@intincrab/updiff 0.1.1 → 0.2.0

package/dist/commands.js

@@ -6,7 +6,11 @@ import { parseArgs } from 'node:util';
 import { AGENT_LABEL, agentPlist, agentStatus, installAgent, notify, uninstallAgent } from "./agent.js";
 import { quickFingerprint, readIdentity, scanBundle } from "./bundle.js";
 import { diffSnapshots, filterBySeverity } from "./diff.js";
+import { diffExtensions, discoverExtensions, renderExtensions } from "./extensions.js";
+import { caskHistory, fetchRelease, pickRelease, resolveCask, sameVersion } from "./fetch.js";
 import { renderJson, renderMarkdown, renderScan, renderText } from "./report.js";
+import { inspectPkg } from "./pkg.js";
+import { diffPkgs, renderPkg, renderPkgMarkdown } from "./pkg-report.js";
 import { Store } from "./store.js";
 import { mapLimit } from "./util.js";
 import { TOOL_VERSION } from "./version.js";
@@ -19,6 +23,16 @@ Usage:
   updiff diff <a> <b>               Compare two apps, snapshot files or stored apps
   updiff check                      Snapshot apps that changed and report the differences
   updiff list [app]                 List stored snapshots
+  updiff fetch <app> [version]      Download an earlier release from Homebrew's cask
+                                    history, store it as a snapshot and compare it
+                                    with the installed app (no baseline needed)
+  updiff extensions [check]         List browser and editor extensions with what they
+                                    can reach; 'check' reports what changed since the
+                                    last check (permissions, sites, bundled code)
+  updiff pkg <installer.pkg> [older.pkg]
+                                    Show what an installer package would do: its
+                                    scripts, launch daemons and install locations.
+                                    With two packages, what changed. Nothing is run.
   updiff agent install|uninstall|status
                                     Run 'check' automatically after app updates
 
@@ -37,12 +51,16 @@ Options:
                                     /Applications and ~/Applications, or
                                     $UPDIFF_APPS_DIRS, colon-separated)
   --notify                          check: show a notification for each changed app
+  --extensions                      check: also check browser and editor extensions
   --settle <seconds>                check: wait until apps stop changing for this long
   --keep <n>                        check/snapshot: snapshots to keep per app (default 10)
   --quiet                           Print less
   --interval <seconds>              agent install: fallback timer (default 21600)
   --dry-run                         agent install: print the LaunchAgent, change nothing
   --no-load                         agent install/uninstall: write files, skip launchctl
+  --no-gatekeeper                   Skip the Gatekeeper/notarization check (faster)
+  --cask <name>                     fetch: the Homebrew cask, when it isn't the app's name
+  --list                            fetch: list the releases in the cask's history
   --no-color                        Plain text output
   -h, --help                        Show this help
   -v, --version                     Show the version
@@ -73,6 +91,10 @@ function parse(argv) {
             'dry-run': { type: 'boolean' },
             'no-load': { type: 'boolean' },
             'no-color': { type: 'boolean' },
+            'no-gatekeeper': { type: 'boolean' },
+            cask: { type: 'string' },
+            list: { type: 'boolean' },
+            extensions: { type: 'boolean' },
             help: { type: 'boolean', short: 'h' },
             version: { type: 'boolean', short: 'v' },
         },
@@ -184,7 +206,8 @@ async function cmdScan(ctx, args) {
     const app = await findAppByName(args[0], ctx.appsDirs);
     if (!app)
         throw new UsageError(`Can't find app "${args[0]}".`);
-    const s = await scanBundle(app, ctx.scan);
+    // A one-off scan of an installed app also shows this Mac's update settings for it.
+    const s = await scanBundle(app, { ...ctx.scan, userDefaults: true });
     const text = ctx.format === 'json' ? renderJson(s) : renderScan(s, { color: ctx.io.color && !ctx.out });
     if (ctx.out) {
         await writeFile(ctx.out, text);
@@ -309,7 +332,48 @@ async function waitUntilSettled(apps, seconds, io, quiet) {
         await new Promise((r) => setTimeout(r, Math.min(15, seconds - age) * 1000));
     }
 }
-async function cmdCheck(ctx, args, notifyEnabled, settle) {
+/** Compares installed extensions with the last stored set and stores the new one. */
+async function checkExtensions(ctx) {
+    const current = { schema: 1, takenAt: new Date().toISOString(), extensions: await discoverExtensions() };
+    const previous = await ctx.store.latestExtensions();
+    if (!previous) {
+        await ctx.store.saveExtensions(current);
+        return { count: current.extensions.length, baseline: true };
+    }
+    const report = diffExtensions(previous, current);
+    if (report.identical)
+        return { count: current.extensions.length, baseline: false };
+    await ctx.store.saveExtensions(current);
+    const file = await ctx.store.saveReport('extensions', previous.takenAt.slice(0, 10), current.takenAt.slice(0, 10), 'md', renderMarkdown(report));
+    return { count: current.extensions.length, baseline: false, report, file };
+}
+function describeExtensionCheck(r) {
+    if (r.baseline)
+        return `Saved a baseline of ${r.count} extension${r.count === 1 ? '' : 's'}; the next check reports what changes.`;
+    return r.report ? `Extensions: ${r.report.counts.high} high, ${r.report.counts.notable} notable, ${r.report.counts.info} info.` : `No changes in ${r.count} extension${r.count === 1 ? '' : 's'}.`;
+}
+async function cmdExtensions(ctx, args) {
+    const [action, ...rest] = args;
+    if (rest.length || (action && action !== 'check' && action !== 'list'))
+        throw new UsageError('extensions takes `list` (default) or `check`.');
+    if (action !== 'check') {
+        const list = await discoverExtensions();
+        ctx.io.out(ctx.format === 'json' ? renderJson(list) : renderExtensions(list, { color: ctx.io.color }));
+        return 0;
+    }
+    const r = await checkExtensions(ctx);
+    if (ctx.format === 'json') {
+        ctx.io.out(renderJson({ count: r.count, baseline: r.baseline, ...(r.report ? { changes: filterBySeverity(r.report, ctx.minSeverity), reportFile: r.file } : {}) }));
+        return 0;
+    }
+    if (r.report) {
+        ctx.io.out(renderText(filterBySeverity(r.report, ctx.minSeverity), { color: ctx.io.color, full: ctx.full }));
+        ctx.io.out(`Report: ${r.file}\n\n`);
+    }
+    ctx.io.out(`${describeExtensionCheck(r)}\n`);
+    return 0;
+}
+async function cmdCheck(ctx, args, notifyEnabled, settle, withExtensions) {
     if (args.length)
         throw new UsageError('check takes no app names; use --apps-dir to choose folders.');
     let apps = await discoverApps(ctx.appsDirs);
@@ -326,12 +390,14 @@ async function cmdCheck(ctx, args, notifyEnabled, settle) {
     }
     const baseline = results.filter((r) => r.status === 'new');
     const failed = results.filter((r) => r.status === 'failed');
+    const ext = withExtensions ? await checkExtensions(ctx) : undefined;
     if (ctx.format === 'json') {
         ctx.io.out(renderJson({
             checked: apps.length,
             baseline: baseline.map((r) => r.snapshot.app.bundleId),
             failed: failed.map((r) => ({ app: r.app, error: r.error })),
             changed: reports.map(({ report, file }) => ({ ...filterBySeverity(report, ctx.minSeverity), reportFile: file })),
+            ...(ext ? { extensions: { count: ext.count, baseline: ext.baseline, ...(ext.report ? { changes: filterBySeverity(ext.report, ctx.minSeverity), reportFile: ext.file } : {}) } } : {}),
         }));
     }
     else {
@@ -347,6 +413,12 @@ async function cmdCheck(ctx, args, notifyEnabled, settle) {
                 parts.push(`${failed.length} failed (${failed.map((f) => basename(f.app)).join(', ')})`);
             ctx.io.out(`${parts.join(', ')}.\n`);
         }
+        if (ext?.report) {
+            ctx.io.out('\n' + renderText(filterBySeverity(ext.report, ctx.minSeverity), { color: ctx.io.color, full: ctx.full }));
+            ctx.io.out(`Report: ${ext.file}\n`);
+        }
+        if (ext && (!ctx.quiet || ext.report))
+            ctx.io.out(`${describeExtensionCheck(ext)}\n`);
     }
     if (notifyEnabled) {
         for (const { report } of reports) {
@@ -354,7 +426,80 @@ async function cmdCheck(ctx, args, notifyEnabled, settle) {
             const summary = high || notable ? `${high} high, ${notable} notable change${high + notable === 1 ? '' : 's'}` : 'No notable changes';
             await notify(`Updiff: ${report.app.name} ${report.to.version}`, `${summary}. Run: updiff diff "${report.app.bundleId}"`);
         }
+        if (ext?.report && (ext.report.counts.high || ext.report.counts.notable)) {
+            await notify('Updiff: extensions changed', `${ext.report.counts.high} high, ${ext.report.counts.notable} notable. Report: ${ext.file}`);
+        }
+    }
+    return 0;
+}
+async function cmdFetch(ctx, args, opts) {
+    if (args.length < 1 || args.length > 2)
+        throw new UsageError('fetch needs an app (or cask) and optionally a version.');
+    const [target, wanted] = args;
+    const installed = await findAppByName(target, ctx.appsDirs);
+    const identity = installed ? await readIdentity(installed) : undefined;
+    const candidates = opts.cask ? [opts.cask] : [target, ...(identity ? [identity.name, basename(installed, '.app')] : [])];
+    const log = (s) => {
+        if (!ctx.quiet)
+            ctx.io.err(`${s}\n`);
+    };
+    const info = await resolveCask(candidates);
+    log(`Reading the history of the Homebrew cask "${info.token}"…`);
+    const { releases } = await caskHistory(info.token, { info });
+    if (!releases.length)
+        throw new UsageError(`Found no releases in the history of the ${info.token} cask.`);
+    if (opts.list) {
+        const rows = releases.map((r) => ({
+            version: r.version,
+            date: r.date.slice(0, 10),
+            checksum: r.sha256 ? 'pinned' : 'not pinned',
+            url: r.url ?? '(derived from the current URL)',
+            installed: sameVersion(r.version, identity?.version),
+        }));
+        if (ctx.format === 'json')
+            ctx.io.out(renderJson(rows));
+        else {
+            const w = Math.max(...rows.map((r) => r.version.length), 7);
+            for (const r of rows)
+                ctx.io.out(`${r.version.padEnd(w)}  ${r.date}  ${r.checksum.padEnd(10)}  ${r.installed ? 'installed' : ''}\n`);
+        }
+        return 0;
+    }
+    const release = pickRelease(releases, wanted, identity?.version);
+    const fetched = await fetchRelease(info, release, { scan: ctx.scan, log });
+    const file = await ctx.store.save(fetched.snapshot);
+    log(`Stored ${fetched.snapshot.app.name} ${fetched.snapshot.app.version} as a snapshot (${file}).`);
+    if (!installed) {
+        log(`${info.name} isn't installed here, so there's nothing to compare it with yet.`);
+        return 0;
+    }
+    if (identity && identity.bundleId !== fetched.snapshot.app.bundleId) {
+        ctx.io.err(`Warning: the cask's app (${fetched.snapshot.app.bundleId}) isn't the installed app (${identity.bundleId}); check --cask.\n`);
+    }
+    log(`Comparing with the installed ${identity?.name ?? basename(installed)} ${identity?.version ?? ''}…\n`);
+    await emit(ctx, diffSnapshots(fetched.snapshot, await scanBundle(installed, ctx.scan)));
+    return 0;
+}
+async function cmdPkg(ctx, args) {
+    if (args.length < 1 || args.length > 2)
+        throw new UsageError('pkg needs an installer package, or two to compare.');
+    for (const a of args)
+        if (!existsSync(a))
+            throw new UsageError(`Can't find "${a}".`);
+    const reports = await Promise.all(args.map((a) => inspectPkg(resolve(a))));
+    if (reports.length === 2) {
+        // Arguments are new then old, matching "what does this update change".
+        await emit(ctx, diffPkgs(reports[1], reports[0]));
+        return 0;
+    }
+    const r = reports[0];
+    const text = ctx.format === 'json' ? renderJson(r) : ctx.format === 'md' ? renderPkgMarkdown(r) : renderPkg(r, { color: ctx.io.color && !ctx.out, full: ctx.full });
+    if (ctx.out) {
+        await writeFile(ctx.out, text);
+        ctx.io.err(`Wrote ${ctx.out}\n`);
     }
+    else
+        ctx.io.out(text);
     return 0;
 }
 async function cmdList(ctx, args) {
@@ -473,7 +618,7 @@ export async function main(argv, io) {
             io: { ...io, color: io.color && !v['no-color'] && format === 'text' },
             store: new Store(v.home ? resolve(v.home) : undefined),
             appsDirs: (v['apps-dir'] ?? defaultAppsDirs()).map((d) => resolve(d)),
-            scan: { deep: v.deep === true },
+            scan: { deep: v.deep === true, notarization: !v['no-gatekeeper'] },
             format,
             minSeverity,
             out: v.out,
@@ -490,9 +635,15 @@ export async function main(argv, io) {
             case 'diff':
                 return await cmdDiff(ctx, args);
             case 'check':
-                return await cmdCheck(ctx, args, v.notify === true, intOption(v.settle, 'settle', 0));
+                return await cmdCheck(ctx, args, v.notify === true, intOption(v.settle, 'settle', 0), v.extensions === true);
+            case 'extensions':
+                return await cmdExtensions(ctx, args);
             case 'list':
                 return await cmdList(ctx, args);
+            case 'pkg':
+                return await cmdPkg(ctx, args);
+            case 'fetch':
+                return await cmdFetch(ctx, args, { cask: v.cask, list: v.list === true });
             case 'agent':
                 return await cmdAgent(ctx, args, { interval: Math.max(600, intOption(v.interval, 'interval', 21600)), dryRun: v['dry-run'] === true, load: !v['no-load'] });
             default:
@@ -504,7 +655,7 @@ export async function main(argv, io) {
             io.err(`${err.message}\n`);
             return 2;
         }
-        io.err(`updiff: ${err.stack ?? err}\n`);
+        io.err(`updiff: ${process.env.UPDIFF_DEBUG ? (err.stack ?? err) : (err.message ?? err)}\n`);
         return 1;
     }
 }

package/dist/diff.js

@@ -398,6 +398,84 @@ function diffInfo(a, b, out) {
         out.push({ severity: 'info', category: 'identity', change: 'changed', title: `Minimum macOS ${ia.minimumSystemVersion ?? '?'} → ${ib.minimumSystemVersion}`, where: ['Contents/Info.plist'] });
     }
 }
+/** Apple has vouched for it: notarized, or distributed by Apple (App Store, system). */
+const isApproved = (source) => /notarized|mac app store|apple system/i.test(source ?? '');
+function diffNotarization(a, b, out) {
+    const na = a.notarization;
+    const nb = b.notarization;
+    // Older snapshots (and scans with notarization off) have nothing to compare.
+    if (!na || !nb)
+        return;
+    const where = [b.app.path];
+    if (na.assessment === 'accepted' && nb.assessment === 'unknown' && nb.error) {
+        out.push({
+            severity: 'high',
+            category: 'signing',
+            change: 'changed',
+            title: "Gatekeeper can no longer verify the app's signature",
+            detail: nb.error,
+            where,
+        });
+    }
+    else if (na.assessment === 'accepted' && nb.assessment === 'rejected') {
+        out.push({
+            severity: 'high',
+            category: 'signing',
+            change: 'changed',
+            title: 'Gatekeeper now rejects the app',
+            detail: `${na.source ?? 'accepted'} → rejected`,
+            where,
+        });
+    }
+    else if (isApproved(na.source) && !isApproved(nb.source) && nb.assessment !== 'unknown') {
+        out.push({
+            severity: 'high',
+            category: 'signing',
+            change: 'removed',
+            title: 'No longer notarized by Apple',
+            detail: `${na.source} → ${nb.source ?? nb.assessment}`,
+            where,
+        });
+    }
+    else if (na.source && nb.source && na.source !== nb.source) {
+        out.push({ severity: 'notable', category: 'signing', change: 'changed', title: 'Distribution changed', detail: `${na.source} → ${nb.source}`, where });
+    }
+    if (na.stapled === true && nb.stapled === false) {
+        out.push({
+            severity: 'info',
+            category: 'signing',
+            change: 'removed',
+            title: 'Notarization ticket no longer stapled',
+            detail: 'Gatekeeper checks it online instead; first launch offline may fail.',
+            where,
+        });
+    }
+    else if (na.stapled === false && nb.stapled === true) {
+        out.push({ severity: 'info', category: 'signing', change: 'added', title: 'Notarization ticket now stapled', where });
+    }
+}
+function diffSparkleCode(a, b, out) {
+    const fa = a.info.sparkleFeedsInCode ?? [];
+    const fb = b.info.sparkleFeedsInCode ?? [];
+    const added = fb.filter((u) => !fa.includes(u));
+    const removed = fa.filter((u) => !fb.includes(u));
+    if (added.length && fa.length) {
+        out.push({
+            severity: 'notable',
+            category: 'updater',
+            change: 'changed',
+            title: 'Update feed in the code changed',
+            detail: `${removed.length ? `${removed.join(', ')} → ` : ''}${added.join(', ')}`,
+            where: [b.app.path],
+        });
+    }
+    else if (added.length) {
+        out.push({ severity: 'notable', category: 'updater', change: 'added', title: 'Update feed set in the code', detail: added.join(', '), where: [b.app.path] });
+    }
+    else if (removed.length) {
+        out.push({ severity: 'info', category: 'updater', change: 'removed', title: 'Update feed no longer in the code', detail: removed.join(', '), where: [b.app.path] });
+    }
+}
 function diffElectron(a, b, out) {
     const pa = a.electron?.packages ?? {};
     const pb = b.electron?.packages ?? {};
@@ -478,9 +556,9 @@ function diffHosts(a, b, out) {
         out.push({ severity: 'info', category: 'host', change: 'removed', title: `${gone.length} domain${gone.length === 1 ? '' : 's'} no longer mentioned`, detail: gone.join(', ') });
     }
 }
-const SEVERITY_ORDER = { high: 0, notable: 1, info: 2 };
-const CATEGORY_ORDER = [
-    'signing', 'privacy', 'entitlement', 'background', 'updater', 'network', 'code', 'urlScheme', 'electron', 'package', 'host', 'identity',
+export const SEVERITY_ORDER = { high: 0, notable: 1, info: 2 };
+export const CATEGORY_ORDER = [
+    'signing', 'privacy', 'permission', 'entitlement', 'background', 'script', 'install', 'updater', 'network', 'code', 'urlScheme', 'electron', 'package', 'host', 'identity',
 ];
 export function diffSnapshots(a, b) {
     const findings = [];
@@ -491,6 +569,16 @@ export function diffSnapshots(a, b) {
     diffCode(a, b, findings);
     diffBackground(a.backgroundItems, b.backgroundItems, findings);
     diffElectron(a, b, findings);
+    diffNotarization(a, b, findings);
+    diffSparkleCode(a, b, findings);
+    if (!a.info.appStoreReceipt !== !b.info.appStoreReceipt) {
+        findings.push({
+            severity: 'notable',
+            category: 'identity',
+            change: b.info.appStoreReceipt ? 'added' : 'removed',
+            title: b.info.appStoreReceipt ? 'Now distributed through the Mac App Store' : 'No longer a Mac App Store build',
+        });
+    }
     diffHosts(a, b, findings);
     const substantive = findings.length;
     if (a.app.version !== b.app.version || a.app.build !== b.app.build) {
@@ -507,6 +595,13 @@ export function diffSnapshots(a, b) {
     const counts = { high: 0, notable: 0, info: 0 };
     for (const f of findings)
         counts[f.severity]++;
+    const notes = [];
+    const encrypted = [...new Set([...(a.encryptedBinaries ?? []), ...(b.encryptedBinaries ?? [])])];
+    if (encrypted.length) {
+        notes.push(`Encrypted binaries (an iPhone or iPad app) can't be searched for hostnames: ${encrypted.slice(0, 3).join(', ')}${encrypted.length > 3 ? '…' : ''}.`);
+    }
+    if (!a.notarization !== !b.notarization)
+        notes.push('Notarization was only checked on one side, so it was not compared.');
     return {
         app: { name: b.app.name, bundleId: b.app.bundleId },
         from: { version: a.app.version, build: a.app.build, takenAt: a.takenAt, path: a.app.path },
@@ -514,6 +609,7 @@ export function diffSnapshots(a, b) {
         findings,
         counts,
         identical: substantive === 0 && a.fingerprint === b.fingerprint,
+        ...(notes.length ? { notes } : {}),
     };
 }
 export function filterBySeverity(report, min) {