Change npm's lockfile registry URLs back to https:// after a wrapped run

.github/workflows/build-macos-pkg.yml

@@ -1,54 +0,0 @@
-name: Build Firewall.pkg
-
-on:
-  workflow_call:
-    inputs:
-      plan:
-        required: true
-        type: string
-
-jobs:
-  pkg:
-    runs-on: macos-26
-    env:
-      TEAM: ${{ vars.APPLE_TEAM }}
-      NOTARY_PROFILE: firewall
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-      - run: brew install xcodegen
-      - name: Install signing identities, profiles and notary key
-        env:
-          CERTIFICATES: ${{ secrets.MACOS_CERTIFICATES }}
-          CERTIFICATES_PASSWORD: ${{ secrets.MACOS_CERTIFICATES_PASSWORD }}
-          APP_PROFILE: ${{ secrets.MACOS_APP_PROFILE }}
-          EXTENSION_PROFILE: ${{ secrets.MACOS_EXTENSION_PROFILE }}
-          NOTARY_KEY: ${{ secrets.NOTARY_KEY }}
-          NOTARY_KEY_ID: ${{ secrets.NOTARY_KEY_ID }}
-          NOTARY_ISSUER: ${{ secrets.NOTARY_ISSUER }}
-        run: |
-          keychain="$RUNNER_TEMP/signing.keychain-db"
-          security create-keychain -p "" "$keychain"
-          security set-keychain-settings "$keychain"
-          security unlock-keychain -p "" "$keychain"
-          security default-keychain -s "$keychain"
-          security list-keychains -d user -s "$keychain" login.keychain
-          base64 --decode <<<"$CERTIFICATES" > "$RUNNER_TEMP/certificates.p12"
-          security import "$RUNNER_TEMP/certificates.p12" -k "$keychain" -P "$CERTIFICATES_PASSWORD" \
-            -T /usr/bin/codesign -T /usr/bin/pkgbuild
-          security set-key-partition-list -S apple-tool:,apple: -s -k "" "$keychain" >/dev/null
-
-          profiles="$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles"
-          mkdir -p "$profiles"
-          base64 --decode <<<"$APP_PROFILE" > "$profiles/app.provisionprofile"
-          base64 --decode <<<"$EXTENSION_PROFILE" > "$profiles/extension.provisionprofile"
-
-          printf '%s' "$NOTARY_KEY" > "$RUNNER_TEMP/notary.p8"
-          xcrun notarytool store-credentials "$NOTARY_PROFILE" \
-            --key "$RUNNER_TEMP/notary.p8" --key-id "$NOTARY_KEY_ID" --issuer "$NOTARY_ISSUER"
-      - run: macos/build.sh
-      - uses: actions/upload-artifact@v7
-        with:
-          name: artifacts-macos-pkg
-          path: macos/build/Firewall.pkg

.github/workflows/release.yml

@@ -211,24 +211,14 @@ jobs:
           path: |
             ${{ steps.cargo-dist.outputs.paths }}
             ${{ env.BUILD_MANIFEST_NAME }}
-
-  custom-build-macos-pkg:
-    needs:
-      - plan
-      - build-local-artifacts
-    uses: ./.github/workflows/build-macos-pkg.yml
-    with:
-      plan: ${{ needs.plan.outputs.val }}
-    secrets: inherit
   # Determines if we should publish/announce
   host:
     needs:
       - plan
       - build-local-artifacts
       - build-global-artifacts
-      - custom-build-macos-pkg
     # Only run if we're "publishing", and only if plan, local and global didn't fail (skipped is fine)
-    if: ${{ always() && needs.plan.result == 'success' && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.custom-build-macos-pkg.result == 'skipped' || needs.custom-build-macos-pkg.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }}
+    if: ${{ always() && needs.plan.result == 'success' && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }}
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     runs-on: "ubuntu-22.04"
@@ -288,6 +278,52 @@ jobs:
 
           gh release create "${{ needs.plan.outputs.tag }}" --target "$RELEASE_COMMIT" $PRERELEASE_FLAG --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/*
 
+  publish-homebrew-formula:
+    needs:
+      - plan
+      - host
+    runs-on: "ubuntu-22.04"
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      PLAN: ${{ needs.plan.outputs.val }}
+      GITHUB_USER: "axo bot"
+      GITHUB_EMAIL: "[email protected]"
+    if: ${{ !fromJson(needs.plan.outputs.val).announcement_is_prerelease || fromJson(needs.plan.outputs.val).publish_prereleases }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: true
+          repository: "usestrix/homebrew-tap"
+          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+      # So we have access to the formula
+      - name: Fetch homebrew formulae
+        uses: actions/download-artifact@v8
+        with:
+          pattern: artifacts-*
+          path: Formula/
+          merge-multiple: true
+      # This is extra complex because you can make your Formula name not match your app name
+      # so we need to find releases with a *.rb file, and publish with that filename.
+      - name: Commit formula files
+        run: |
+          git config --global user.name "${GITHUB_USER}"
+          git config --global user.email "${GITHUB_EMAIL}"
+
+          for release in $(echo "$PLAN" | jq --compact-output '.releases[] | select([.artifacts[] | endswith(".rb")] | any)'); do
+            filename=$(echo "$release" | jq '.artifacts[] | select(endswith(".rb"))' --raw-output)
+            name=$(echo "$filename" | sed "s/\.rb$//")
+            version=$(echo "$release" | jq .app_version --raw-output)
+
+            export PATH="/home/linuxbrew/.linuxbrew/bin:$PATH"
+            brew update
+            # We avoid reformatting user-provided data such as the app description and homepage.
+            brew style --except-cops FormulaAudit/Homepage,FormulaAudit/Desc,FormulaAuditStrict --fix "Formula/${filename}" || true
+
+            git add "Formula/${filename}"
+            git commit -m "${name} ${version}"
+          done
+          git push
+
   custom-publish-crates:
     needs:
       - plan
@@ -306,11 +342,12 @@ jobs:
     needs:
       - plan
       - host
+      - publish-homebrew-formula
       - custom-publish-crates
     # use "always() && ..." to allow us to wait for all publish jobs while
     # still allowing individual publish jobs to skip themselves (for prereleases).
     # "host" however must run to completion, no skipping allowed!
-    if: ${{ always() && needs.host.result == 'success' && (needs.custom-publish-crates.result == 'skipped' || needs.custom-publish-crates.result == 'success') }}
+    if: ${{ always() && needs.host.result == 'success' && (needs.publish-homebrew-formula.result == 'skipped' || needs.publish-homebrew-formula.result == 'success') && (needs.custom-publish-crates.result == 'skipped' || needs.custom-publish-crates.result == 'success') }}
     runs-on: "ubuntu-22.04"
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

core/Cargo.lock

@@ -3370,7 +3370,7 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "strix-firewall"
-version = "0.1.0-rc.1"
+version = "0.1.0"
 dependencies = [
  "clap",
  "core-foundation 0.10.1",

core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "strix-firewall"
-version = "0.1.0-rc.1"
+version = "0.1.0"
 edition = "2021"
 license = "Apache-2.0"
 authors = ["Strix"]

core/src/aliasing/managers/mod.rs

@@ -37,7 +37,13 @@ pub struct Manager {
     pub env: &'static [(&'static str, &'static str)],
     pub args: &'static [Args],
     /// Where the manager records registry URLs, which then carry our http:// override.
-    pub lockfile: Option<&'static str>,
+    pub lockfile: Option<Lockfile>,
+}
+
+/// What to do after a run about http:// registry URLs left in the lockfile at this path.
+pub enum Lockfile {
+    Restore(&'static str),
+    Warn(&'static str),
 }
 
 pub static MANAGERS: &[&Manager] =

core/src/aliasing/managers/npm.rs

@@ -1,4 +1,4 @@
-use super::{Manager, PROXY};
+use super::{Lockfile, Manager, PROXY};
 
 pub static NPM: Manager = Manager {
     command: "npm",
@@ -8,5 +8,5 @@ pub static NPM: Manager = Manager {
         ("npm_config_registry", "http://registry.npmjs.org/"),
     ],
     args: &[],
-    lockfile: Some("package-lock.json"),
+    lockfile: Some(Lockfile::Restore("package-lock.json")),
 };

core/src/aliasing/managers/uv.rs

@@ -1,8 +1,8 @@
-use super::{Manager, PROXY, PYPI_SIMPLE};
+use super::{Lockfile, Manager, PROXY, PYPI_SIMPLE};
 
 pub static UV: Manager = Manager {
     command: "uv",
     env: &[("HTTP_PROXY", PROXY), ("http_proxy", PROXY), ("UV_DEFAULT_INDEX", PYPI_SIMPLE)],
     args: &[],
-    lockfile: Some("uv.lock"),
+    lockfile: Some(Lockfile::Warn("uv.lock")),
 };

core/src/aliasing/mod.rs

@@ -10,7 +10,7 @@ use crate::policies::registries::BUILT_IN;
 use std::io::{Error, ErrorKind};
 use std::path::{Path, PathBuf};
 use std::process::Command;
-use tracing::warn;
+use tracing::{info, warn};
 
 pub struct Invocation {
     pub program: String,
@@ -54,8 +54,10 @@ pub fn run(port: u16, invocation: &Invocation, dir: Option<&Path>) -> std::io::R
     let status = status.map_err(|error| windows::explain(error, &program));
     let code = status?.code().unwrap_or(1);
     let manager = MANAGERS.iter().find(|manager| manager.command == invocation.program);
-    if let Some(lockfile) = manager.and_then(|manager| manager.lockfile) {
-        warn_if_plaintext(lockfile, dir);
+    match manager.and_then(|manager| manager.lockfile.as_ref()) {
+        Some(Lockfile::Restore(lockfile)) => restore_https(lockfile, dir),
+        Some(Lockfile::Warn(lockfile)) => warn_if_plaintext(lockfile, dir),
+        None => {}
     }
     Ok(code)
 }
@@ -72,3 +74,20 @@ fn warn_if_plaintext(lockfile: &str, dir: Option<&Path>) {
         warn!("{lockfile} has http:// registry URLs; change them to https:// before committing");
     }
 }
+
+fn restore_https(lockfile: &str, dir: Option<&Path>) {
+    let path = dir.unwrap_or(Path::new(".")).join(lockfile);
+    let Ok(text) = std::fs::read_to_string(&path) else { return };
+    let mut fixed = text.clone();
+    for registry in BUILT_IN {
+        let host = registry.host();
+        fixed = fixed.replace(&format!("http://{host}/"), &format!("https://{host}/"));
+    }
+    if fixed == text {
+        return;
+    }
+    match std::fs::write(&path, fixed) {
+        Ok(()) => info!("changed {lockfile}'s registry URLs back to https://"),
+        Err(e) => warn!("could not change {lockfile}'s registry URLs back to https://: {e}"),
+    }
+}

dist-workspace.toml

@@ -4,10 +4,10 @@ members = ["cargo:core"]
 [dist]
 cargo-dist-version = "0.32.0"
 ci = "github"
-installers = ["shell", "powershell", "msi"]
+installers = ["shell", "powershell", "homebrew", "msi"]
 # core/wix/main.wxs is edited to install the service.
 allow-dirty = ["msi"]
 features = ["machine-wide"]
-publish-jobs = ["./publish-crates"]
-global-artifacts-jobs = ["./build-macos-pkg"]
+tap = "usestrix/homebrew-tap"
+publish-jobs = ["homebrew", "./publish-crates"]
 targets = ["aarch64-apple-darwin", "x86_64-apple-darwin", "aarch64-unknown-linux-gnu", "x86_64-unknown-linux-gnu", "x86_64-pc-windows-msvc"]

macos/build.sh

@@ -48,7 +48,7 @@ build() {
   xcodegen generate >/dev/null
   xcodebuild -project Firewall.xcodeproj -scheme StrixFirewall -configuration $CONFIGURATION \
     -destination generic/platform=macOS \
-    -derivedDataPath build CURRENT_PROJECT_VERSION="$(date +%s)" CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO \
+    -derivedDataPath build CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO \
     CODE_SIGN_IDENTITY="" CODE_SIGN_ENTITLEMENTS="" build >/dev/null
 }
 

macos/project.yml

@@ -19,8 +19,6 @@ settings:
     ENABLE_DEBUG_DYLIB: "NO"
     CODE_SIGN_STYLE: Automatic
     CODE_SIGN_IDENTITY: Apple Development
-    # build.sh sets a fresh one per build; macOS only replaces an installed extension whose version differs.
-    CURRENT_PROJECT_VERSION: "1"
 
 packages:
   Rama:
@@ -44,7 +42,6 @@ targets:
       properties:
         CFBundlePackageType: SYSX
         CFBundleShortVersionString: "0.1"
-        CFBundleVersion: $(CURRENT_PROJECT_VERSION)
         NSSystemExtensionUsageDescription: Firewall uses a network extension to screen package downloads before they install.
         NetworkExtension:
           NEMachServiceName: ${TEAM}.com.usestrix.firewall.extension
@@ -105,7 +102,6 @@ targets:
       path: App/Info.plist
       properties:
         CFBundleShortVersionString: "0.1"
-        CFBundleVersion: $(CURRENT_PROJECT_VERSION)
         LSMinimumSystemVersion: $(MACOSX_DEPLOYMENT_TARGET)
         NSSystemExtensionUsageDescription: Firewall uses a network extension to screen package downloads before they install.
         LSUIElement: true