41 lines
2.1 KiB
Bash
Executable File
41 lines
2.1 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
PROJECT="$ROOT/Rsync Studio.xcodeproj"
|
|
|
|
echo "== Rsync Studio project security checks =="
|
|
grep -q 'ENABLE_HARDENED_RUNTIME = YES' "$PROJECT/project.pbxproj"
|
|
grep -q 'ENABLE_APP_SANDBOX = NO' "$PROJECT/project.pbxproj"
|
|
grep -q 'INFOPLIST_KEY_CFBundleIconName = AppIcon' "$PROJECT/project.pbxproj"
|
|
test -f "$ROOT/Rsync Studio/Resources/PrivacyInfo.xcprivacy"
|
|
|
|
if grep -R --line-number -E 'StrictHostKeyChecking[ =]+no|UserKnownHostsFile[ =]+/dev/null|sshpass' "$ROOT/Rsync Studio" --include='*.swift'; then
|
|
echo "Unsafe SSH configuration detected." >&2
|
|
exit 1
|
|
fi
|
|
|
|
grep -q 'BatchMode=yes' "$ROOT/Rsync Studio/Services/RsyncCommandBuilder.swift"
|
|
grep -q 'allowUnattendedDelete' "$ROOT/Rsync Studio/Models/SyncJob.swift"
|
|
grep -q 'RsyncSecurityValidator' "$ROOT/Rsync Studio/Services/RsyncCommandBuilder.swift"
|
|
grep -q 'isSafeRemotePath' "$ROOT/Rsync Studio/Services/RsyncCommandBuilder.swift"
|
|
grep -q 'hasBalancedShellSyntax' "$ROOT/Rsync Studio/Services/RsyncCommandBuilder.swift"
|
|
grep -q -- '--files-from' "$ROOT/Rsync Studio/Services/RsyncCommandBuilder.swift"
|
|
grep -q -- '--log-file' "$ROOT/Rsync Studio/Services/RsyncCommandBuilder.swift"
|
|
|
|
grep -q 'final class LicensingManager' "$ROOT/Rsync Studio/Services/LicensingManager.swift"
|
|
grep -q 'trialLengthDays = 30' "$ROOT/Rsync Studio/Services/LicensingManager.swift"
|
|
grep -q 'Curve25519.Signing.PublicKey' "$ROOT/Rsync Studio/Services/LicensingManager.swift"
|
|
grep -q 'RsyncStudioLicensePublicKey' "$PROJECT/project.pbxproj"
|
|
if find "$ROOT" -type f \( -iname '*private*key*' -o -iname '*.p8' \) ! -path '*/build/*' | grep -q .; then
|
|
echo "A private signing key appears to be present in the project tree." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Static policy checks passed."
|
|
echo ""
|
|
echo "After creating a signed Release app, also run:"
|
|
echo " codesign --verify --deep --strict --verbose=2 /path/to/Rsync Studio.app"
|
|
echo " spctl --assess --type execute --verbose=4 /path/to/Rsync Studio.app"
|
|
echo " xcrun stapler validate /path/to/Rsync Studio.app"
|