]; then newest=$p; newest_time=$t; fi
   done

macos/project.yml

@@ -55,7 +55,7 @@ targets:
         com.apple.application-identifier: ${TEAM}.com.usestrix.firewall.extension
         com.apple.developer.team-identifier: ${TEAM}
         com.apple.developer.networking.networkextension:
-          - ${NE_PROVIDER}
+          - app-proxy-provider-systemextension
         # NE requires NEMachServiceName to start with one of these.
         com.apple.security.application-groups:
           - ${TEAM}.com.usestrix.firewall
@@ -111,7 +111,7 @@ targets:
         com.apple.developer.team-identifier: ${TEAM}
         com.apple.developer.system-extension.install: true
         com.apple.developer.networking.networkextension:
-          - ${NE_PROVIDER}
+          - app-proxy-provider-systemextension
         com.apple.security.network.client: true
     dependencies:
       - target: Extension