pairling 0.2.5 → 0.2.6

package/payload/mac/install/render-launchd.py

@@ -4,6 +4,7 @@
 from __future__ import annotations
 
 import argparse
+import os
 import plistlib
 from pathlib import Path
 
@@ -11,6 +12,7 @@ PAIRLING_DAEMON_LABEL = "dev.pairling.companiond"
 PAIRLING_GUARDIAN_LABEL = "dev.pairling.power-guardian"
 PAIRLING_CONNECTD_LABEL = "dev.pairling.connectd"
 PAIRLING_PTYBROKER_LABEL = "dev.pairling.ptybroker"
+PAIRLING_MINTD_LABEL = "dev.pairling.mintd"
 PAIRLING_RUNTIME_PORT = "7773"
 
 
@@ -20,21 +22,27 @@ def write_plist(path: Path, payload: dict) -> None:
         plistlib.dump(payload, fh, sort_keys=False)
 
 
-def daemon_plist(current: Path, logs: Path, python_bin: str) -> dict:
+def daemon_plist(current: Path, logs: Path, python_bin: str, mint_enabled: bool = False) -> dict:
+    env = {
+        "PAIRLING_RUNTIME_PORT": PAIRLING_RUNTIME_PORT,
+        "COMPANION_DAEMON_PORT": PAIRLING_RUNTIME_PORT,
+        "PAIRLING_BIND_MODE": "all",
+        "PAIRLING_APP_SUPPORT_ROOT": str(current.parent.parent),
+        "PAIRLING_LOGS_ROOT": str(logs),
+        "PATH": "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",
+    }
+    if mint_enabled:
+        # Architecture B is on only when the separate-uid mint broker is
+        # installed. Persisting the flag here keeps it across daemon restarts
+        # and reboots, instead of relying on an ephemeral launchctl setenv.
+        env["PAIRLING_MINT_ENABLED"] = "1"
     return {
         "Label": PAIRLING_DAEMON_LABEL,
         "ProgramArguments": [
             python_bin,
             str(current / "companiond" / "pairlingd.py"),
         ],
-        "EnvironmentVariables": {
-            "PAIRLING_RUNTIME_PORT": PAIRLING_RUNTIME_PORT,
-            "COMPANION_DAEMON_PORT": PAIRLING_RUNTIME_PORT,
-            "PAIRLING_BIND_MODE": "all",
-            "PAIRLING_APP_SUPPORT_ROOT": str(current.parent.parent),
-            "PAIRLING_LOGS_ROOT": str(logs),
-            "PATH": "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",
-        },
+        "EnvironmentVariables": env,
         "RunAtLoad": True,
         "KeepAlive": True,
         "ThrottleInterval": 10,
@@ -96,6 +104,39 @@ def connectd_plist(current: Path, logs: Path) -> dict:
     }
 
 
+def mintd_plist(current: Path, logs: Path) -> dict:
+    system_root = Path("/Library/Application Support/Pairling")
+    system_logs = Path("/Library/Logs/Pairling")
+    return {
+        "Label": PAIRLING_MINTD_LABEL,
+        "UserName": "_pairling_mint",
+        "GroupName": "staff",
+        "ProgramArguments": [
+            str(system_root / "mint" / "pairling-tailnet-mintd"),
+            "--secret-path",
+            str(system_root / "mint" / "client_secret.json"),
+            "--socket-path",
+            str(system_root / "run" / "mintd" / "mintd.sock"),
+            "--state-path",
+            str(system_root / "mint" / "state.json"),
+            "--audit-path",
+            str(system_root / "mint" / "audit.jsonl"),
+            "--alert-path",
+            str(system_root / "run" / "mintd" / "alerts.jsonl"),
+            "--authorized-uid",
+            str(os.getuid()),
+        ],
+        "EnvironmentVariables": {
+            "PATH": "/Applications/Tailscale.app/Contents/MacOS:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",
+        },
+        "RunAtLoad": True,
+        "KeepAlive": True,
+        "ThrottleInterval": 10,
+        "StandardOutPath": str(system_logs / "mintd.log"),
+        "StandardErrorPath": str(system_logs / "mintd.err"),
+    }
+
+
 def ptybroker_plist(current: Path, logs: Path, python_bin: str) -> dict:
     app_support = current.parent.parent
     return {
@@ -125,16 +166,19 @@ def main() -> int:
     parser.add_argument("--daemon-python", default="/usr/local/bin/python3")
     parser.add_argument("--guardian-python", default="/usr/bin/python3")
     parser.add_argument("--mirror-python", default="/usr/local/bin/python3", help=argparse.SUPPRESS)
+    parser.add_argument("--mint-enabled", action="store_true",
+                        help="set PAIRLING_MINT_ENABLED=1 in the companiond env (Architecture B)")
     args = parser.parse_args()
 
     current = Path(args.current_root)
     logs = Path(args.logs_root)
     out = Path(args.output_dir)
 
-    write_plist(out / f"{PAIRLING_DAEMON_LABEL}.plist", daemon_plist(current, logs, args.daemon_python))
+    write_plist(out / f"{PAIRLING_DAEMON_LABEL}.plist", daemon_plist(current, logs, args.daemon_python, args.mint_enabled))
     write_plist(out / f"{PAIRLING_PTYBROKER_LABEL}.plist", ptybroker_plist(current, logs, args.daemon_python))
     write_plist(out / f"{PAIRLING_GUARDIAN_LABEL}.plist", guardian_plist(current, logs, args.guardian_python))
     write_plist(out / f"{PAIRLING_CONNECTD_LABEL}.plist", connectd_plist(current, logs))
+    write_plist(out / f"{PAIRLING_MINTD_LABEL}.plist", mintd_plist(current, logs))
     return 0
 
 

package/payload-manifest.json

@@ -1,18 +1,18 @@
 {
   "connectd": {
     "darwin-arm64": {
-      "sha256": "96400014bc7d32bd1b976216eb6dc76a6621d9da34a2ef02da87c72957dea170",
+      "sha256": "d6d23a4cf72a2c44cde10adfd58d58dc1a29226da10e0bfa7c147b2c0e9bd1a7",
       "team_id": "965AVD34A3"
     },
     "darwin-x64": {
-      "sha256": "bb4df01a72f6c2032c8d7341f5d243fa3e6c99295c033dbf3f99a7d7eed650b7",
+      "sha256": "d1f7cfb6fcb1a9542ac4852ef41610a8866e010aff299b86a349b06bcc5ec465",
       "team_id": "965AVD34A3"
     }
   },
   "files": [
     {
       "path": "payload/mac/SOURCE_BRANCH",
-      "sha256": "34d6a94dacb895403529caac12a19aed745c6caca7a8d0f4ed631999044f76e8"
+      "sha256": "b7cda4715ebe6bb92ec69b85df0e99668564bde99f03d6e04109b399538000b2"
     },
     {
       "path": "payload/mac/SOURCE_DIRTY",
@@ -20,11 +20,11 @@
     },
     {
       "path": "payload/mac/SOURCE_REVISION",
-      "sha256": "6fba526ba8b27c395d71b9d6067bb09fe9458c5d650a92af80541ad7971a3ba3"
+      "sha256": "1746356edd4da4f8f46f7c3481696eb0481563f5d9d24e67be7545fdc4fb4b4b"
     },
     {
       "path": "payload/mac/VERSION",
-      "sha256": "e959f750e92dbb7614ae28ac96f0a37272caed81d8bbb758791af7bfbb6106a0"
+      "sha256": "be3c6d2c6c406a64d44f0b6464a887e290416dd90c524094485b1be00936d6d7"
     },
     {
       "path": "payload/mac/companiond/app_attest_lan.py",
@@ -72,15 +72,15 @@
     },
     {
       "path": "payload/mac/companiond/pairling_connectd_status.py",
-      "sha256": "c44ce738f39aa791b5252e27719c79119406ad143b4ad4627a84acd3bff89a97"
+      "sha256": "243b0319b31919bbaca3742fc288097e05bef800432d0409d9a1f70df682386f"
     },
     {
       "path": "payload/mac/companiond/pairling_devices.py",
-      "sha256": "ef82052d0560863e43476ba9098db7435d924fc473d3ebb747954663a975c85b"
+      "sha256": "79ffd7aeb999c70a10b76f6b6ea1e9f4f63fff0446ecb76863a4d46403e7601b"
     },
     {
       "path": "payload/mac/companiond/pairling_pairing.py",
-      "sha256": "e125501b4c41f57fb9f4acee705f523c0c320fe207c48d4cb5286c8413085e0f"
+      "sha256": "6d6aab5cfa12daff6b83f25c6844253432dfec3f20bec30a072875a19dba23cb"
     },
     {
       "path": "payload/mac/companiond/pairling_psk.py",
@@ -96,7 +96,7 @@
     },
     {
       "path": "payload/mac/companiond/pairlingd.py",
-      "sha256": "1e65b91c2015451502ca07c15f35c8145a3ceb3d4c79fb0d11aad63c66a65861"
+      "sha256": "ee2a9115531a15f9cc3aff0680be3bb7ab7b42c7cf001eac05b33cbf36755842"
     },
     {
       "path": "payload/mac/companiond/providers/__init__.py",
@@ -136,7 +136,7 @@
     },
     {
       "path": "payload/mac/companiond/push_dispatcher.py",
-      "sha256": "5b7eda4d80e031b1321873db967194f0c85bee208bbc1c731a583eb7efc78d7d"
+      "sha256": "93aadbb99321cd6f17461254edbffbc11ba99086ba48b20b26ffbebdcd2c6381"
     },
     {
       "path": "payload/mac/companiond/push_event_catalog.py",
@@ -194,14 +194,34 @@
       "path": "payload/mac/connectd/cmd/pairling-connectd/authkey_test.go",
       "sha256": "844ca4d83d952339fb394c1b3ccbe9c0717f8fe500a9b7282eede9291bfc284b"
     },
+    {
+      "path": "payload/mac/connectd/cmd/pairling-connectd/identity_test.go",
+      "sha256": "5ef8ad69a4571019d8092973c94da4c1b317e11d84dd411ce6064e7024a133d5"
+    },
     {
       "path": "payload/mac/connectd/cmd/pairling-connectd/main.go",
-      "sha256": "7bed187e340124860c49e5161a5b60338e3282d8467eec83d2f75c766f417e3c"
+      "sha256": "4582664c189db3c13fef81328172d69fa0bcd6b064396c0a811a154da98f7f21"
+    },
+    {
+      "path": "payload/mac/connectd/cmd/pairling-connectd/peer_identity_test.go",
+      "sha256": "044c1260387b990de073d4f09fa516c3ce15ded7c255b5e1ac3d57f3f5810c27"
     },
     {
       "path": "payload/mac/connectd/cmd/pairling-connectd/upstream_health_test.go",
       "sha256": "dc5b6d3a8d11f38bcc198287bdbc95f058d35792ca6cf34bc49ca0bed22bfacf"
     },
+    {
+      "path": "payload/mac/connectd/cmd/pairling-tailnet-mintd/main.go",
+      "sha256": "64fd4527c97397fce10793001af8d59ac3154c75c7ed9e1b532f8f2e4bf88bd4"
+    },
+    {
+      "path": "payload/mac/connectd/cmd/pairling-tailnet-mintd/mintd.go",
+      "sha256": "ca49b8ab8216eeec770ad6e9e8111aca819a9a88b050d7eefbdf69c0fad20376"
+    },
+    {
+      "path": "payload/mac/connectd/cmd/pairling-tailnet-mintd/mintd_test.go",
+      "sha256": "14a9af6b9575ba89314ce05f2fe465844fea3bb40b3eba5e0d33d059608bfb1f"
+    },
     {
       "path": "payload/mac/connectd/go.mod",
       "sha256": "c96748d396598b0952b4c0d43f7f85ca3a56f4019761088267421b22518d5905"
@@ -210,29 +230,41 @@
       "path": "payload/mac/connectd/go.sum",
       "sha256": "af76807df4c698a707e5e6f9e8b3d091cf8be7a4b7f5ecee98361be2eee51ade"
     },
+    {
+      "path": "payload/mac/connectd/internal/gateway/adversarial_verify_test.go",
+      "sha256": "5065aac2f8e682557fe1d12854d5436b0320ab4c10f9f682f0a6ecd1f2d12fab"
+    },
+    {
+      "path": "payload/mac/connectd/internal/gateway/funnel_bootstrap_test.go",
+      "sha256": "2f9412f00adfc7ed3433316202469bf43bba52655677be6b46d16a47152bb531"
+    },
+    {
+      "path": "payload/mac/connectd/internal/gateway/funnel_contract_test.go",
+      "sha256": "946a757b5dc3bdade769d63f325bedc3014dbe2f18d55a99c5eb82354856b5d1"
+    },
     {
       "path": "payload/mac/connectd/internal/gateway/proxy.go",
-      "sha256": "5da0f96ec8c364d90a7c07e4e968df6e9bd7bfeadf6cbe25d0bb743cdba3a91a"
+      "sha256": "ad7de08a59819fcbdd81f62d707738af128064cc24cea576674aee2f0960c267"
     },
     {
       "path": "payload/mac/connectd/internal/gateway/proxy_test.go",
-      "sha256": "1eefdfc331e97033d124cd627dd6e456f6de71e3a28b8d05aa6ede9faa3ff663"
+      "sha256": "b02cd354dcd3292079f35ee86a1ce75e3ed8286550f064fdae7914e661464910"
     },
     {
       "path": "payload/mac/connectd/internal/runtime/config.go",
-      "sha256": "da25233909881d82b4f5e019896f1d8456eb5ab8a67cbdb385652d4cca088c73"
+      "sha256": "4b2c325c1f693c747b37e9dae380be2c7801c674f41fe59403d48e33aec62332"
     },
     {
       "path": "payload/mac/connectd/internal/runtime/config_test.go",
-      "sha256": "eab02d122677fbae7f6417eb232d20fc8f7945b1babf8c3d0e25ec746f71ba33"
+      "sha256": "f914d32112cd3151449d58d3f14cba4e88bd313428d7a1c1ce092d160b66babc"
     },
     {
       "path": "payload/mac/connectd/internal/status/status.go",
-      "sha256": "b420d29797ab5cfff365077baf5043cf59c88c656c5a04fee071e61c748abaf4"
+      "sha256": "69d6950c942c7c20bb5994c90d325c3683f21981ed85f653c43dcba2b00c4528"
     },
     {
       "path": "payload/mac/connectd/internal/status/status_test.go",
-      "sha256": "b4b166e5c0c17f5b6d9984f877b778c737e4bb5781058e52e1eb0d865e10c46e"
+      "sha256": "5d2c9601c5edf6afc0abc7d4737cc06fd4e3a53cb83c0fce4b51750c1e194366"
     },
     {
       "path": "payload/mac/guardian/companion-power-guardian.py",
@@ -252,7 +284,7 @@
     },
     {
       "path": "payload/mac/install/install-runtime.sh",
-      "sha256": "87c1db89b281b78d0809b4360c54c5c57b8e4f25a473496373315236ffeb6117"
+      "sha256": "152eed164fd4edfd42874f20e8476d8e42415d5e93e090b716fef2ea7ed6424e"
     },
     {
       "path": "payload/mac/install/psk_dependency_check.py",
@@ -260,7 +292,7 @@
     },
     {
       "path": "payload/mac/install/render-launchd.py",
-      "sha256": "2eaec2c7deaaf850d6bc499ca91e4e5bad3a8ef63957d5f35df42204b2c0ae11"
+      "sha256": "5c4c06b578e24726731650ff39d688248ba1bd412b9e21fc368b13d07e8ee0df"
     },
     {
       "path": "payload/mac/install/uninstall-runtime.sh",
@@ -275,9 +307,19 @@
       "sha256": "5ebcd63fc53114ace518807c2221e562e65237e57945a76c457f5931a5791cc1"
     }
   ],
+  "mintd": {
+    "darwin-arm64": {
+      "sha256": "08b815ae499550ffe2634315a7e8c2233a6a557f75d51476716da00c082e42d6",
+      "team_id": "965AVD34A3"
+    },
+    "darwin-x64": {
+      "sha256": "3acd15acb4474793aa9862f3f4a7957570621e3034803a9991fe8445426b7301",
+      "team_id": "965AVD34A3"
+    }
+  },
   "package": "pairling",
-  "package_version": "0.2.5",
+  "package_version": "0.2.6",
   "schema_version": 1,
   "source_dirty": false,
-  "source_revision": "2f094bd"
+  "source_revision": "7f2b4a22"
 }