Store config under com.usestrix.firewall

* Sign with Developer ID and notarize the package

* Name signing identities by type

* Say how signing identities are matched

* Notarize only when NOTARY_PROFILE is set

core/src/config/mod.rs

@@ -59,8 +59,8 @@ impl Default for FirewallConfig {
 impl Default for DenylistSource {
     fn default() -> Self {
         DenylistSource {
-            base: "https://raw.githubusercontent.com/usestrix/malicious-packages/packages".into(),
-            revision: "https://api.github.com/repos/usestrix/malicious-packages/commits/packages"
+            base: "https://raw.githubusercontent.com/usestrix/firewall-blocklist/main".into(),
+            revision: "https://api.github.com/repos/usestrix/firewall-blocklist/commits/main"
                 .into(),
             poll_secs: 10,
         }
@@ -100,6 +100,6 @@ impl FirewallConfig {
 }
 
 pub fn path() -> Option<PathBuf> {
-    let dirs = ProjectDirs::from("ai", "strix", "firewall")?;
+    let dirs = ProjectDirs::from("com", "usestrix", "firewall")?;
     Some(dirs.config_dir().join("config.json"))
 }

macos/build.sh

@@ -1,8 +1,10 @@
 #!/bin/bash
 # Builds and signs Firewall.app, installs it to /Applications, and packages it as build/Firewall.pkg.
+# The package is notarized with the notarytool keychain profile in NOTARY_PROFILE; `build.sh debug`
+# makes a Debug build and skips notarization.
 #
-# Xcode builds the bundles unsigned; they are signed here because the granted NetworkExtension
-# entitlement has no -systemextension variant, so Xcode cannot sign them itself.
+# Xcode builds the bundles unsigned; they are signed here. Debug builds use Apple Development signing
+# because macOS refuses to activate a Developer ID extension that is not notarized.
 set -euo pipefail
 cd "$(dirname "$0")"
 
@@ -10,13 +12,27 @@ cd "$(dirname "$0")"
 : "${TEAM:?set TEAM in macos/.env}"
 export TEAM
 
+# Identities are matched as a substring of the certificate name; set them if more than one matches.
+# Development profiles grant only the plain NetworkExtension values, Developer ID ones only -systemextension.
+if [ "${1:-}" = debug ]; then
+  CONFIGURATION=Debug
+  IDENTITY=${DEBUG_IDENTITY:-Apple Development}
+  NE_PROVIDER=app-proxy-provider
+else
+  CONFIGURATION=Release
+  IDENTITY=${IDENTITY:-Developer ID Application}
+  NE_PROVIDER=app-proxy-provider-systemextension
+  : "${NOTARY_PROFILE:?set NOTARY_PROFILE in macos/.env}"
+fi
+export NE_PROVIDER
+
 APP_ID=com.usestrix.firewall
 EXT_ID=com.usestrix.firewall.extension
 VERSION=0.1
-IDENTITY=${IDENTITY:-$(security find-identity -v -p codesigning | awk -F'"' '/Apple Development/ {print $2; exit}')}
+INSTALLER_IDENTITY=${INSTALLER_IDENTITY:-Developer ID Installer}
 PROFILES="$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles"
 
-APP=build/Build/Products/Debug/Installer.app
+APP=build/Build/Products/$CONFIGURATION/Installer.app
 EXT=$APP/Contents/Library/SystemExtensions/$EXT_ID.systemextension
 PKG_ROOT=build/pkg-root
 
@@ -25,12 +41,13 @@ main() {
   sign
   install_app
   package
+  [ $CONFIGURATION = Debug ] || notarize
 }
 
 build() {
   echo "==> Building"
   xcodegen generate >/dev/null
-  xcodebuild -project Firewall.xcodeproj -scheme Installer -configuration Debug \
+  xcodebuild -project Firewall.xcodeproj -scheme Installer -configuration $CONFIGURATION \
     -derivedDataPath build CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO \
     CODE_SIGN_IDENTITY="" CODE_SIGN_ENTITLEMENTS="" build >/dev/null
 }
@@ -39,9 +56,9 @@ sign() {
   echo "==> Signing with $IDENTITY"
   cp "$(profile_for $APP_ID)" "$APP/Contents/embedded.provisionprofile"
   cp "$(profile_for $EXT_ID)" "$EXT/Contents/embedded.provisionprofile"
-  codesign --force --options runtime --timestamp=none \
+  codesign --force --options runtime --timestamp \
     --entitlements Extension/Extension.entitlements -s "$IDENTITY" "$EXT"
-  codesign --force --options runtime --timestamp=none \
+  codesign --force --options runtime --timestamp \
     --entitlements Installer/Installer.entitlements -s "$IDENTITY" "$APP"
   codesign --verify --deep --strict "$APP"
 }
@@ -64,15 +81,25 @@ package() {
   pkgbuild --analyze --root "$PKG_ROOT" build/components.plist >/dev/null
   plutil -replace 0.BundleIsRelocatable -bool NO build/components.plist
   pkgbuild --root "$PKG_ROOT" --component-plist build/components.plist --scripts pkg \
-    --identifier $APP_ID --version $VERSION --install-location / build/Firewall.pkg >/dev/null
+    --identifier $APP_ID --version $VERSION --install-location / --sign "$INSTALLER_IDENTITY" \
+    build/Firewall.pkg >/dev/null
 }
 
-# Prints the newest provisioning profile Xcode has downloaded for a bundle id.
+notarize() {
+  echo "==> Notarizing build/Firewall.pkg"
+  xcrun notarytool submit build/Firewall.pkg --keychain-profile "$NOTARY_PROFILE" --wait
+  xcrun stapler staple build/Firewall.pkg
+}
+
+# Prints the newest provisioning profile Xcode has downloaded for a bundle id that grants NE_PROVIDER.
 profile_for() {
-  local want=$TEAM.$1 newest= newest_time=0 id t
+  local want=$TEAM.$1 newest= newest_time=0 profile id t
   for p in "$PROFILES"/*.provisionprofile; do
-    id=$(security cms -D -i "$p" | plutil -extract Entitlements.com\\.apple\\.application-identifier raw -o - -)
+    profile=$(security cms -D -i "$p")
+    id=$(plutil -extract Entitlements.com\\.apple\\.application-identifier raw -o - - <<<"$profile")
     [ "$id" = "$want" ] || continue
+    plutil -extract Entitlements.com\\.apple\\.developer\\.networking\\.networkextension json -o - - <<<"$profile" |
+      grep -q "\"$NE_PROVIDER\"" || continue
     t=$(stat -f %m "$p")
     if [ "$t" -gt "$newest_time" ]; then newest=$p; newest_time=$t; fi
   done

macos/project.yml

@@ -55,7 +55,7 @@ targets:
         com.apple.application-identifier: ${TEAM}.com.usestrix.firewall.extension
         com.apple.developer.team-identifier: ${TEAM}
         com.apple.developer.networking.networkextension:
-          - app-proxy-provider
+          - ${NE_PROVIDER}
         # NE requires NEMachServiceName to start with one of these.
         com.apple.security.application-groups:
           - ${TEAM}.com.usestrix.firewall
@@ -111,7 +111,7 @@ targets:
         com.apple.developer.team-identifier: ${TEAM}
         com.apple.developer.system-extension.install: true
         com.apple.developer.networking.networkextension:
-          - app-proxy-provider
+          - ${NE_PROVIDER}
         com.apple.security.network.client: true
     dependencies:
       - target: Extension