brew: pin cask signers; verify before install

Abierto
  • ¿Algo no está bien?
#65 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
45/100
Tipo de issue
Nueva funcionalidad
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
macos, shell
Área
cli, security

Línea de trabajo

Start by reading install/brew, the Brewfiles it uses, and the existing install scripts; check the installed apps in /Applications to confirm each vendor's Team ID before adding pins to install/brew.d/signers. Implement the checks described for install/verify-casks and integrate them into install/brew. Done means every Brewfile cask is pinned or refused, a one-character-wrong pin fails --before, and unverified apps are never copied into /Applications.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

A cask is a URL and a hash. The hash proves the bytes did not change.
It does not prove who made them. Apple code signing does.

Every Developer ID app carries a Team ID. Pin one Team ID per cask.
Check the pin before the app reaches /Applications.

Files

install/brew.d/signers holds the pins. One cask per line:

# <cask> <Team ID>   # vendor
slack       BQR82RBBHL   # Slack Technologies
1password   2BUA8C4S2C   # AgileBits Inc.

The Team IDs for the casks installed today come from the copies in
/Applications. That is trust on first use. Check each vendor name.

install/verify-casks checks the pins. It has three modes:

  • --before <Brewfile>: fetch each cask not yet installed. Unpack it
    in a temp directory. Verify it there. Install nothing.
  • --installed <Brewfile>: verify the apps in /Applications.
  • --record <cask>: print the signer of an installed app. Ask.
    Append a pin.

The check

One requirement does most of the work:

anchor apple generic
and certificate 1[field.1.2.840.113635.100.6.2.6] exists
and certificate leaf[field.1.2.840.113635.100.6.1.13] exists
and certificate leaf[subject.OU] = "<Team ID>"

It requires an Apple root, a Developer ID intermediate, a Developer ID
Application leaf, and the pinned team. Pass it to codesign --verify --deep --strict -R=. Then run spctl --assess --type execute to require
notarization.

In install/brew

verify-casks --before "$BREWFILE" || exit 1
brew bundle --verbose --file="$BREWFILE"
verify-casks --installed "$BREWFILE"

A cask with no pin is refused. To trust a new vendor, add one line to
signers. The diff is the review.

Details

  • codex is a bare binary in /opt/homebrew/bin. Gatekeeper cannot assess
    it. Run the codesign check only.
  • google-chrome uses sha256 :no_check. Brew may download it again at
    install time. Then the verified file and the installed file can differ.
    Find out. If so, install Chrome from the verified copy.
  • A .pkg cask needs pkgutil --check-signature. None exist in the
    desktop set today.
  • The four hand-installed apps (Brave, Chrome, Slack, 1Password) need
    brew install --cask --adopt first.
  • Pass --no-upgrade to brew bundle. The apps update themselves.

Done when

  • Each cask in each Brewfile has a pin, or the install refuses it.
  • A cask signed by the wrong team fails --before. Test with a pin
    changed by one character.
  • Nothing unverified is copied into /Applications.
Lenguaje dominante
Shell
Estrellas
1
Forks
0
Merge medio
9 h 5 min
PR fusionados (30 d)
5

Preparar el entorno

  • Sin Dockerfile ni archivo de Docker Compose
  • Tiene una plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de indexzero/dotfiles

Todos los issues de indexzero/dotfiles

Issues similares

Más issues de Shell/Bash

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.