Update README to remove old asset

Removed outdated asset links from README.

.github/build-setup.yml

@@ -0,0 +1,3 @@
+- name: Set the telemetry key
+  shell: bash
+  run: echo "FIREWALL_POSTHOG_KEY=${{ secrets.FIREWALL_POSTHOG_KEY }}" >> "$GITHUB_ENV"

.github/workflows/build-macos-pkg.yml

@@ -13,6 +13,7 @@ jobs:
     env:
       TEAM: ${{ vars.APPLE_TEAM }}
       NOTARY_PROFILE: firewall
+      FIREWALL_POSTHOG_KEY: ${{ secrets.FIREWALL_POSTHOG_KEY }}
     steps:
       - uses: actions/checkout@v6
         with:

.github/workflows/release-notes.yml

@@ -0,0 +1,40 @@
+name: Rewrite release notes
+
+on:
+  workflow_call:
+    inputs:
+      plan:
+        required: true
+        type: string
+
+jobs:
+  notes:
+    runs-on: ubuntu-22.04
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      TAG: ${{ fromJson(inputs.plan).announcement_tag }}
+    steps:
+      - run: |
+          url="https://github.com/${{ github.repository }}/releases/download/$TAG"
+          cat > notes.md <<NOTES
+          ## macOS
+
+          [Firewall.pkg]($url/Firewall.pkg)
+
+          ## Windows
+
+          [strix-firewall-x86_64-pc-windows-msvc.msi]($url/strix-firewall-x86_64-pc-windows-msvc.msi)
+
+          ## Command line
+
+          **Command-line installs do not include machine-wide screening.**
+
+          \`\`\`sh
+          curl --proto '=https' --tlsv1.2 -LsSf $url/strix-firewall-installer.sh | sh
+          \`\`\`
+
+          \`\`\`sh
+          powershell -ExecutionPolicy Bypass -c "irm $url/strix-firewall-installer.ps1 | iex"
+          \`\`\`
+          NOTES
+          gh release edit "$TAG" --repo "${{ github.repository }}" --notes-file notes.md

.github/workflows/release.yml

@@ -127,6 +127,9 @@ jobs:
             curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
             echo "$HOME/.cargo/bin" >> $GITHUB_PATH
           fi
+      - name: "Set the telemetry key"
+        run: "echo \"FIREWALL_POSTHOG_KEY=${{ secrets.FIREWALL_POSTHOG_KEY }}\" >> \"$GITHUB_ENV\""
+        shell: "bash"
       - name: Install dist
         run: ${{ matrix.install_dist.run }}
       # Get the dist-manifest
@@ -299,8 +302,7 @@ jobs:
     secrets: inherit
     # publish jobs get escalated permissions
     permissions:
-      "id-token": "write"
-      "packages": "write"
+      "contents": "read"
 
   announce:
     needs:
@@ -319,3 +321,12 @@ jobs:
         with:
           persist-credentials: false
           submodules: recursive
+
+  custom-release-notes:
+    needs:
+      - plan
+      - announce
+    uses: ./.github/workflows/release-notes.yml
+    with:
+      plan: ${{ needs.plan.outputs.val }}
+    secrets: inherit

README.md

@@ -1,10 +1,12 @@
 # Strix's Dependency Firewall
 
-Stops malicious packages before they install. Built by [Strix](https://strix.ai/blog/firewall-announcement).
+Stops malicious packages before they install. Built by [Strix](https://strix.ai): read [the blogpost](https://www.strix.ai/blog/firewall-announcement).
 
 Screening runs on your device: downloads go straight to the registry, never through a Strix server.
 Each package's name and version are looked up [Strix's malicious-package blocklist](https://github.com/usestrix/firewall-blocklist), so installs are blocked system-wide *before* reaching your machine.
 
+https://github.com/user-attachments/assets/835411b1-5c89-409f-b98a-cb238310429c
+
 ## Install
 
 **Machine-wide**, from the [latest release](https://github.com/usestrix/firewall/releases/latest):

core/Cargo.lock

@@ -3393,7 +3393,7 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "strix-firewall"
-version = "0.1.0-rc.2"
+version = "0.1.2"
 dependencies = [
  "clap",
  "core-foundation 0.10.1",

core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "strix-firewall"
-version = "0.1.0-rc.2"
+version = "0.1.2"
 edition = "2021"
 license = "Apache-2.0"
 authors = ["Strix"]

dist-workspace.toml

@@ -8,6 +8,12 @@ installers = ["shell", "powershell", "msi"]
 # core/wix/main.wxs is edited to install the service.
 allow-dirty = ["msi"]
 features = ["machine-wide"]
+source-tarball = false
 publish-jobs = ["./publish-crates"]
+post-announce-jobs = ["./release-notes"]
 global-artifacts-jobs = ["./build-macos-pkg"]
+github-build-setup = "../build-setup.yml"
 targets = ["aarch64-apple-darwin", "x86_64-apple-darwin", "aarch64-unknown-linux-gnu", "x86_64-unknown-linux-gnu", "x86_64-pc-windows-msvc"]
+
+[dist.github-custom-job-permissions]
+"publish-crates" = { contents = "read" }

macos/App/FirewallApp.swift

@@ -33,12 +33,11 @@ enum SetupWindow {
 private struct MenuBarLabel: View {
     @ObservedObject var model: FirewallModel
     @Environment(\.openWindow) private var openWindow
-    @State private var raised = false
 
     var body: some View {
-        Image(nsImage: Self.icon).onAppear {
-            guard !raised, !model.screening else { return }
-            raised = true
+        Image(nsImage: Self.icon).task {
+            await model.refresh()
+            guard !model.configured else { return }
             SetupWindow.open(openWindow)
         }
     }

macos/App/FirewallModel.swift

@@ -2,6 +2,7 @@ import AppKit
 import NetworkExtension
 import OSLog
 import Security
+import ServiceManagement
 import SystemExtensions
 
 enum StepStatus: Equatable {
@@ -71,9 +72,8 @@ final class FirewallModel: NSObject, ObservableObject {
             let running = connection.status == .connected
             Task { @MainActor in self?.screening = running }
         }
-        Task {
-            await refresh()
-            if CommandLine.arguments.contains("--install") { await install() }
+        if CommandLine.arguments.contains("--install") {
+            Task { await install() }
         }
         Task { await watchBlocks() }
     }
@@ -83,6 +83,10 @@ final class FirewallModel: NSObject, ObservableObject {
     func refresh() async {
         if let manager = try? await loadManager() {
             watched = manager
+            // Nothing starts the tunnel at boot, so the app does once it is set up and not paused.
+            if manager.isEnabled && manager.connection.status == .disconnected {
+                try? manager.connection.startVPNTunnel()
+            }
             if manager.isEnabled {
                 screeningStep = .done("Enabled (\(manager.connection.status.label))")
             }
@@ -116,6 +120,11 @@ final class FirewallModel: NSObject, ObservableObject {
                           work: trustCertificateAuthority)
         else { return }
 
+        do {
+            try SMAppService.mainApp.register()
+        } catch {
+            log("Could not open the app at login: \(error.localizedDescription)")
+        }
         completed = true
         log("Setup complete")
         offerRestart()
@@ -156,6 +165,7 @@ final class FirewallModel: NSObject, ObservableObject {
         await removeConfiguration()
         let strandedKey = removeStoredCA()
         await deactivate()
+        try? await SMAppService.mainApp.unregister()
         if let strandedKey { trustStep = .failed(strandedKey) }
 
         let failed = [extensionStep, screeningStep, trustStep].contains(where: \.isFailed)