apply suggestions from code review

[deploy]

Author: overheadhunter

src/main/java/org/cryptomator/macos/update/DmgUpdateMechanism.java

@@ -48,23 +48,48 @@ public UpdateStep secondStep(Path workDir, Path assetPath, DownloadUpdateInfo up
 
 	private UpdateStep unpack(Path workDir, Path assetPath) throws IOException {
 		// Extract Cryptomator.app from the .dmg file
-		String script = """
-					hdiutil attach "${DMG_PATH}" -mountpoint "/Volumes/Cryptomator_${MOUNT_ID}" -nobrowse -quiet &&
-					cp -R "/Volumes/Cryptomator_${MOUNT_ID}/Cryptomator.app" 'Cryptomator.app' &&
-					hdiutil detach "/Volumes/Cryptomator_${MOUNT_ID}" -quiet
-					""";
-		var command = List.of("/bin/zsh", "-c", script);
-		var processBuilder = new ProcessBuilder(command);
+		var processBuilder = new ProcessBuilder(List.of("/bin/zsh", "-s"));
 		processBuilder.directory(workDir.toFile());
 		processBuilder.environment().put("DMG_PATH", assetPath.toString());
 		processBuilder.environment().put("MOUNT_ID", UUID.randomUUID().toString());
 		Process p = processBuilder.start();
 		try {
+			try (var stdin = p.outputWriter()) {
+				stdin.write("""
+						trap 'hdiutil detach "/Volumes/Cryptomator_${MOUNT_ID}" -quiet || true' EXIT
+						hdiutil attach "${DMG_PATH}" -mountpoint "/Volumes/Cryptomator_${MOUNT_ID}" -nobrowse -quiet
+						cp -R "/Volumes/Cryptomator_${MOUNT_ID}/Cryptomator.app" 'Cryptomator.app'
+						""");
+			}
 			if (p.waitFor() != 0) {
 				LOG.error("Failed to extract DMG, exit code: {}, output: {}", p.exitValue(), new String(p.getErrorStream().readAllBytes()));
 				throw new IOException("Failed to extract DMG, exit code: " + p.exitValue());
 			}
-			LOG.debug("Update ready: {}", workDir.resolve("Cryptomator.app"));
+			LOG.debug("Unpacked app: {}", workDir.resolve("Cryptomator.app"));
+		} catch (InterruptedException e) {
+			Thread.currentThread().interrupt();
+			throw new InterruptedIOException("Failed to extract DMG, interrupted");
+		}
+		return UpdateStep.of(Localization.get().getString("org.cryptomator.macos.update.dmg.verifying"), () -> this.verify(workDir, assetPath));
+	}
+
+	private UpdateStep verify(Path workDir, Path assetPath) throws IOException {
+		// Verify code signature of the extracted .app
+		var processBuilder = new ProcessBuilder(List.of("/bin/zsh", "-s"));
+		processBuilder.directory(workDir.toFile());
+		Process p = processBuilder.start();
+		try {
+			try (var stdin = p.outputWriter()) {
+				stdin.write("""
+						codesign --verify --deep --strict 'Cryptomator.app'
+						spctl --assess --type execute 'Cryptomator.app'
+						""");
+			}
+			if (p.waitFor() != 0) {
+				LOG.error("Checking code signature failed: {}, output: {}", p.exitValue(), new String(p.getErrorStream().readAllBytes()));
+				throw new UpdateFailedException("Invalid Code Signature.");
+			}
+			LOG.debug("Verified app: {}", workDir.resolve("Cryptomator.app"));
 		} catch (InterruptedException e) {
 			Thread.currentThread().interrupt();
 			throw new InterruptedIOException("Failed to extract DMG, interrupted");
@@ -84,14 +109,14 @@ public UpdateStep restart(Path workDir) throws IllegalStateException, IOExceptio
 		}
 		LOG.info("Restarting to apply Update in {} now...", workDir);
 		String script = """
-					while kill -0 ${CRYPTOMATOR_PID} 2> /dev/null; do sleep 0.2; done;
-					if [ -d "${CRYPTOMATOR_INSTALL_PATH}" ]; then
-					  echo "Removing old installation at ${CRYPTOMATOR_INSTALL_PATH}";
-					  rm -rf "${CRYPTOMATOR_INSTALL_PATH}"
-					fi
-					mv 'Cryptomator.app' "${CRYPTOMATOR_INSTALL_PATH}";
-					open "${CRYPTOMATOR_INSTALL_PATH}";
-					""";
+				while kill -0 ${CRYPTOMATOR_PID} 2> /dev/null; do sleep 0.2; done;
+				if [ -d "${CRYPTOMATOR_INSTALL_PATH}" ]; then
+				  echo "Removing old installation at ${CRYPTOMATOR_INSTALL_PATH}";
+				  rm -rf "${CRYPTOMATOR_INSTALL_PATH}"
+				fi
+				mv 'Cryptomator.app' "${CRYPTOMATOR_INSTALL_PATH}";
+				open "${CRYPTOMATOR_INSTALL_PATH}";
+				""";
 		Files.writeString(workDir.resolve("install.sh"), script, StandardCharsets.US_ASCII, StandardOpenOption.WRITE, StandardOpenOption.CREATE_NEW);
 		var command = List.of("/bin/zsh", "-c", "/usr/bin/nohup zsh install.sh >install.log 2>&1 &");
 		var processBuilder = new ProcessBuilder(command);

src/main/resources/MacIntegrationsBundle.properties

@@ -2,4 +2,5 @@ org.cryptomator.macos.keychain.displayName=macOS Keychain
 org.cryptomator.macos.keychain.touchIdDisplayName=Touch ID
 org.cryptomator.macos.update.dmg.displayName=Download .dmg file
 org.cryptomator.macos.update.dmg.unpacking=Unpacking...
+org.cryptomator.macos.update.dmg.verifying=Verifying...
 org.cryptomator.macos.update.dmg.restarting=Restarting...