37 lines
2.0 KiB
Markdown
37 lines
2.0 KiB
Markdown
# Rsync Studio — Security / Release Audit
|
|
|
|
This project targets direct macOS distribution using Developer ID signing and Apple notarisation. App Sandbox is intentionally disabled because the product launches `rsync`/SSH and operates on arbitrary user-configured filesystem paths.
|
|
|
|
## Security controls present
|
|
|
|
- Hardened Runtime enabled for Debug and Release target configurations.
|
|
- No shell (`/bin/sh -c`) command construction; `Process` uses an absolute executable path and argument array.
|
|
- SSH host-key checking is not disabled.
|
|
- Automated SSH uses BatchMode, timeout and keepalive limits.
|
|
- SSH password authentication/storage is not supported; legacy stored password data is deleted.
|
|
- Remote host, username, port, key path and remote destination are validated.
|
|
- Remote paths reject shell metacharacters before rsync can invoke the remote shell.
|
|
- Advanced arguments reject transport replacement, remote-command, credential, arbitrary list/log/batch path and destructive overrides.
|
|
- Malformed Advanced argument quoting/trailing escapes are rejected.
|
|
- `--` terminates rsync option parsing before source/destination operands.
|
|
- Local source/destination overlap is rejected.
|
|
- File-watch and exclusion values reject control characters.
|
|
- Scheduled/watch delete requires explicit per-job authorisation.
|
|
- Run logs are ANSI-cleaned, likely credentials redacted and size-capped before persistence.
|
|
- Run history has bounded retention.
|
|
- Privacy manifest declares no tracking/no collected data and the app-specific UserDefaults required reason.
|
|
- Launch at login uses `SMAppService` and remains user-controlled.
|
|
- No analytics/telemetry or application HTTP client code is present.
|
|
|
|
## Required release verification on a Mac
|
|
|
|
Run:
|
|
|
|
```bash
|
|
./Scripts/release-preflight.sh
|
|
```
|
|
|
|
Then archive with Developer ID, submit with Apple `notarytool` (or Xcode Organizer), staple the ticket and run the signature/Gatekeeper checks in `Docs/RELEASE.md`.
|
|
|
|
A Linux source audit cannot substitute for Xcode's macOS SDK typecheck, code signing, notarisation or Gatekeeper assessment.
|