Is macOS’s new XProtect behavioural security preparing to go live?

Re:Is macOS’s new XProtect behavioural security preparing to... by davidmurdoch on Monday September 04, 2023 @10:27AM (#37380808)

It's an Electron app AND blockchain related; hackernews's two favorite things to hate. I don't expect much love from this crowd. Heh.

It's certainly either something I'm doing wrong, or a big in the software I'm using to automate signing, notification and stapling.

Here's the issue I opened on the software I'm using to automate: https://github.com/electron-userland/electron-builder/issues... that issue kinks to the PR that adds the automation.

It's a non-trivial thing to test, since it involves so many secrets and the notarization step can take over an hour, so I don't expect anyone here to actually want to look into it.

My original comment really was just venting my frustration, not a cry for help (but I might be crying soon if I can get to the bottom of this!).

[ Parent | on HN ]

Re:Is macOS’s new XProtect behavioural security preparing to... by terhechte on Monday September 04, 2023 @10:43AM (#37380944)

I’m on mobile, so short help: in one of my projects I’m building a binary in Rust and then using Xcode to notarize it by replacing the binary of another shell app that I’m Bildung in Xcode. This works really well. Check out the description here: https://github.com/terhechte/Ebou

[ Parent | on HN ]

Re:Is macOS’s new XProtect behavioural security preparing to... by davidmurdoch on Monday September 04, 2023 @10:45AM (#37380958)

Thanks! I'll take a look at the specifics tomorrow.

[ Parent | on HN ]

Re:Is macOS’s new XProtect behavioural security preparing to... by jamil7 on Monday September 04, 2023 @11:03AM (#37381148)

Thanks for the response. The output of `spctl` on your latest build (2.7.2, downloaded from the build artefacts section of Github Actions gives me the following:

/Applications/Ganache.app: rejected (invalid destination for symbolic link in bundle) origin=Developer ID Application: ConsenSys AG (48XVW22RCG)

I see you're also migrating to Github Actions for this particular release and that the notarization process was working correctly on your previous CI/CD? I guess there has to be an issue with the new environment here or the way you're building it now.

[ Parent | on HN ]

Re:Is macOS’s new XProtect behavioural security preparing to... by dunham on Monday September 04, 2023 @12:10PM (#37381827)

Probably the five links to /usr/local/bin/python3 in node_modules. Does the app need node_modules bundled?

[ Parent | on HN ]

Re:Is macOS’s new XProtect behavioural security preparing to... by mike_hearn on Monday September 04, 2023 @11:26AM (#37381390)

You could try experimenting with Hydraulic Conveyor [1]. I built it originally due to the frustrations involved in distributing P2P software during my old Bitcoin days so you won't get any hate from me about that ;)

Conveyor can package Electron apps and also do all the Mac specific stuff from any platform including Linux. So it can sign, notarize and staple the app itself, also bundling Sparkle updates as it goes. We're listed on the Electron website these days. You may have more luck with it. There's a Discord channel for help too if you get stuck.

[1] https://hydraulic.dev/ (disclosure: my company)

[ Parent | on HN ]

Re:Is macOS’s new XProtect behavioural security preparing to... by davidmurdoch on Monday September 04, 2023 @11:47AM (#37381608)

Thanks for this! I've made a new issue to look into switching. It'd be great to find something that Just Works™!

[ Parent | on HN ]