docs(security): record that removal and the unsigned fallback were exercised - #152
Merged
Merged
Conversation
…ercised SECURITY.md said "Removing the helper from the UI has not been exercised, and neither has the fallback an unsigned build takes." Both were exercised on 2026-08-19 while closing #71, so the paragraph understated what is known about the shipped build. Removal was sampled at 5 Hz across the click. SleepDisabled returned to 0 at one sample while the helper process was still running, and the helper was gone at the next. Zero samples showed the hold set with the helper already gone, which is the stranding failure the documented order exists to prevent. That is positive evidence rather than an absence: the sampler caught the released state while the helper still ran, which a missed transient cannot manufacture. The unsigned fallback was exercised the same day on the same Mac. A bundle presenting TeamIdentifier=not set offered no arming control and named the sudo route instead, which is the degrade path #71 required. The limits are stated with the claim, in the same terms the paragraph above uses for the arm round trip: one run, one Mac, one date, and no test here re-runs either, because one needs a signed bundle plus a hand-approved registration and the other needs an unsigned one. Also recorded: macOS keeps the app's entry in Login Items and Extensions after removal, because the helper's plist ships inside the bundle. Removal retires the registration rather than erasing the record of it, and anything claiming the item leaves that pane is wrong. Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SECURITY.mdsaid removal from the UI and the unsigned-build fallback had not been exercised. Both were, on 2026-08-19, while closing #71. The paragraph understated what is known about the shipped build, in the one file a security-minded reader opens first.Removal was sampled at 5 Hz across the click:
SleepDisabledreturned to 0 while the helper process was still running, and the helper was gone one sample later. Zero samples showed the hold set with the helper already gone. That is positive evidence rather than an absence, since the sampler caught the released state while the helper still ran, which a missed transient cannot manufacture.The unsigned fallback was exercised the same day: a bundle presenting
TeamIdentifier=not setoffered no arming control and named thesudoroute instead.The limits travel with the claim, in the same terms the paragraph above already uses for the arm round trip: one run, one Mac, one date, and no test here re-runs either.
Also recorded, because it contradicts what the release checklist assumed: macOS keeps the app's entry in Login Items and Extensions after removal, since the helper's plist ships inside the bundle.
sfltool dumpbtmstill carries the daemon record afterwards. Removal retires the registration rather than erasing the record of it.Testing done
swift testrc=0, 1239 tests in 12 suites, one pre-existing known issue.Breaking changes
None. Documentation only.