Skip to content

🔒 [security] Validate code signature on auto-update #34

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hatimhtm wants to merge 1 commit into
base: main
Choose a base branch
from
Open

🔒 [security] Validate code signature on auto-update #34

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
71 changes: 48 additions & 23 deletions Click2Minimize/AppDelegate.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -462,44 +462,69 @@ class AppDelegate: NSObject, NSApplicationDelegate {

// Mount the DMG
let mountTask = Process()
let pipe = Pipe()
mountTask.launchPath = "/usr/bin/hdiutil"
mountTask.arguments = ["attach", localURL.path]
mountTask.arguments = ["attach", localURL.path, "-plist"]
mountTask.standardOutput = pipe

mountTask.terminationHandler = { process in
var mountedVolumePath: String? = nil
let data = pipe.fileHandleForReading.readDataToEndOfFile()

if process.terminationStatus == 0 {
// Get the mounted volume path
let mountedVolumePath = "/Volumes/Click2Minimize" // Adjust this if the volume name is different
let appDestinationURL = URL(fileURLWithPath: "/Applications/Click2Minimize.app") // Change to /Applications

do {
// Copy the app to the /Applications folder
let appSourceURL = URL(fileURLWithPath: "\(mountedVolumePath)/Click2Minimize.app") // Adjust if necessary
if FileManager.default.fileExists(atPath: appDestinationURL.path) {
try FileManager.default.removeItem(at: appDestinationURL) // Remove old version if it exists
if let plist = try? PropertyListSerialization.propertyList(from: data, options: [], format: nil) as? [String: Any],
let systemEntities = plist["system-entities"] as? [[String: Any]] {
for entity in systemEntities {
if let mp = entity["mount-point"] as? String {
mountedVolumePath = mp
break
}
}
try FileManager.default.copyItem(at: appSourceURL, to: appDestinationURL)
print("Successfully installed Click2Minimize to /Applications.")

// Prompt the user to relaunch the app
DispatchQueue.main.async {
self.promptUserToRelaunch()
}
}

if let mountedPath = mountedVolumePath {
let appDestinationURL = URL(fileURLWithPath: "/Applications/Click2Minimize.app")
let appSourceURL = URL(fileURLWithPath: "\(mountedPath)/Click2Minimize.app")

// Verify signature of downloaded app
let verifyTask = Process()
verifyTask.launchPath = "/usr/bin/codesign"
verifyTask.arguments = ["--verify", "-v", appSourceURL.path]
verifyTask.launch()
verifyTask.waitUntilExit()

if verifyTask.terminationStatus == 0 {
do {
// Copy the app to the /Applications folder
if FileManager.default.fileExists(atPath: appDestinationURL.path) {
try FileManager.default.removeItem(at: appDestinationURL) // Remove old version if it exists
}
try FileManager.default.copyItem(at: appSourceURL, to: appDestinationURL)
print("Successfully installed Click2Minimize to /Applications.")

// Prompt the user to relaunch the app
DispatchQueue.main.async {
self.promptUserToRelaunch()
}

} catch {
print("Error copying app to /Applications: \(error.localizedDescription)")
self.openBrowserForManualUpgrade()
}

} catch {
print("Error copying app to /Applications: \(error.localizedDescription)")
// Open the browser link for manual upgrade
} else {
print("Failed to verify signature of downloaded app.")
self.openBrowserForManualUpgrade()
}

// Unmount the DMG
let unmountTask = Process()
unmountTask.launchPath = "/usr/bin/hdiutil"
unmountTask.arguments = ["detach", mountedVolumePath]
unmountTask.arguments = ["detach", mountedPath]
unmountTask.launch()
unmountTask.waitUntilExit()
} else {
print("Failed to mount DMG.")
// Open the browser link for manual upgrade
print("Failed to mount DMG or determine mount point.")
self.openBrowserForManualUpgrade()
}
}
Expand Down