rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Stop macOS agent updates from spawning BTM entries

Browse Source 
Unsigned darwin release tarballs replaced the Developer ID
binary on each auto-update, so Background Task Management
treated every release as a new identity and showed the generic
executable icon. Sign those archives with a stable identifier,
refuse signature downgrades, and attribute daemon/tray jobs to
Probo Agent.app via AssociatedBundleIdentifiers.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
2026-07-30 10:43:27 +02:00
parent 0a61bea40c
commit 5e63e193cd
10 changed files with 450 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
pkg/deviceagent/service/service_darwin.go
View File

@@ -21,6 +21,7 @@
package service
import (
_ "embed"
"encoding/xml"
"errors"
"fmt"
@@ -39,35 +40,14 @@ const (
helperBinaryPath = "/Library/PrivilegedHelperTools/" + helperLabel
)
const launchdPlistTmpl = `<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>{{xml .Label}}</string>
<key>ProgramArguments</key>
<array>
<string>{{xml .ExePath}}</string>
<string>run</string>
<string>--dir</string>
<string>{{xml .Dir}}</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>KeepAlive</key>
<true/>
<key>StandardOutPath</key>
<string>/var/log/probo-agent.log</string>
<key>StandardErrorPath</key>
<string>/var/log/probo-agent.log</string>
<key>UserName</key>
<string>root</string>
<key>GroupName</key>
<string>wheel</string>
</dict>
</plist>
`
var (
//go:embed launchd.plist.tmpl
launchdPlistTmpl string
launchdPlist = template.Must(
template.New("plist").Funcs(template.FuncMap{"xml": xmlEscape}).Parse(launchdPlistTmpl),
)
)
func xmlEscape(v string) (string, error) {
var sb strings.Builder
@@ -126,11 +106,6 @@ func Install(cfg Config) error {
cfg.Label = DefaultLabel
}
tmpl, err := template.New("plist").Funcs(template.FuncMap{"xml": xmlEscape}).Parse(launchdPlistTmpl)
if err != nil {
return fmt.Errorf("cannot parse plist template: %w", err)
}
if err := os.MkdirAll(filepath.Dir(plistPath), 0o755); err != nil {
return fmt.Errorf("cannot ensure launch daemons directory: %w", err)
}
@@ -142,7 +117,7 @@ func Install(cfg Config) error {
defer func() { _ = f.Close() }()
if err := tmpl.Execute(f, cfg); err != nil {
if err := launchdPlist.Execute(f, cfg); err != nil {
return fmt.Errorf("cannot render plist: %w", err)
}