Repository navigation
feat(desktop): bundle the built-in relay helper, signed and hash-checked (K3) - #628
Merged
Merged
Conversation
Stage K3 of the built-in call relay. Every desktop package now carries spry-node from the spry-turn 0.4.0 release, outside the asar: macOS Contents/Resources/spry/spry-node, Windows resources\spry\spry-node.exe, Linux resources/spry/spry-node, and in the deb /opt/KithMoot/resources/spry/spry-node (root, 0755). Nothing starts it yet. scripts/spry-release.json pins each archive and binary by SHA-256; scripts/spry-helper.mjs fetches the archive once, checks both hashes and extracts only spry-node, afresh for every build. The packagers write spry-manifest.json into the app with the helper's hash per platform, and spry-bundle.mjs hands the supervisor (K4) the helper's path only while its bytes match, so a helper replaced in a user-writable install is refused. On macOS the helper is signed first (Developer ID, hardened runtime, timestamp; ad hoc for a local preview) and the app's signing leaves it alone, because signing rewrites a binary and re-signing is not repeatable; the manifest holds the hash of the final bytes. A local preview now signs through osx-sign ad hoc, so it skips the helper too. The packager checks the helper's signature, authority, runtime flag and hash after signing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stage K3 of the built-in call relay (docs/design/2026-10-28-built-in-relay.md, 1.2 and 7). Every desktop package carries
spry-nodefrom the spry-turn 0.4.0 release. Still hidden: nothing starts it; K4 moves the supervisor onto it.Contents/Resources/spry/spry-node, outside the asar, Developer ID + hardened runtime + timestampresources\spry\spry-node.exe(unsigned, like the app)resources/spry/spry-node, 0755/opt/KithMoot/resources/spry/spry-node, root, 0755, no setuid (the AppArmor profile is unconfined, so no change there)How
desktop/scripts/spry-release.jsonpins each archive and itsspry-nodeby SHA-256 (taken from the published release; the release'sSHA256SUMSchecked first).desktop/scripts/spry-helper.mjsdownloads an archive once intoartifacts/spry/downloads, checks both hashes every build, and extracts onlyspry-node, afresh each time. No runtime download.spry-manifest.jsoninto the app with the helper's hash per platform.desktop/spry-bundle.mjsgives K4's supervisor the helper's path only while its bytes match, so a helper replaced in a user-writable install is refused.ignores it; the manifest holds the final bytes' hash. Local previews now sign through osx-sign ad hoc for the same reason (previouslycodesign --deep, which would re-sign the helper). After signing, the packager checks the bundle (--deep --strict), the helper's own signature, its Developer ID authority and runtime flag, and its hash.Checks
node --test desktop/test/spry-bundle.test.mjs desktop/test/linux-package.test.mjs: 15 pass (path per platform; manifest shape and missing platform refused; mismatched or missing helper refused; staging fetches once, checks archive and binary hashes, extracts onlyspry-nodeafresh; tampered archive or binary refused; the checked-in pin covers all four platforms).package:linux(tarballs and debs),package:windows, and a local-previewpackage:macall build;dpkg -cshows the helper root-owned 0755; the manifest inside the app's asar equals the bundled helper's hash;verifiedHelperpasses against the packaged app; the bundled helper launches.package:macwith the helper inside was accepted by Apple notarisation, stapled, and Gatekeeper accepts the app (source=Notarized Developer ID); the helper launches from the notarised bundle.Release cost: each archive grows by one helper (about 4 to 5 MB uncompressed). The next desktop release ships it; nothing changes for users until K5.
https://claude.ai/code/session_01P4tkjt9pRAySng1JJnHn9t