@hasna/recordings 0.2.13 → 0.3.1

package/src/native/Recordings/Updater/ProtocolTests/ExpectationIntegrityTests.swift

@@ -0,0 +1,60 @@
+import Testing
+
+/// Positive and negative controls for the test framework itself.
+///
+/// Package.swift pins swift-testing to a revision that does not match the compiler, because the
+/// matching 6.3.x line hard-links a toolchain library that is not on SwiftPM's search path. The
+/// rule that pin was standing in for — "the shim must track the compiler" — exists because a
+/// mismatched shim once corrupted `#expect` Bool-comparison evaluation and passed false
+/// assertions. A silently-passing `#expect` makes every other test in this package meaningless,
+/// and no green run can reveal it.
+///
+/// These assert the property directly. The negative controls matter more than the positive ones:
+/// `withKnownIssue` fails when its body records *no* issue, so if `#expect` ever stops evaluating
+/// a false comparison, this suite goes red instead of the whole suite going quietly green.
+struct ExpectationIntegrityTests {
+    @Test("#expect admits true Bool comparisons")
+    func admitsTrueComparisons() {
+        #expect(true == true)
+        #expect(false == false)
+        #expect(true != false)
+        #expect((1 == 1) == true)
+        #expect((1 == 2) == false)
+    }
+
+    @Test("#expect records an issue for a false Bool comparison")
+    func recordsIssueForFalseEquality() {
+        withKnownIssue("a false Bool comparison must be recorded, not passed") {
+            #expect(false == true)
+        }
+    }
+
+    @Test("#expect records an issue for a false Bool inequality")
+    func recordsIssueForFalseInequality() {
+        withKnownIssue("an untrue inequality must be recorded, not passed") {
+            #expect(true != true)
+        }
+    }
+
+    @Test("#expect records an issue for a false comparison behind a variable")
+    func recordsIssueForFalseComparisonThroughVariables() {
+        // The reported corruption involved comparison *evaluation*, so route the operands
+        // through variables rather than literals the optimiser can fold away.
+        let left = Int.random(in: 1...1)
+        let right = left + 1
+        #expect(left != right)
+        withKnownIssue("a false comparison between variables must be recorded") {
+            #expect(left == right)
+        }
+    }
+
+    @Test("#require unwraps a present optional")
+    func requireUnwrapsPresentOptional() throws {
+        // Only the positive direction is asserted here. The negative direction — `#require(nil)`
+        // — throws by design, and wrapping it in `withKnownIssue` additionally records an
+        // "API was misused" issue, so it adds noise rather than coverage. The Bool-comparison
+        // controls above are what the reported corruption was actually about.
+        let present: Int? = 7
+        #expect(try #require(present) == 7)
+    }
+}

package/src/native/Recordings/Updater/ProtocolTests/UpdateXPCInterfaceTests.swift

@@ -0,0 +1,113 @@
+import Foundation
+import Testing
+
+@testable import RecordingsUpdateProtocol
+
+/// The XPC allowlist is the decoding trust boundary for the privileged updater, so these
+/// assert the *exact* set installed for every argument rather than a subset. A set that
+/// grew silently would widen what the broker is willing to decode; a set that shrank
+/// would reject legitimate replies. Either direction should fail the build.
+///
+/// Membership is compared by class name because Objective-C class objects cannot be cast
+/// to `AnyHashable` in Swift — `NSDictionary.self as! AnyHashable` traps at runtime.
+struct UpdateXPCInterfaceTests {
+    private static let installSelector =
+        NSSelectorFromString("installWithArchive:manifest:envelope:reply:")
+    private static let statusSelector = NSSelectorFromString("queryStatusWithReply:")
+
+    private func allowedClassNames(
+        _ interface: NSXPCInterface,
+        selector: Selector,
+        argumentIndex: Int,
+        ofReply: Bool
+    ) -> Set<String> {
+        let classes = interface.classes(for: selector, argumentIndex: argumentIndex, ofReply: ofReply)
+        return Set(classes.compactMap { ($0 as? AnyClass).map { NSStringFromClass($0) } })
+    }
+
+    @Test("every install request argument accepts only a file handle")
+    func installRequestAcceptsOnlyFileHandles() {
+        let interface = makeRecordingsUpdateXPCInterface()
+        for index in 0..<3 {
+            let allowed = allowedClassNames(
+                interface,
+                selector: Self.installSelector,
+                argumentIndex: index,
+                ofReply: false
+            )
+            #expect(allowed == ["NSFileHandle"], "install request argument \(index)")
+        }
+    }
+
+    @Test("install and status replies accept only scalar dictionaries")
+    func repliesAcceptOnlyScalarDictionaries() {
+        let interface = makeRecordingsUpdateXPCInterface()
+        let expected: Set<String> = ["NSDictionary", "NSString", "NSNumber"]
+        for selector in [Self.installSelector, Self.statusSelector] {
+            let allowed = allowedClassNames(
+                interface,
+                selector: selector,
+                argumentIndex: 0,
+                ofReply: true
+            )
+            #expect(allowed == expected, "reply allowlist for \(selector)")
+        }
+    }
+
+    @Test("the reply allowlist admits no container beyond the dictionary itself")
+    func replyAllowlistExcludesNestedContainers() {
+        let interface = makeRecordingsUpdateXPCInterface()
+        let allowed = allowedClassNames(
+            interface,
+            selector: Self.statusSelector,
+            argumentIndex: 0,
+            ofReply: true
+        )
+        for rejected in ["NSArray", "NSData", "NSURL", "NSValue", "NSSet"] {
+            #expect(!allowed.contains(rejected), "\(rejected) must not be decodable in a reply")
+        }
+    }
+
+    /// The allowlist only matters if it is actually sufficient to decode what the broker
+    /// sends. Rather than comparing class names — a native Swift `String` key bridges to
+    /// `Swift.__StringStorage`, not `NSString`, so name matching tests the bridge instead of
+    /// the contract — this round-trips real replies through secure coding restricted to the
+    /// installed allowlist. A reply that grew a type XPC would refuse to decode fails here.
+    @Test("the installed allowlist can securely decode the replies the broker actually sends")
+    func allowlistDecodesRealReplies() throws {
+        let interface = makeRecordingsUpdateXPCInterface()
+        let allowedClasses = interface
+            .classes(for: Self.statusSelector, argumentIndex: 0, ofReply: true)
+            .compactMap { $0 as? AnyClass }
+        #expect(allowedClasses.count == 3)
+
+        let replies = [
+            updateSuccessReply(
+                transactionID: "t-1",
+                releaseID: "r-1",
+                installedVersion: "0.2.15"
+            ),
+            updateFailureReply(.invalidEnvelope, message: "rejected"),
+        ]
+        for reply in replies {
+            let data = try NSKeyedArchiver.archivedData(
+                withRootObject: reply,
+                requiringSecureCoding: true
+            )
+            let unarchiver = try NSKeyedUnarchiver(forReadingFrom: data)
+            unarchiver.requiresSecureCoding = true
+            let decoded = unarchiver.decodeObject(
+                of: allowedClasses,
+                forKey: NSKeyedArchiveRootObjectKey
+            )
+            unarchiver.finishDecoding()
+            #expect(unarchiver.error == nil, "reply is not decodable under the allowlist")
+            let decodedReply = try #require(decoded as? NSDictionary)
+            #expect(decodedReply.count == reply.count)
+            #expect(
+                decodedReply[RecordingsUpdateReplyKey.lifecycle] as? String
+                    == RecordingsUpdateConstants.lifecycle
+            )
+        }
+    }
+}

package/src/native/Recordings/Updater/VerifierLauncher/RecordingsVerifierLauncher.c

@@ -16,6 +16,7 @@
 #include <sys/acl.h>
 #include <sys/resource.h>
 #include <sys/stat.h>
+#include <sys/sysctl.h>
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <time.h>
@@ -29,6 +30,39 @@
 #define OUTPUT_PATH_PREFIX "/Library/Application Support/Hasna/Recordings/Updates/transaction-"
 #define OUTPUT_PATH_SUFFIX "/verifier-output"
 
+/*
+ * Lower bound for the pre-exec descriptor sweep, so a pathologically small
+ * RLIMIT_NOFILE can never shrink the sweep below the descriptors we place by hand.
+ */
+#define DESCRIPTOR_SWEEP_FLOOR 64
+
+/*
+ * PRIVATE API, DELIBERATE — RISK ACCEPTED.
+ *
+ * `sandbox_init_with_parameters` is exported by libSystem (`_sandbox_init_with_parameters`
+ * is present in libSystem.tbd) but is declared in no SDK header, so this declaration is
+ * the only contract we have. Apple may change its signature or remove it in any macOS
+ * update, and nothing checks our prototype against theirs.
+ *
+ * Why we accept that rather than avoid it: the public `sandbox_init` cannot express this
+ * policy. It is API_DEPRECATED since macOS 10.8, and its own header states that `flags`
+ * "Must be SANDBOX_NAMED" — it can only select one of the five built-in kSBXProfile*
+ * profiles, so it can neither load our profile nor bind the OUTPUT_DIR parameter the
+ * profile is written against. The alternative of textually substituting the output path
+ * into the profile source would move a runtime-derived string into a security policy
+ * document, which is strictly worse than depending on the parameter API built for it.
+ *
+ * Do NOT mark this `weak_import`. Referenced strongly, a symbol Apple removes becomes a
+ * link error at build time, which fails closed. Weak-linked, it would become a NULL call
+ * or a silently unsandboxed verifier child at runtime.
+ */
+extern int sandbox_init_with_parameters(
+    const char *profile,
+    uint64_t flags,
+    const char *const parameters[],
+    char **errorbuf
+);
+
 int recordings_descriptor_has_no_extended_acl(int descriptor) {
     if (descriptor < 0) return 0;
     errno = 0;
@@ -244,6 +278,57 @@ static bool apply_limit(int resource, rlim_t soft, rlim_t hard) {
     return setrlimit(resource, &limit) == 0;
 }
 
+/*
+ * Highest descriptor number that could exist in this process, used to bound the pre-exec
+ * sweep below. MUST be evaluated in the parent, before the child lowers RLIMIT_NOFILE:
+ * verifier_child() drops RLIMIT_NOFILE to 32 before it sweeps, and lowering the limit does
+ * not close descriptors that are already open, so a getrlimit() call made after that point
+ * reports 32 and would skip every inherited descriptor at or above 32.
+ */
+static rlim_t inherited_descriptor_ceiling(void) {
+    rlim_t ceiling = 0;
+    struct rlimit limit;
+    if (getrlimit(RLIMIT_NOFILE, &limit) == 0) {
+        if (limit.rlim_cur != RLIM_INFINITY && limit.rlim_cur > ceiling) ceiling = limit.rlim_cur;
+        if (limit.rlim_max != RLIM_INFINITY && limit.rlim_max > ceiling) ceiling = limit.rlim_max;
+    }
+    /*
+     * An unlimited hard limit tells us nothing, so fall back to the kernel's per-process
+     * cap, which is the real ceiling on descriptor numbers.
+     */
+    int per_process_maximum = 0;
+    size_t size = sizeof(per_process_maximum);
+    if (sysctlbyname("kern.maxfilesperproc", &per_process_maximum, &size, NULL, 0) == 0 &&
+        per_process_maximum > 0) {
+        if (ceiling == 0 || ceiling > (rlim_t)per_process_maximum) {
+            ceiling = (rlim_t)per_process_maximum;
+        }
+    }
+    if (ceiling < DESCRIPTOR_SWEEP_FLOOR) ceiling = DESCRIPTOR_SWEEP_FLOOR;
+    return ceiling;
+}
+
+/*
+ * Darwin has neither `closefrom()` nor Linux's `close_range()` — both are absent from the
+ * macOS SDK entirely, not merely behind a header we failed to include — so the sweep is
+ * open-coded.
+ *
+ * A plain bounded loop of close() is used rather than enumerating /dev/fd, which would
+ * close exactly the open descriptors instead of probing a range. /dev/fd enumeration needs
+ * opendir()/readdir(), which allocate; this code runs after fork() in a multithreaded XPC
+ * broker, where malloc can deadlock if another thread held its lock at fork time. close()
+ * and getrlimit() are plain syscalls and are safe here, so correctness of the sandbox
+ * boundary is not traded for an allocation in the one place we must not allocate.
+ *
+ * The cost is bounded by `ceiling` failed close() calls once per verification, which is
+ * negligible against the caller's 90-second budget.
+ */
+static void close_descriptors_from(int lowest, rlim_t ceiling) {
+    for (rlim_t descriptor = (rlim_t)lowest; descriptor < ceiling; descriptor++) {
+        (void)close((int)descriptor);
+    }
+}
+
 static void kill_and_reap(pid_t child) {
     kill(child, SIGKILL);
     int wait_status = 0;
@@ -257,7 +342,8 @@ static void verifier_child(
     gid_t group_id,
     const char *expected_sha256,
     const char *sandbox_profile,
-    const char *output_path
+    const char *output_path,
+    rlim_t descriptor_ceiling
 ) {
     if (!apply_limit(RLIMIT_CPU, 60, 60) ||
         !apply_limit(RLIMIT_AS, 4ULL * 1024 * 1024 * 1024, 4ULL * 1024 * 1024 * 1024) ||
@@ -276,7 +362,7 @@ static void verifier_child(
         _exit(74);
     }
     if (null_descriptor > CHILD_OUTPUT_FD) close(null_descriptor);
-    closefrom(5);
+    close_descriptors_from(CHILD_OUTPUT_FD + 1, descriptor_ceiling);
 
     gid_t groups[] = { group_id };
     if (setgroups(1, groups) != 0 || setgid(group_id) != 0 || setuid(user_id) != 0 ||
@@ -289,12 +375,23 @@ static void verifier_child(
     };
     char *sandbox_error = NULL;
     if (sandbox_init_with_parameters(sandbox_profile, 0, sandbox_parameters, &sandbox_error) != 0) {
-        if (sandbox_error != NULL) sandbox_free_error(sandbox_error);
+        if (sandbox_error != NULL) {
+            // `sandbox_free_error` is the only documented way to release the buffer the
+            // sandbox API allocates, and it is deprecated with no replacement. We _exit
+            // immediately below, so this is belt-and-braces rather than load-bearing;
+            // the deprecation warning is scoped to this one call instead of the file.
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated-declarations"
+            sandbox_free_error(sandbox_error);
+#pragma clang diagnostic pop
+        }
         _exit(72);
     }
     // Sandbox initialization is allowed to use implementation-internal descriptors.
     // Re-close everything above the two explicit artifact descriptors before exec.
-    closefrom(5);
+    // RLIMIT_NOFILE is 32 by this point, so the sandbox cannot have opened anything above
+    // it; sweeping to the inherited ceiling again is generous and harmless.
+    close_descriptors_from(CHILD_OUTPUT_FD + 1, descriptor_ceiling);
 
     char archive_argument[16];
     char output_argument[16];
@@ -356,6 +453,9 @@ int recordings_run_artifact_verifier(
         return errno != 0 ? errno : EMFILE;
     }
 
+    /* Captured before fork(), while getrlimit() still describes the real descriptor table. */
+    const rlim_t descriptor_ceiling = inherited_descriptor_ceiling();
+
     const pid_t child = fork();
     if (child < 0) {
         status = errno;
@@ -367,7 +467,8 @@ int recordings_run_artifact_verifier(
             verifier_group_id,
             expected_archive_sha256,
             sandbox_profile,
-            output_path
+            output_path,
+            descriptor_ceiling
         );
     } else {
         struct timespec started;

package/src/native/Recordings/build.sh

@@ -380,6 +380,8 @@ if [ "$SOURCE_PACKAGE_ROOT" != "$PACKAGE_ROOT" ]; then
         "$SOURCE_PACKAGE_ROOT/scripts/native_fs_guard.ts" \
         "$SOURCE_PACKAGE_ROOT/scripts/build_native_fs_guard.sh" \
         "$SOURCE_PACKAGE_ROOT/scripts/native/recordings_fs_guard.c" \
+        "$SOURCE_PACKAGE_ROOT/scripts/policy/local-only-approved-targets.txt" \
+        "$SOURCE_PACKAGE_ROOT/scripts/read_local_only_targets.sh" \
         "$SOURCE_PACKAGE_ROOT/packaging/macos/build_release_pkg.sh" \
         "$SOURCE_PACKAGE_ROOT/packaging/macos/release_lifecycle.ts" \
         "$SOURCE_PACKAGE_ROOT/packaging/macos/Verifier.entitlements" \
@@ -418,7 +420,7 @@ generate_and_verify_native_fs_guard() {
         TMPDIR="$BUILD_WORK_DIR" \
         "$BASH_EXECUTABLE" "$SOURCE_PACKAGE_ROOT/scripts/build_native_fs_guard.sh" \
         "$addon" "$dependency_root/node_modules/node-api-headers/include"
-    /usr/bin/lipo -verify_arch arm64 x86_64 "$addon"
+    /usr/bin/lipo "$addon" -verify_arch arm64 x86_64
     if [ "$MODE" = "release" ]; then
         run_codesign --force --sign "$CODESIGN_IDENTITY" --options runtime --timestamp "$addon"
     else
@@ -991,8 +993,34 @@ if [ "$MODE" = "release" ]; then
         fi
     fi
 elif [ "$MODE" = "local" ]; then
-    if [ "$LOCAL_APPROVED_TARGET" != "station06" ]; then
-        echo "Local-only builds currently require RECORDINGS_LOCAL_APPROVED_TARGET=station06." >&2
+    # Same policy file and same sourced reader the installer uses. The artifact tool
+    # re-implements the same rules in TypeScript and re-checks the target later, so
+    # agreement between the two implementations rests on their shared contract test,
+    # not on shared code.
+    #
+    # Both resolve from $SOURCE_PACKAGE_ROOT — the `git archive` of $SOURCE_SHA — and not
+    # from $PACKAGE_ROOT. They used to read $PACKAGE_ROOT, which is the mutable working
+    # tree, so this gate validated a different file from the one the artifact was built
+    # from: with the archived policy listing only station06, a working-tree policy listing
+    # "attacker" got "attacker" approved, and station06 refused. Every other build input
+    # is resolved from the snapshot for exactly this reason (see the required-snapshot-input
+    # loop above, which already demands both of these paths inside the archive), and a gate
+    # that checks a file the artifact does not contain is not a gate.
+    LOCAL_TARGET_POLICY="${SOURCE_PACKAGE_ROOT}/scripts/policy/local-only-approved-targets.txt"
+    LOCAL_TARGET_READER="${SOURCE_PACKAGE_ROOT}/scripts/read_local_only_targets.sh"
+    [ -f "$LOCAL_TARGET_READER" ] && [ ! -L "$LOCAL_TARGET_READER" ] || {
+        echo "Packaged local-only approved target reader is missing." >&2
+        exit 1
+    }
+    # shellcheck source=/dev/null
+    . "$LOCAL_TARGET_READER"
+    LOCAL_APPROVED_TARGET_MATCHED=0
+    LOCAL_APPROVED_TARGET_LIST=""
+    read_local_only_targets \
+        "$LOCAL_TARGET_POLICY" LOCAL_APPROVED_TARGET_LIST LOCAL_APPROVED_TARGET_MATCHED \
+        "$LOCAL_APPROVED_TARGET" || exit 1
+    if [ "$LOCAL_APPROVED_TARGET_MATCHED" -ne 1 ]; then
+        echo "Local-only builds require an approved RECORDINGS_LOCAL_APPROVED_TARGET (${LOCAL_APPROVED_TARGET_LIST})." >&2
         exit 1
     fi
     if ! [[ "$LOCAL_APPROVED_TARGET_IDENTITY_SHA256" =~ ^[a-f0-9]{64}$ ]]; then
@@ -1031,13 +1059,50 @@ elif [ "$MODE" = "local" ]; then
         echo "Local-only artifacts must be built on a different authenticated Tailscale node." >&2
         exit 1
     fi
-    CODESIGN_IDENTITY="-"
-    EXPECTED_TEAM_ID="ADHOC"
+    # Signing identity for a local-station artifact.
+    #
+    # This used to be an unconditional `CODESIGN_IDENTITY="-"`, and that was the defect
+    # behind "the Fn key does nothing". Hold-to-talk is a CGEventTap (RecordingsLib/
+    # FnKeyMonitor.swift), macOS only creates that tap for a process with Accessibility,
+    # and TCC keys every grant to bundle identifier PLUS code-signing identity. An ad-hoc
+    # signature has no identity to key on beyond a CDHash that changes on every rebuild,
+    # so each reinstall orphaned the grant, AXIsProcessTrusted() stayed false and the app
+    # logged "fn monitor start ok=false" forever. Ad-hoc is therefore not a neutral default
+    # here — it structurally prevents the permission the feature needs from ever sticking.
+    #
+    # So when a Developer ID Application identity is supplied, sign with it and pin its
+    # team. That is the same stable identity a release uses; what still separates this from
+    # a release is notarization, the single-target binding, and the builder attestation
+    # above, none of which are relaxed. With no identity supplied the old ad-hoc behaviour
+    # is kept verbatim, because a Mac without the signing key must still be able to build.
+    if [ -n "$CODESIGN_IDENTITY" ] && [ "$CODESIGN_IDENTITY" != "-" ]; then
+        if [[ "$CODESIGN_IDENTITY" != "Developer ID Application:"* ]]; then
+            echo "Local-station signing requires a Developer ID Application identity in RECORDINGS_CODESIGN_IDENTITY." >&2
+            exit 1
+        fi
+        if [ -z "$EXPECTED_TEAM_ID" ]; then
+            echo "Local-station Developer ID signing requires RECORDINGS_EXPECTED_TEAM_IDENTIFIER to pin the team." >&2
+            exit 1
+        fi
+        if [ "$EXPECTED_TEAM_ID" = "ADHOC" ]; then
+            echo "RECORDINGS_EXPECTED_TEAM_IDENTIFIER=ADHOC is not a Developer ID team." >&2
+            exit 1
+        fi
+        LOCAL_SIGNING_MODE="developer_id"
+    else
+        CODESIGN_IDENTITY="-"
+        EXPECTED_TEAM_ID="ADHOC"
+        LOCAL_SIGNING_MODE="ad_hoc"
+    fi
     ARTIFACT_POLICY="local_only"
     APPROVED_TARGET="$LOCAL_APPROVED_TARGET"
     APPROVED_TARGET_IDENTITY_KIND="$LOCAL_APPROVED_TARGET_IDENTITY_KIND"
     APPROVED_TARGET_IDENTITY_SHA256="$LOCAL_APPROVED_TARGET_IDENTITY_SHA256"
-    echo "WARNING: local-only artifacts are ad-hoc signed, non-notarized, and restricted to ${APPROVED_TARGET}." >&2
+    if [ "$LOCAL_SIGNING_MODE" = "developer_id" ]; then
+        echo "WARNING: local-only artifacts are Developer ID signed, non-notarized, and restricted to ${APPROVED_TARGET}." >&2
+    else
+        echo "WARNING: local-only artifacts are ad-hoc signed, non-notarized, and restricted to ${APPROVED_TARGET}." >&2
+    fi
     echo "WARNING: installing can change code identity and require Microphone or Accessibility reauthorization." >&2
 else
     BUILD_CONFIGURATION="debug"
@@ -1468,8 +1533,8 @@ run_signed_helper_contract() {
         HOME="$contract_home"
         PATH="/usr/bin:/bin:/usr/sbin:/sbin"
         TMPDIR="$contract_home"
-        HASNA_RECORDINGS_STORAGE_MODE="local"
-        RECORDINGS_STORAGE_MODE="local"
+        HASNA_RECORDINGS_CLIENT_STORE="sqlite"
+        RECORDINGS_CLIENT_STORE="sqlite"
         HASNA_RECORDINGS_DB_PATH="$contract_home/recordings.db"
         RECORDINGS_AUDIO_DIR="$contract_home/audio"
     )
@@ -1783,7 +1848,8 @@ if [ "$MODE" = "local" ]; then
         --package-root "$PACKAGE_ROOT" \
         --approved-target "$APPROVED_TARGET" \
         --approved-target-identity-kind "$APPROVED_TARGET_IDENTITY_KIND" \
-        --approved-target-identity-sha256 "$APPROVED_TARGET_IDENTITY_SHA256"
+        --approved-target-identity-sha256 "$APPROVED_TARGET_IDENTITY_SHA256" \
+        --expected-team-id "$EXPECTED_TEAM_ID"
     publish_app_output
     verify_source_unchanged
     echo "Built immutable local-only app artifact: $FINAL_ARCHIVE"