Repository navigation
fix(security): sandbox, release hardening, and provenance attestations - #9
Merged
Merged
Conversation
…uilds - Release: CODE_SIGN_INJECT_BASE_ENTITLEMENTS=NO; ad-hoc signing otherwise ships get-task-allow, letting local processes attach despite the hardened runtime. make install now installs a Release build - enable the App Sandbox with user-selected read-write for CSV export - copy pre-sandbox history and preferences into the container once, via read-only temporary exceptions for those two paths; originals are left untouched and test hosts skip the migration
…ance - build job runs read-only; only the publish job gets contents: write - pin actions to commit SHAs and XcodeGen to 2.46.0 with a SHA-256 check - persist-credentials: false on checkout - validate the release tag and build the tagged commit on manual runs - pass step outputs via env instead of interpolating them into scripts - fail the release if get-task-allow ever reappears - add build provenance attestations and document gh attestation verify
- remove docs/plans, no longer needed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes from a security audit of the codebase. Nothing critical was found: the app has no network code, URL schemes, XPC or shell-outs, and no secrets in git history. These changes harden how Hop is built, signed and released.
Root causes and fixes
1. Release builds could be attached to by any local process (confirmed)
CODE_SIGN_IDENTITY=-) addscom.apple.security.get-task-alloweven in Release. That cancels the hardened runtime's protection against debugger attachment and code injection.CODE_SIGN_INJECT_BASE_ENTITLEMENTS: NOfor Release. Verified: the built app carries only the sandbox entitlements.get-task-allowever reappears.make installinstalls a Release build instead of Debug.2. The release pipeline ran unpinned tools while holding a write token
buildjob (read-only, plus attestation permissions) and apublishjob, the only one withcontents: write, which runs no third-party tooling.scripts/install-xcodegen.sh) instead ofbrew install.persist-credentials: falseon every checkout.3. Users couldn't verify the download came from this repo
gh attestation verify Hop-<version>.zip -R bendns/hop.4. The manual-release tag input wasn't validated
^v[0-9]+\.[0-9]+\.[0-9]+$.envinstead of being interpolated into shell scripts.gh release create --verify-tagrefuses to create a tag that doesn't exist.5. The app wasn't sandboxed
files.user-selected.read-writefor CSV export.LegacyDataMigration, using read-only temporary exceptions for exactly two paths. The originals are never modified.container-migration.plist: it only runs when the container is first created. A local test run had already created the container (MCMMetadataCreator = com.apple.dt.xcodebuild), so that one-time migration had been skipped.Verification
LegacyDataMigrationTests).com.bendns.hopapp.migtest) and launched it sandboxed with only the narrow entitlements. It copied the realhistory.json(26.6K) and allhop.*preferences into its own container, and the originals were unchanged.Notes
docs/plansremoval landed in the first commit instead of the docs commit. Squash merge makes this irrelevant.Files changed
project.yml,Hop/Hop.entitlements,MakefileHop/HopApp.swift,Hop/Persistence/HistoryStore.swift,Hop/Persistence/LegacyDataMigration.swift(new)HopTests/LegacyDataMigrationTests.swift(new).github/workflows/ci.yml,.github/workflows/release.yml,scripts/install-xcodegen.sh(new)README.md,docs/plans/(removed)