Build releases with the telemetry key

.github/workflows/release-notes.yml

@@ -27,7 +27,9 @@ jobs:
 
           ## Command line
 
-          **Command-line installs do not include machine-wide screening.**
+          \`\`\`sh
+          cargo install strix-firewall
+          \`\`\`
 
           \`\`\`sh
           curl --proto '=https' --tlsv1.2 -LsSf $url/strix-firewall-installer.sh | sh

.github/workflows/release.yml

@@ -302,7 +302,8 @@ jobs:
     secrets: inherit
     # publish jobs get escalated permissions
     permissions:
-      "contents": "read"
+      "id-token": "write"
+      "packages": "write"
 
   announce:
     needs:

README.md

@@ -1,12 +1,10 @@
 # Strix's Dependency Firewall
 
-Stops malicious packages before they install. Built by [Strix](https://strix.ai): read [the blogpost](https://www.strix.ai/blog/firewall-announcement).
+Stops malicious packages before they install. Built by [Strix](https://strix.ai/blog/firewall-announcement).
 
 Screening runs on your device: downloads go straight to the registry, never through a Strix server.
 Each package's name and version are looked up [Strix's malicious-package blocklist](https://github.com/usestrix/firewall-blocklist), so installs are blocked system-wide *before* reaching your machine.
 
-https://github.com/user-attachments/assets/835411b1-5c89-409f-b98a-cb238310429c
-
 ## Install
 
 **Machine-wide**, from the [latest release](https://github.com/usestrix/firewall/releases/latest):

core/Cargo.lock

@@ -3393,7 +3393,7 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "strix-firewall"
-version = "0.1.2"
+version = "0.1.1"
 dependencies = [
  "clap",
  "core-foundation 0.10.1",

core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "strix-firewall"
-version = "0.1.2"
+version = "0.1.1"
 edition = "2021"
 license = "Apache-2.0"
 authors = ["Strix"]

dist-workspace.toml

@@ -14,6 +14,3 @@ post-announce-jobs = ["./release-notes"]
 global-artifacts-jobs = ["./build-macos-pkg"]
 github-build-setup = "../build-setup.yml"
 targets = ["aarch64-apple-darwin", "x86_64-apple-darwin", "aarch64-unknown-linux-gnu", "x86_64-unknown-linux-gnu", "x86_64-pc-windows-msvc"]
-
-[dist.github-custom-job-permissions]
-"publish-crates" = { contents = "read" }

macos/App/FirewallModel.swift

@@ -55,7 +55,6 @@ final class FirewallModel: NSObject, ObservableObject {
     @Published private(set) var removed = false
     @Published private(set) var screening = false
     @Published private(set) var blocked: [BlockedPackage] = []
-    @Published private(set) var update: String?
 
     private let logger = Logger(subsystem: FirewallIDs.appBundleID, category: "installer")
     private var pendingRequest: (request: OSSystemExtensionRequest, continuation: CheckedContinuation<Void, Error>)?
@@ -77,7 +76,6 @@ final class FirewallModel: NSObject, ObservableObject {
             Task { await install() }
         }
         Task { await watchBlocks() }
-        Task { await watchUpdates() }
     }
 
     // MARK: - Flows
@@ -248,17 +246,6 @@ final class FirewallModel: NSObject, ObservableObject {
         }
     }
 
-    /// Asks again every day until the user updates.
-    private func watchUpdates() async {
-        while true {
-            if let version = await Updates.available() {
-                update = version
-                Updates.prompt(version)
-            }
-            try? await Task.sleep(nanoseconds: 86_400_000_000_000)
-        }
-    }
-
     private func stage(_ step: ReferenceWritableKeyPath<FirewallModel, StepStatus>,
                        running: String,
                        work: @MainActor () async throws -> String) async -> Bool {

macos/App/MenuBarView.swift

@@ -7,12 +7,6 @@ struct MenuBarView: View {
     var body: some View {
         Text(model.screening ? "Screening downloads" : "Not running")
 
-        if let version = model.update {
-            Button("Update to \(version)") {
-                Updates.download(version)
-            }
-        }
-
         Divider()
 
         Button("Setup") {

macos/App/Updates.swift

@@ -1,32 +0,0 @@
-import AppKit
-
-enum Updates {
-    static let current = Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? ""
-
-    private struct Release: Decodable {
-        let tag_name: String
-    }
-
-    /// The latest release's version, when it is newer than this app.
-    static func available() async -> String? {
-        let latest = URL(string: "https://api.github.com/repos/usestrix/firewall/releases/latest")!
-        guard let (data, _) = try? await URLSession.shared.data(from: latest),
-              let release = try? JSONDecoder().decode(Release.self, from: data) else { return nil }
-        let version = release.tag_name.hasPrefix("v") ? String(release.tag_name.dropFirst()) : release.tag_name
-        return version.compare(current, options: .numeric) == .orderedDescending ? version : nil
-    }
-
-    static func download(_ version: String) {
-        NSWorkspace.shared.open(URL(string: "https://github.com/usestrix/firewall/releases/download/v\(version)/Firewall.pkg")!)
-    }
-
-    @MainActor static func prompt(_ version: String) {
-        let alert = NSAlert()
-        alert.messageText = "Firewall \(version) is available"
-        alert.informativeText = "You have \(current). Download the installer and open it to update."
-        alert.addButton(withTitle: "Download")
-        alert.addButton(withTitle: "Later")
-        NSApp.activate(ignoringOtherApps: true)
-        if alert.runModal() == .alertFirstButtonReturn { download(version) }
-    }
-}

macos/build.sh

@@ -28,7 +28,7 @@ export NE_PROVIDER
 
 APP_ID=com.usestrix.firewall
 EXT_ID=com.usestrix.firewall.extension
-VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' ../core/Cargo.toml)
+VERSION=0.1
 INSTALLER_IDENTITY=${INSTALLER_IDENTITY:-Developer ID Installer}
 PROFILES="$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles"
 
@@ -48,7 +48,7 @@ build() {
   xcodegen generate >/dev/null
   xcodebuild -project Firewall.xcodeproj -scheme StrixFirewall -configuration $CONFIGURATION \
     -destination generic/platform=macOS \
-    -derivedDataPath build CURRENT_PROJECT_VERSION="$(date +%s)" MARKETING_VERSION="$VERSION" CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO \
+    -derivedDataPath build CURRENT_PROJECT_VERSION="$(date +%s)" CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO \
     CODE_SIGN_IDENTITY="" CODE_SIGN_ENTITLEMENTS="" build >/dev/null
 }
 

macos/project.yml

@@ -43,7 +43,7 @@ targets:
       path: Extension/Info.plist
       properties:
         CFBundlePackageType: SYSX
-        CFBundleShortVersionString: $(MARKETING_VERSION)
+        CFBundleShortVersionString: "0.1"
         CFBundleVersion: $(CURRENT_PROJECT_VERSION)
         NSSystemExtensionUsageDescription: Firewall uses a network extension to screen package downloads before they install.
         NetworkExtension:
@@ -104,7 +104,7 @@ targets:
     info:
       path: App/Info.plist
       properties:
-        CFBundleShortVersionString: $(MARKETING_VERSION)
+        CFBundleShortVersionString: "0.1"
         CFBundleVersion: $(CURRENT_PROJECT_VERSION)
         LSMinimumSystemVersion: $(MACOSX_DEPLOYMENT_TARGET)
         NSSystemExtensionUsageDescription: Firewall uses a network extension to screen package downloads before they install.