[akshaymaloo]

Summary

Security-only replacement for the relevant part of #112. This branch is based directly on main and has no dependency on the animation changes.

• Replace unauthenticated helper message ports with bounded local sockets. Both endpoints verify the peer's kernel audit token, code-signing requirement, and executable path.
• Bind helper events to the authenticated section and wanted items; validate command sizes and geometry.
• Restrict release-note navigation to user-activated HTTPS links and use a content security policy and nonpersistent WebKit storage to block scripts and external resources.
• Pin Sparkle to the already-resolved 2.10.1 revision and checksum-verify release tooling instead of discovering executables in shared caches.
• Fail on Gatekeeper errors and verify the generated update's Ed25519 signature against the exported app's public key.
• Add regression tests and update helper/release documentation.

Validation

Independently validated this security-only branch on macOS 27.2 with Xcode 27.1:

• 9 helper IPC/protocol tests passed, including unauthorized sender/server rejection, copied-executable rejection, duplicate-listener protection, and event ownership checks.
• 9 release-note app cases passed (4 test functions, including a parameterized test), including real WebKit script/resource blocking. The app and both embedded helpers build successfully.
• 10 release checks passed, covering fail-closed pipeline behavior and real Ed25519 validation of matching, tampered, unsigned, and wrong-length update fixtures.
• bash -n scripts/release.sh and git diff --check passed.

Remaining validation

This is a draft. Helper startup/relaunch and IPC latency still need verification using an installed, signed build. Production Developer ID signing/notarization was not run; release orchestration uses offline test doubles and signature verification uses generated cryptographic fixtures.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[akshaymaloo]

I have read the CLA Document and I hereby sign the CLA

[fif7y]

Hey @akshaymaloo, thanks for this one too, there's a lot of care in it. I'd like to take part of it though, not all of it.

1- Release notes: happy to take the content security policy and the link policy as they are.
2- Release pipeline: the update signature check is great. Two things would break our next release though. Without the || true, spctl stops release.sh, because it rejects our stapled DMG with "no usable signature" (exit 3, the DMG isn't code-signed, that's expected). And the pin moves Sparkle from 2.9.6 to 2.10.1, which I'd rather do on its own once I've tested it.
3- Helper sockets: I'll pass on these. Only an unsandboxed app running as the same user can reach the message ports, and that app could already rewrite Dimble's settings or quit it. The sockets also live in $TMPDIR, which macOS cleans after 3 days, and the signature check fails under the debugger. The size checks on the messages are worth keeping though.

Could you open a smaller PR against roster with 1, 2 (without the spctl change and the Sparkle bump) and the message checks? I'll close this one then.

[akshaymaloo]

Thanks for the detailed review. Opened the smaller replacement against roster: #117

It keeps the release-note policies, update-signature verification, and bounded message validation. CFMessagePort remains in place; there are no helper socket/signature/path changes. project.yml is unchanged, and the original nonfatal spctl behavior is preserved. Signing-tool discovery is also unchanged.

Validated with Sparkle 2.9.6: 6 helper-message tests, 9 release-note app cases, and 8 release/signature checks pass. The release regression explicitly exercises spctl exit 3 and confirms that invalid update signatures still fail.

Leaving this PR open for you to close in favor of the replacement, as requested.

[fif7y]

Closing this one in favor of #117, thanks again @akshaymaloo!