Store config under com.usestrix.firewall

* Sign with Developer ID and notarize the package

* Name signing identities by type

* Say how signing identities are matched

* Notarize only when NOTARY_PROFILE is set

core/src/config/mod.rs

@@ -59,8 +59,8 @@ impl Default for FirewallConfig {
 impl Default for DenylistSource {
     fn default() -> Self {
         DenylistSource {
-            base: "https://raw.githubusercontent.com/usestrix/malicious-packages/packages".into(),
-            revision: "https://api.github.com/repos/usestrix/malicious-packages/commits/packages"
+            base: "https://raw.githubusercontent.com/usestrix/firewall-blocklist/main".into(),
+            revision: "https://api.github.com/repos/usestrix/firewall-blocklist/commits/main"
                 .into(),
             poll_secs: 10,
         }
@@ -100,6 +100,6 @@ impl FirewallConfig {
 }
 
 pub fn path() -> Option<PathBuf> {
-    let dirs = ProjectDirs::from("ai", "strix", "firewall")?;
+    let dirs = ProjectDirs::from("com", "usestrix", "firewall")?;
     Some(dirs.config_dir().join("config.json"))
 }

core/src/os/macos/mod.rs

@@ -25,10 +25,10 @@ use std::sync::Arc;
 use tracing_subscriber::layer::SubscriberExt;
 use tracing_subscriber::util::SubscriberInitExt;
 
-const BUNDLE_ID: &str = "ai.strix.firewall";
+const BUNDLE_ID: &str = "com.usestrix.firewall";
 const KEYCHAIN_SERVICE: &str = BUNDLE_ID;
 const KEYCHAIN_ACCOUNT: &str = "ca";
-/// Must match `macos/LaunchAgents/ai.strix.firewall.env.plist`, which points npm at it.
+/// Must match `macos/LaunchAgents/com.usestrix.firewall.env.plist`, which points npm at it.
 const CA_FILE: &str = "/Library/Application Support/Firewall/ca.pem";
 
 #[derive(Clone)]
@@ -113,7 +113,7 @@ fn handler(exec: Executor) -> Result<Handler, BoxError> {
 }
 
 /// stderr is invisible in a system extension, so events go to the unified log:
-/// `log stream --predicate 'subsystem == "ai.strix.firewall"'`.
+/// `log stream --predicate 'subsystem == "com.usestrix.firewall"'`.
 fn init(_config: Option<&TransparentProxyInitConfig>) -> bool {
     // A panic crossing the FFI boundary aborts, and its message would go to stderr.
     std::panic::set_hook(Box::new(|panic| tracing::error!("{panic}")));

core/src/os/macos/uninstall.rs

@@ -7,7 +7,7 @@ use std::io::ErrorKind;
 use tracing::info;
 
 /// Installed by the pkg.
-const ENV_AGENT: &str = "/Library/LaunchAgents/ai.strix.firewall.env.plist";
+const ENV_AGENT: &str = "/Library/LaunchAgents/com.usestrix.firewall.env.plist";
 
 /// Removes what only root can: the CA, its enclave key and exported copy, and the env
 /// agent. Trust settings need an authorization dialog, so the installer drops those itself.

macos/Installer/FirewallIDs.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 enum FirewallIDs {
-    static let appBundleID = "ai.strix.firewall"
-    static let extensionBundleID = "ai.strix.firewall.extension"
+    static let appBundleID = "com.usestrix.firewall"
+    static let extensionBundleID = "com.usestrix.firewall.extension"
     static let caCommonName = "Strix Firewall"
 }

macos/LaunchAgents/com.usestrix.firewall.env.plist

@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
 	<key>Label</key>
-	<string>ai.strix.firewall.env</string>
+	<string>com.usestrix.firewall.env</string>
 	<key>ProgramArguments</key>
 	<array>
 		<string>/bin/launchctl</string>

macos/build.sh

@@ -1,8 +1,10 @@
 #!/bin/bash
 # Builds and signs Firewall.app, installs it to /Applications, and packages it as build/Firewall.pkg.
+# The package is notarized with the notarytool keychain profile in NOTARY_PROFILE; `build.sh debug`
+# makes a Debug build and skips notarization.
 #
-# Xcode builds the bundles unsigned; they are signed here because the granted NetworkExtension
-# entitlement has no -systemextension variant, so Xcode cannot sign them itself.
+# Xcode builds the bundles unsigned; they are signed here. Debug builds use Apple Development signing
+# because macOS refuses to activate a Developer ID extension that is not notarized.
 set -euo pipefail
 cd "$(dirname "$0")"
 
@@ -10,13 +12,27 @@ cd "$(dirname "$0")"
 : "${TEAM:?set TEAM in macos/.env}"
 export TEAM
 
-APP_ID=ai.strix.firewall
-EXT_ID=ai.strix.firewall.extension
+# Identities are matched as a substring of the certificate name; set them if more than one matches.
+# Development profiles grant only the plain NetworkExtension values, Developer ID ones only -systemextension.
+if [ "${1:-}" = debug ]; then
+  CONFIGURATION=Debug
+  IDENTITY=${DEBUG_IDENTITY:-Apple Development}
+  NE_PROVIDER=app-proxy-provider
+else
+  CONFIGURATION=Release
+  IDENTITY=${IDENTITY:-Developer ID Application}
+  NE_PROVIDER=app-proxy-provider-systemextension
+  : "${NOTARY_PROFILE:?set NOTARY_PROFILE in macos/.env}"
+fi
+export NE_PROVIDER
+
+APP_ID=com.usestrix.firewall
+EXT_ID=com.usestrix.firewall.extension
 VERSION=0.1
-IDENTITY=${IDENTITY:-$(security find-identity -v -p codesigning | awk -F'"' '/Apple Development/ {print $2; exit}')}
+INSTALLER_IDENTITY=${INSTALLER_IDENTITY:-Developer ID Installer}
 PROFILES="$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles"
 
-APP=build/Build/Products/Debug/Installer.app
+APP=build/Build/Products/$CONFIGURATION/Installer.app
 EXT=$APP/Contents/Library/SystemExtensions/$EXT_ID.systemextension
 PKG_ROOT=build/pkg-root
 
@@ -25,12 +41,13 @@ main() {
   sign
   install_app
   package
+  [ $CONFIGURATION = Debug ] || notarize
 }
 
 build() {
   echo "==> Building"
   xcodegen generate >/dev/null
-  xcodebuild -project Firewall.xcodeproj -scheme Installer -configuration Debug \
+  xcodebuild -project Firewall.xcodeproj -scheme Installer -configuration $CONFIGURATION \
     -derivedDataPath build CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO \
     CODE_SIGN_IDENTITY="" CODE_SIGN_ENTITLEMENTS="" build >/dev/null
 }
@@ -39,9 +56,9 @@ sign() {
   echo "==> Signing with $IDENTITY"
   cp "$(profile_for $APP_ID)" "$APP/Contents/embedded.provisionprofile"
   cp "$(profile_for $EXT_ID)" "$EXT/Contents/embedded.provisionprofile"
-  codesign --force --options runtime --timestamp=none \
+  codesign --force --options runtime --timestamp \
     --entitlements Extension/Extension.entitlements -s "$IDENTITY" "$EXT"
-  codesign --force --options runtime --timestamp=none \
+  codesign --force --options runtime --timestamp \
     --entitlements Installer/Installer.entitlements -s "$IDENTITY" "$APP"
   codesign --verify --deep --strict "$APP"
 }
@@ -59,20 +76,30 @@ package() {
   rm -rf "$PKG_ROOT"
   mkdir -p "$PKG_ROOT/Applications" "$PKG_ROOT/Library/LaunchAgents"
   cp -R "$APP" "$PKG_ROOT/Applications/Firewall.app"
-  cp LaunchAgents/ai.strix.firewall.env.plist "$PKG_ROOT/Library/LaunchAgents/"
+  cp LaunchAgents/com.usestrix.firewall.env.plist "$PKG_ROOT/Library/LaunchAgents/"
 
   pkgbuild --analyze --root "$PKG_ROOT" build/components.plist >/dev/null
   plutil -replace 0.BundleIsRelocatable -bool NO build/components.plist
   pkgbuild --root "$PKG_ROOT" --component-plist build/components.plist --scripts pkg \
-    --identifier $APP_ID --version $VERSION --install-location / build/Firewall.pkg >/dev/null
+    --identifier $APP_ID --version $VERSION --install-location / --sign "$INSTALLER_IDENTITY" \
+    build/Firewall.pkg >/dev/null
 }
 
-# Prints the newest provisioning profile Xcode has downloaded for a bundle id.
+notarize() {
+  echo "==> Notarizing build/Firewall.pkg"
+  xcrun notarytool submit build/Firewall.pkg --keychain-profile "$NOTARY_PROFILE" --wait
+  xcrun stapler staple build/Firewall.pkg
+}
+
+# Prints the newest provisioning profile Xcode has downloaded for a bundle id that grants NE_PROVIDER.
 profile_for() {
-  local want=$TEAM.$1 newest= newest_time=0 id t
+  local want=$TEAM.$1 newest= newest_time=0 profile id t
   for p in "$PROFILES"/*.provisionprofile; do
-    id=$(security cms -D -i "$p" | plutil -extract Entitlements.com\\.apple\\.application-identifier raw -o - -)
+    profile=$(security cms -D -i "$p")
+    id=$(plutil -extract Entitlements.com\\.apple\\.application-identifier raw -o - - <<<"$profile")
     [ "$id" = "$want" ] || continue
+    plutil -extract Entitlements.com\\.apple\\.developer\\.networking\\.networkextension json -o - - <<<"$profile" |
+      grep -q "\"$NE_PROVIDER\"" || continue
     t=$(stat -f %m "$p")
     if [ "$t" -gt "$newest_time" ]; then newest=$p; newest_time=$t; fi
   done

macos/pkg/postinstall

@@ -3,7 +3,7 @@
 user=$(stat -f %Su /dev/console)
 [ "$user" = root ] && exit 0
 uid=$(id -u "$user")
-agent=/Library/LaunchAgents/ai.strix.firewall.env.plist
+agent=/Library/LaunchAgents/com.usestrix.firewall.env.plist
 launchctl bootout "gui/$uid" "$agent" 2>/dev/null
 launchctl bootstrap "gui/$uid" "$agent"
 launchctl asuser "$uid" sudo -u "$user" open -a /Applications/Firewall.app --args --install

macos/project.yml

@@ -1,6 +1,6 @@
 name: Firewall
 options:
-  bundleIdPrefix: ai.strix.firewall
+  bundleIdPrefix: com.usestrix.firewall
   deploymentTarget: { macOS: "13.0" }
   createIntermediateGroups: true
 
@@ -33,8 +33,8 @@ targets:
     sources: [Extension]
     settings:
       base:
-        PRODUCT_BUNDLE_IDENTIFIER: ai.strix.firewall.extension
-        PRODUCT_NAME: ai.strix.firewall.extension
+        PRODUCT_BUNDLE_IDENTIFIER: com.usestrix.firewall.extension
+        PRODUCT_NAME: com.usestrix.firewall.extension
         PRODUCT_MODULE_NAME: Extension
         OTHER_LDFLAGS: [-lfirewall, -framework, NetworkExtension, -lz]
     info:
@@ -44,7 +44,7 @@ targets:
         CFBundleShortVersionString: "0.1"
         NSSystemExtensionUsageDescription: Firewall uses a network extension to screen package downloads before they install.
         NetworkExtension:
-          NEMachServiceName: ${TEAM}.ai.strix.firewall.extension
+          NEMachServiceName: ${TEAM}.com.usestrix.firewall.extension
           NEProviderClasses:
             com.apple.networkextension.app-proxy: RamaAppleNetworkExtension.RamaTransparentProxyProvider
     entitlements:
@@ -52,13 +52,13 @@ targets:
       properties:
         # Xcode injects these from the profile; we sign by hand, and NE's IPC
         # check rejects a caller without them.
-        com.apple.application-identifier: ${TEAM}.ai.strix.firewall.extension
+        com.apple.application-identifier: ${TEAM}.com.usestrix.firewall.extension
         com.apple.developer.team-identifier: ${TEAM}
         com.apple.developer.networking.networkextension:
-          - app-proxy-provider
+          - ${NE_PROVIDER}
         # NE requires NEMachServiceName to start with one of these.
         com.apple.security.application-groups:
-          - ${TEAM}.ai.strix.firewall
+          - ${TEAM}.com.usestrix.firewall
         com.apple.security.network.client: true
         com.apple.security.network.server: true
     dependencies:
@@ -96,7 +96,7 @@ targets:
         buildPhase: resources
     settings:
       base:
-        PRODUCT_BUNDLE_IDENTIFIER: ai.strix.firewall
+        PRODUCT_BUNDLE_IDENTIFIER: com.usestrix.firewall
     info:
       path: Installer/Info.plist
       properties:
@@ -107,11 +107,11 @@ targets:
     entitlements:
       path: Installer/Installer.entitlements
       properties:
-        com.apple.application-identifier: ${TEAM}.ai.strix.firewall
+        com.apple.application-identifier: ${TEAM}.com.usestrix.firewall
         com.apple.developer.team-identifier: ${TEAM}
         com.apple.developer.system-extension.install: true
         com.apple.developer.networking.networkextension:
-          - app-proxy-provider
+          - ${NE_PROVIDER}
         com.apple.security.network.client: true
     dependencies:
       - target: Extension