Dependabot's workflow is set up in such a way it seems that it can't
find our `sha.exs` file.
This is a cleaner approach that doesn't rely on using external files for
the application version.
Interesting note: `mix compile` will happily use the cached `version`
even though it's computed from an env var, because `mix compile` uses
file hash and mtime to know when to recompile.
See https://github.com/firezone/firezone/network/updates/942719116
Bumps the tauri group in /rust with 1 update:
[tauri](https://github.com/tauri-apps/tauri).
Updates `tauri` from 2.2.1 to 2.2.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tauri-apps/tauri/releases">tauri's
releases</a>.</em></p>
<blockquote>
<h2>tauri-cli v2.2.2</h2>
<!-- raw HTML omitted -->
<pre><code>Updating git repository
`https://github.com/tauri-apps/schemars.git`
Updating crates.io index
Locking 1041 packages to latest compatible versions
Adding apple-codesign v0.27.0 (available: v0.29.0)
Adding axum v0.7.9 (available: v0.8.1)
Adding cargo_toml v0.17.2 (available: v0.21.0)
Adding html5ever v0.26.0 (available: v0.29.0)
Adding hyper v0.14.32 (available: v1.5.2)
Adding itertools v0.13.0 (available: v0.14.0)
Adding minisign v0.7.3 (available: v0.7.9)
Adding oxc_allocator v0.36.0 (available: v0.44.0)
Adding oxc_ast v0.36.0 (available: v0.44.0)
Adding oxc_parser v0.36.0 (available: v0.44.0)
Adding oxc_span v0.36.0 (available: v0.44.0)
Adding proc-macro-crate v2.0.0 (available: v2.0.2)
Adding serialize-to-javascript v0.1.1 (available: v0.1.2)
Adding serialize-to-javascript-impl v0.1.1 (available: v0.1.2)
Adding tauri-utils v1.6.0 (available: v1.6.1)
Adding tiny_http v0.11.0 (available: v0.12.0)
Adding x509-certificate v0.23.1 (available: v0.24.0)
Fetching advisory database from
`https://github.com/RustSec/advisory-db.git`
Loaded 724 security advisories (from /home/runner/.cargo/advisory-db)
Updating crates.io index
Scanning Cargo.lock for vulnerabilities (1066 crate dependencies)
Crate: atk
Version: 0.18.2
Warning: unmaintained
Title: gtk-rs GTK3 bindings - no longer maintained
Date: 2024-03-04
ID: RUSTSEC-2024-0413
URL: https://rustsec.org/advisories/RUSTSEC-2024-0413
Dependency tree:
atk 0.18.2
└── gtk 0.18.2
├── wry 0.48.0
│ └── tauri-runtime-wry 2.3.0
│ └── tauri 2.2.0
│ ├── tauri-plugin-sample 0.1.0
│ │ └── api 0.1.0
│ ├── tauri-plugin-log 2.2.0
│ │ └── api 0.1.0
│ ├── tauri-file-associations-demo 0.1.0
│ ├── tauri 2.2.0
│ ├── restart 0.1.0
│ ├── resources 0.1.0
</tr></table>
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4c3f047735"><code>4c3f047</code></a>
Apply Version Updates From Current Changes (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/12377">#12377</a>)</li>
<li><a
href="61e69db9e4"><code>61e69db</code></a>
chore: Add changefile for <a
href="https://redirect.github.com/tauri-apps/tauri/issues/12371">#12371</a>
(<a
href="https://redirect.github.com/tauri-apps/tauri/issues/12376">#12376</a>)</li>
<li><a
href="75d56e8364"><code>75d56e8</code></a>
fix: fix Specta integration (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/12371">#12371</a>)</li>
<li><a
href="a8aca70151"><code>a8aca70</code></a>
Apply Version Updates From Current Changes (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/12355">#12355</a>)</li>
<li><a
href="cad5504455"><code>cad5504</code></a>
fix(cli): Fix npm package name in <code>tauri add</code> (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/12354">#12354</a>)</li>
<li><a
href="f8e50e8e5b"><code>f8e50e8</code></a>
chore(deps): update rust crate tauri-winres to 0.2 (dev) (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/12341">#12341</a>)</li>
<li><a
href="cfe1af2848"><code>cfe1af2</code></a>
chore(deps): update rust crate notify to v8 (dev) (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/12342">#12342</a>)</li>
<li>See full diff in <a
href="https://github.com/tauri-apps/tauri/compare/tauri-v2.2.1...tauri-v2.2.2">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [env_logger](https://github.com/rust-cli/env_logger) from 0.11.5
to 0.11.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/rust-cli/env_logger/releases">env_logger's
releases</a>.</em></p>
<blockquote>
<h2>v0.11.6</h2>
<h2>[0.11.6] - 2024-12-20</h2>
<h3>Features</h3>
<ul>
<li>Opt-in file and line rendering</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/rust-cli/env_logger/blob/main/CHANGELOG.md">env_logger's
changelog</a>.</em></p>
<blockquote>
<h2>[0.11.6] - 2024-12-20</h2>
<h3>Features</h3>
<ul>
<li>Opt-in file and line rendering</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="dc1a01a797"><code>dc1a01a</code></a>
chore: Release</li>
<li><a
href="65f81b3b6b"><code>65f81b3</code></a>
docs: Update changelog</li>
<li><a
href="77425992f6"><code>7742599</code></a>
Merge pull request <a
href="https://redirect.github.com/rust-cli/env_logger/issues/345">#345</a>
from EriKWDev/main</li>
<li><a
href="59229bce53"><code>59229bc</code></a>
fix: Test result of everything enabled has changed</li>
<li><a
href="b0d4760955"><code>b0d4760</code></a>
spelling + field names</li>
<li><a
href="1bad1f59d7"><code>1bad1f5</code></a>
feature: ability to display source file path and line number with
default for...</li>
<li><a
href="cc97bf76e3"><code>cc97bf7</code></a>
chore(deps): Update Rust Stable to v1.83 (<a
href="https://redirect.github.com/rust-cli/env_logger/issues/343">#343</a>)</li>
<li><a
href="240cd21de5"><code>240cd21</code></a>
style: Make clippy happy</li>
<li><a
href="da7ff82259"><code>da7ff82</code></a>
chore: Update from _rust template</li>
<li><a
href="ab1d854945"><code>ab1d854</code></a>
chore(deps): Update Rust crate snapbox to v0.6.20 (<a
href="https://redirect.github.com/rust-cli/env_logger/issues/342">#342</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/rust-cli/env_logger/compare/v0.11.5...v0.11.6">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
We introduced a regression in `connlib` in #7749 whereby queued but
unsent datagrams got dropped in case the socket was not ready to send
more data.
This happens because within `Io`, we pull each datagram one by one from
the iterator:
e60ec7144c/rust/connlib/tunnel/src/io.rs (L178-L188)
This function will send datagrams for as long as the socket is ready and
drop the iterator afterwards. This means the returned iterator MUST BE
lazy and "cancel-safe". This was the case prior to #7749 because
`datagrams` function used `iter_mut` and only cut off the to be sent
bytes when the next item got pulled from iterator. With #7749, the
entire `HashMap` got drained, thus dropping packets if `Io` didn't
manage to process the iterator in full.
When starting a Task, by default it's launched with the same priority as
the calling code.
In the UI these are run on the `MainActor` with highest priority by
default. If the worker thread running the Task closure gets blocked, it
will cause the UI to hang.
To fix this, we use `Task.detached` which runs the closure without a
specific priority, which is lower than the UI thread.
Furthermore, `weak self` is used to prevent retain cycles if the parent
thread `deinit`s.
This was causing an issue primarily when making IPC calls because those
will sometimes hang until the XPC service is launched for the first
time.
---------
Signed-off-by: Jamil <jamilbk@users.noreply.github.com>
Bumps [keyring](https://github.com/hwchen/keyring-rs) from 3.4.0 to
3.6.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/hwchen/keyring-rs/releases">keyring's
releases</a>.</em></p>
<blockquote>
<h2>v3.6.1: Update dependencies</h2>
<p>Two of the dependencies (<code>openssl</code> and
<code>whoami</code>) were discovered to have vulnerabilities which were
fixed in minor or patch releases. This crate has been updated to insist
that the minor/patch release number of these dependencies is high enough
to ensure use of a patched version.</p>
<p>There is no reason to think that the vulnerabilities in these
dependencies could have been exercised through this crate. In addition,
builds of clients done after the dependencies were patched would have
already picked up the non-vulnerable versions. So this change is simply
to ensure that future builds cannot use the vulnerable versions.</p>
<p>There are no code changes in this release.</p>
<h2>v3.6.0: Add new combination keystore</h2>
<p>This release contains a new credential store for Linux: a combination
of keyutils (for use by headless processes) and secret service (for
persistence of credentials beyond reboot). Thanks very much to <a
href="https://github.com/soywod"><code>@soywod</code></a> for the
contribution!</p>
<h2>v3.5.0: Add debug logging of internal operations</h2>
<ul>
<li>Add debug logging of internal operations (thanks to <a
href="https://github.com/soywod"><code>@soywod</code></a>).</li>
<li>Revert iOS security-framework dependency to v2 (see <a
href="https://redirect.github.com/hwchen/keyring-rs/issues/225">#225</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/hwchen/keyring-rs/blob/master/CHANGELOG.md">keyring's
changelog</a>.</em></p>
<blockquote>
<h2>Version 3.6.0</h2>
<ul>
<li>Add combination keystore of keyutils and secret service (thanks to
<a href="https://github.com/soywod"><code>@soywod</code></a>).</li>
</ul>
<h2>Version 3.5.0</h2>
<ul>
<li>Add debug logging of internal operations (thanks to <a
href="https://github.com/soywod"><code>@soywod</code></a>).</li>
<li>Revert iOS security-framework dependency to v2 (see <a
href="https://redirect.github.com/hwchen/keyring-rs/issues/225">#225</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="779dfe0dc3"><code>779dfe0</code></a>
Merge pull request <a
href="https://redirect.github.com/hwchen/keyring-rs/issues/230">#230</a>
from brotskydotcom/master</li>
<li><a
href="2e646c888d"><code>2e646c8</code></a>
Bump version and update dependencies.</li>
<li><a
href="eb54c8085d"><code>eb54c80</code></a>
Merge pull request <a
href="https://redirect.github.com/hwchen/keyring-rs/issues/229">#229</a>
from brotskydotcom/master</li>
<li><a
href="f18c3115b7"><code>f18c311</code></a>
Bump version and update changelog.</li>
<li><a
href="2e2e9157ad"><code>2e2e915</code></a>
Merge pull request <a
href="https://redirect.github.com/hwchen/keyring-rs/issues/222">#222</a>
from soywod/secret-service-with-keyutils</li>
<li><a
href="f59afd50e4"><code>f59afd5</code></a>
Updated docs for new keystore.</li>
<li><a
href="658174ef99"><code>658174e</code></a>
Fix new clippy warning.</li>
<li><a
href="16236b85f9"><code>16236b8</code></a>
Merge remote-tracking branch 'upstream/master' into
secret-service-with-keyutils</li>
<li><a
href="6df3d93950"><code>6df3d93</code></a>
init doc + unit tests</li>
<li><a
href="9a4184ceac"><code>9a4184c</code></a>
Merge pull request <a
href="https://redirect.github.com/hwchen/keyring-rs/issues/226">#226</a>
from brotskydotcom/release-3.5</li>
<li>Additional commits viewable in <a
href="https://github.com/hwchen/keyring-rs/compare/v3.4.0...v3.6.1">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
After reading through this [Apple technical
note](https://developer.apple.com/documentation/technotes/tn3137-on-mac-keychains),
it's clear that we want to actually omit this key from our keychain
queries.
The reason is because:
- on iOS, this will be already set (there is no other option)
- on macOS, the data protection keychain is *unavailable* from system
extensions
After testing, it appears that the original issue that PR sought to fix
was actually fixed by always installing the correct system extension
version: #7759.
Reverts firezone/firezone#7756
When building / testing the Apple clients locally, OS code signing and
security requirements can cause certain types of errors to throw.
We still want to see these in the console, but not necessary capture
them to Sentry.
Why:
* An IdP sync can fail for different reasons and because of this we
previously put a threshold on when to send the first 'IdP sync failed'
email, which was set at 10 failed sync attempts. One thing that was
accidentally overlooked was that on one specific failure type (i.e. 401
- Unauthorized) the Firezone sync was automatically disabled and not
tried from that point forward. Unfortunately, that meant an email did
not get sent out because the threshold was not met. This PR resolves
that by making sure the 401 error will send out an email immediately,
while keeping the 10 failed sync threshold for all other errors.
Closes: #7725
In #7758, we fix `connlib`s event-loop to always provide the current
time to the state machine rather than the one that was requested (which
may be in the past). Even though this is already fairly resilient, we
should never request a time in the past.
This patch adds this as an assertion to our test suite.
On a high level, `connlib` is a state machine that gets driven by a
custom event-loop. For time-related actions, the state machine computes,
when it would like to be woken next. The event-loop sets a timer for
that value and emits this value when the timer fires.
There is an edge-case where this may result in the time going backwards
within the state machine. Specifically, if - for whatever reason - the
state machine emits a time value that is in the past, the timer in the
`Io` component will fire right away **but the `deadline` will point to
the time in the past**.
The only thing we are actually interested in is that the timer fires at
all. Instead of passing back the deadline of the timer, we fetch the
_current_ time and pass that back to the state machine as the current
input. This ensures that we never jump back in time because Rust
guarantees for calls to `Instant::now` to be monotonic.
(https://doc.rust-lang.org/std/time/struct.Instant.html#:~:text=a%20measurement%20of%20a%20monotonically%20nondecreasing%20clock.)
Bumps [socket2](https://github.com/rust-lang/socket2) from 0.5.7 to
0.5.8.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/rust-lang/socket2/blob/master/CHANGELOG.md">socket2's
changelog</a>.</em></p>
<blockquote>
<h1>0.5.8</h1>
<ul>
<li>Added <code>Socket::(set_)header_included_v4</code> and
<code>Socket::(set_)header_included_v6</code>
(<a
href="https://redirect.github.com/rust-lang/socket2/pull/518">rust-lang/socket2#518</a>).</li>
<li>Added support for <code>Socket::original_dst</code> and
<code>Socket::original_dst_ipv6</code> on Windows
(<a
href="https://redirect.github.com/rust-lang/socket2/pull/529">rust-lang/socket2#529</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/rust-lang/socket2/commits">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the tauri group in /rust with 2 updates:
[tauri](https://github.com/tauri-apps/tauri) and
[tauri-build](https://github.com/tauri-apps/tauri).
Updates `tauri` from 2.2.0 to 2.2.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tauri-apps/tauri/releases">tauri's
releases</a>.</em></p>
<blockquote>
<h2>tauri-cli v2.2.1</h2>
<!-- raw HTML omitted -->
<pre><code>Updating git repository
`https://github.com/tauri-apps/schemars.git`
Updating crates.io index
Locking 1040 packages to latest compatible versions
Adding apple-codesign v0.27.0 (available: v0.29.0)
Adding axum v0.7.9 (available: v0.8.1)
Adding cargo_toml v0.17.2 (available: v0.21.0)
Adding html5ever v0.26.0 (available: v0.29.0)
Adding hyper v0.14.32 (available: v1.5.2)
Adding itertools v0.13.0 (available: v0.14.0)
Adding minisign v0.7.3 (available: v0.7.9)
Adding oxc_allocator v0.36.0 (available: v0.44.0)
Adding oxc_ast v0.36.0 (available: v0.44.0)
Adding oxc_parser v0.36.0 (available: v0.44.0)
Adding oxc_span v0.36.0 (available: v0.44.0)
Adding proc-macro-crate v2.0.0 (available: v2.0.2)
Adding serialize-to-javascript v0.1.1 (available: v0.1.2)
Adding serialize-to-javascript-impl v0.1.1 (available: v0.1.2)
Adding tauri-utils v1.6.0 (available: v1.6.1)
Adding tiny_http v0.11.0 (available: v0.12.0)
Adding which v4.4.2 (available: v7.0.1)
Adding x509-certificate v0.23.1 (available: v0.24.0)
Fetching advisory database from
`https://github.com/RustSec/advisory-db.git`
Loaded 722 security advisories (from /home/runner/.cargo/advisory-db)
Updating crates.io index
Scanning Cargo.lock for vulnerabilities (1065 crate dependencies)
Crate: atk
Version: 0.18.2
Warning: unmaintained
Title: gtk-rs GTK3 bindings - no longer maintained
Date: 2024-03-04
ID: RUSTSEC-2024-0413
URL: https://rustsec.org/advisories/RUSTSEC-2024-0413
Dependency tree:
atk 0.18.2
└── gtk 0.18.2
├── wry 0.48.0
│ └── tauri-runtime-wry 2.3.0
│ └── tauri 2.2.0
│ ├── tauri-plugin-sample 0.1.0
│ │ └── api 0.1.0
│ ├── tauri-plugin-log 2.2.0
│ │ └── api 0.1.0
│ ├── tauri-file-associations-demo 0.1.0
│ ├── tauri 2.2.0
│ ├── restart 0.1.0
</tr></table>
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="89c6f08e82"><code>89c6f08</code></a>
Apply Version Updates From Current Changes (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/12218">#12218</a>)</li>
<li><a
href="cde0ff7798"><code>cde0ff7</code></a>
chore: Fix clippy 1.84 warnings (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/12328">#12328</a>)</li>
<li><a
href="b0d7527250"><code>b0d7527</code></a>
chore(deps): update rust crate windows-registry to 0.4 (dev) (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/12301">#12301</a>)</li>
<li><a
href="a28b5013c5"><code>a28b501</code></a>
chore(deps): update rust crate ico to 0.4 (dev) (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/12298">#12298</a>)</li>
<li><a
href="b9a99a5c69"><code>b9a99a5</code></a>
fix(cli): Skip File Access events in dev server (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/12297">#12297</a>)</li>
<li><a
href="98f62e65a2"><code>98f62e6</code></a>
fix(cli): <code>tauri add</code> NPM packages for community plugins (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/12246">#12246</a>)</li>
<li><a
href="c130af6b06"><code>c130af6</code></a>
chore(deps): update dependency rollup to v4.30.1 (dev) (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/12291">#12291</a>)</li>
<li><a
href="ef21ed9ac1"><code>ef21ed9</code></a>
fix(cli): iOS build crashing when development team has spaces (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/12290">#12290</a>)</li>
<li><a
href="cd1d026f97"><code>cd1d026</code></a>
fix: fails to build if the project path contains glob characters (<a
href="https://redirect.github.com/tauri-apps/tauri/issues/11961">#11961</a>)</li>
<li><a
href="848d0e060e"><code>848d0e0</code></a>
chore(deps): update cargo_toml for edition 2024 [fix <a
href="https://redirect.github.com/tauri-apps/tauri/issues/10412">#10412</a>]
(<a
href="https://redirect.github.com/tauri-apps/tauri/issues/12270">#12270</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/tauri-apps/tauri/compare/tauri-v2.2.0...tauri-v2.2.1">compare
view</a></li>
</ul>
</details>
<br />
Updates `tauri-build` from 2.0.4 to 2.0.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tauri-apps/tauri/releases">tauri-build's
releases</a>.</em></p>
<blockquote>
<h2>tauri-build v2.0.5</h2>
<!-- raw HTML omitted -->
<pre><code>Updating git repository
`https://github.com/tauri-apps/schemars.git`
Updating crates.io index
Locking 1051 packages to latest compatible versions
Adding apple-codesign v0.27.0 (available: v0.29.0)
Adding axum v0.7.9 (available: v0.8.1)
Adding colored v2.2.0 (available: v3.0.0)
Adding html5ever v0.26.0 (available: v0.29.0)
Adding itertools v0.13.0 (available: v0.14.0)
Adding minisign v0.7.3 (available: v0.7.9)
Adding notify v7.0.0 (available: v8.0.0)
Adding notify-debouncer-full v0.4.0 (available: v0.5.0)
Adding oxc_allocator v0.36.0 (available: v0.44.0)
Adding oxc_ast v0.36.0 (available: v0.44.0)
Adding oxc_parser v0.36.0 (available: v0.44.0)
Adding oxc_span v0.36.0 (available: v0.44.0)
Adding proc-macro-crate v2.0.0 (available: v2.0.2)
Adding serialize-to-javascript v0.1.1 (available: v0.1.2)
Adding serialize-to-javascript-impl v0.1.1 (available: v0.1.2)
Adding specta v2.0.0-rc.20 (available: v2.0.0-rc.21)
Adding specta-macros v2.0.0-rc.17 (available: v2.0.0-rc.18)
Adding specta-util v0.0.7 (available: v0.0.8)
Adding tauri-utils v1.6.0 (available: v1.6.1)
Adding tiny_http v0.11.0 (available: v0.12.0)
Adding windows v0.58.0 (available: v0.59.0)
Adding x509-certificate v0.23.1 (available: v0.24.0)
Fetching advisory database from
`https://github.com/RustSec/advisory-db.git`
Loaded 724 security advisories (from /home/runner/.cargo/advisory-db)
Updating crates.io index
Scanning Cargo.lock for vulnerabilities (1076 crate dependencies)
Crate: atk
Version: 0.18.2
Warning: unmaintained
Title: gtk-rs GTK3 bindings - no longer maintained
Date: 2024-03-04
ID: RUSTSEC-2024-0413
URL: https://rustsec.org/advisories/RUSTSEC-2024-0413
Dependency tree:
atk 0.18.2
└── gtk 0.18.2
├── wry 0.48.0
│ └── tauri-runtime-wry 2.3.0
│ └── tauri 2.2.1
│ ├── tauri-plugin-sample 0.1.0
│ │ └── api 0.1.0
│ ├── tauri-plugin-log 2.2.0
</tr></table>
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/tauri-apps/tauri/compare/tauri-build-v2.0.4...tauri-build-v2.0.5">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
When a user launches the macOS app, we check if the system extension is
installed. If it was, we assumed it would function properly.
However, an older version of the extension can be installed from our
current app version, so we would erroneously consider the extension as
"installed" even though it needed to be updated.
To fix this, we introduced an enum for tracking the system extension
state with `installed`, `needsReplacement`, and `needsInstall` states.
These track whether the extension is up-to-date, needs upgrade (or
downgrade), or needs to be approved and enabled by the user altogether
respectively.
Importantly, this also gracefully handles downgrades, not just upgrades
since we already return a `.replace` action in our request callback that
the system calls when installing an extension with the same bundle ID as
one that exists.
This will force the macOS Keychain to behave like the iOS Keychain. To
be honest, Apple's documentation is very much lacking in this regard,
but some research suggests this is both heavily recommended by Apple and
that it enables the Keychain operation to benefit from Apple's security
hardware in their Macs.
In my local testing, it also seems to make keychain operations more
reliable when SIP is disabled, but that could be a fluke given the
number of variables at play.
https://developer.apple.com/documentation/security/ksecusedataprotectionkeychain
Draft because stacked.
This function is called from `PacketTunnelProvider.startTunnel`, which
already uses the `completionHandler` approach for returning to the
caller when the tunnel start operation is completed.
Thus `async / await` here is redundant and unnecessary.
The Keychain on Apple platforms, while secure, is not always available.
It can be unavailable if the user has changed its permissions
accidentally, the keychain database is corrupt, there is an issue with
the secure enclave, or any number of other system-related or Apple
account-related reasons.
There are only two things we use the Keychain for:
- Storing the `firezone-id`. This is actually not a secret.
- Persisting the `token` upon sign in so that:
- the iOS system can keep the tunnel alive without the GUI running
- the macOS app can relaunch after `Disconnect & Quit` without having to
sign in again
For the first case, we move back to persisting this to a file (see
#7464).
For the second case, we simply don't care too much if the Keychain can't
be saved to. We simply move on with activating the tunnel and logging
the error so we know how often these edge cases occur.
When `snownet` is tasked to establish a new connection, it first
randomly samples one of its relays that is used as an additional source
of candidates in case a direct connection is not possible. We (try to)
maintain an allocation on each relay throughout the lifetime of a
`connlib` session. In case a relay doesn't respond to the initial
binding message at all (even after several retries), we consider the
relay offline and remove all state associated to it.
It is possible that we sampled a relay for use in a connection and only
then realise that it is offline. In that case, we print a message to the
log:
> Selected relay disconnected during ICE; connection may fail
The condition for when we print this log is: "we are in `Connecting` and
the sampled relay does no longer exist". This results in log spam in
case that condition is actually hit because no state is being changed as
part of this check and thus, on the next call to `handle_timeout`, this
condition is still true!
To fix this, we change the `rid` field of `Connecting` to an `Option`.
In case we detect that a relay is no longer present, we print the log
and then clear the option. As a result, the log is only printed once.
Within `connlib`, we read batches of IP packets and process them at
once. Each encrypted packet is appended to a buffer shared with other
packets of the same length. Once the batch is successfully processed,
all of these buffers are written out using GSO to the network. This
allows UDP operations to be much more efficient because not every packet
has to traverse the entire syscall hierarchy of the operating system.
Until now, these buffers got re-allocated on every batch. This is pretty
wasteful and leads to a lot of repeated allocations. Measurements show
that most of the time, we only have a handful of packets with different
segments lengths _per batch_. For example, just booting up the
headless-client and running a speedtest showed that only 5 of these
buffers are were needed at one time.
By introducing a buffer pool, we can reuse these buffers between batches
and avoid reallocating them.
Related: #7747.
When a Firezone client roams, the host app sends a "reset" command to
`connlib`. At present, this "reset" command clears the network
connection state and therefore restarts ICE. As part of that, the tunnel
key also gets rotated yet which resources have already been authorized
is retained.
This isn't a problem per se because the client's identity is determined
by the "Firezone ID" which persists even across restarts of a Client.
For the Gateway however, a roamed Client and a restarted Client are
indistinguishable as in both cases, the tunnel public key and ICE
credentials change.
Instead of only clearing the connection-specific state, we now also
throw away all the ACL state that is associated with connections, i.e.
which Resource already got authorized on the Gateway. As a result - with
this change - Clients will emit another "connection intent" to the
portal upon roaming, triggering a new authorization of this flow with a
Gateway.
There isn't any particular need for doing this except that lingering
state can be a nasty source of bugs. With the now idempotent control
protocol, it is pretty easy to re-request these authorisations. Overall,
this makes `connlib` more resilient and easier to reason about.
We try to unit test on each major platform we support in CI to reduce
the possibility a specific OS has issues with our unit tests. Now that
macos-15 is available in GitHub CI, it would be a good idea to add it to
the mix.
Even after all of the changes made to make the subnets update properly
in the Relays module, it will always fail because of these two facts
combined:
- lifecycle is `create_before_destroy`
- GCP instance group template binds a network interface on a per-subnet
basis and this cannot be bound to both old and new subnet. The fix for
this would be to create a new instance group manager on each deploy
Rather than needlessly roll over the relay networks on each deploy,
since they're not changing, it would make more sense to define them
outside of the Relays module so that they aren't tainted by code
changes. This will prevent needless resource replacement and allow for
the Relay module to use them as-is.
#7733 fixed the randomness generation, but didn't fix the numbering.
According to [GCP docs](https://cloud.google.com/vpc/docs/subnets), we
can use virtually any RFC 1918 space for this.
This PR updates our numbering scheme to use the `10.128.0.0/9` space for
Relay subnets and changes the elixir app to use `10.2.2.0/20` to prevent
collisions.
When a Relay's instances are updated / changed, the contained
subnetwork's `name` and `ip_cidr_range` need to be updated to something
else because we are using the `create_before_destroy` lifecycle
configuration for the Relays module.
To fix this, we need to make sure that when recreating Relays, we use a
unique `name` and `ip_cidr_range` for the new instances so as not to
conflict with existing ones.
To handle this, we use a computed state-tracked value for
`ip_cidr_range` that will automatically adjust to the number of Relay
regions we have and it will be incremented each time the Relays are
recreated. Then we update the `name` to include this range to ensure we
never have a subnet name that conflicts with an existing one.
Since the last deployment failed, half of the subnets are created while
the other half are not. We need to taint all of the subnets to force
Terraform to replace them.
To improve supply-chain security, reference all GitHub actions using the
hash of the released tag. GitHub recommends to do this for third-party
actions
(https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions).
In order to make our CI more deterministic, I opted to do it for all our
actions. This means any change to our workflow configuration requires a
source code change and thus passing CI on our end.
Dependabot will automatically issue PRs for these actions and update the
comment with the new version next to them.
Resolves: #2497.
Ever since #7289, we no longer issue any DNS queries to `connlib` when
we reconnect to the portal. Thus, the back-then conceived feature of
"known hosts" that allowed us to resolve that DNS query without having
an upstream receiver is no longer needed.
Rather than notarizing the embedded app, the `notarytool` supports
notarizing the entire disk image instead which will recursively notarize
relevant binaries inside.
On macOS 12, returning an empty body for a `WindowGroup` can cause the
app UI to crash with the following error:
```
*** Assertion failure in void _NSWindowSetFrameIvar(NSWindow *, NSRect)(), NSWindow.m:935
```
Since the `menuBar` is not initialized when the app initializes, this
conditional can return an empty body in a race condition.
Even though we're winding down support for macOS 12, it would be good to
fix this logic bug.
When `connlib` detects that no data is being sent on a connection, it
enters a "low-power" mode within which timers are set to a much longer
interval than usual. For `boringtun` this moves the timer from 1s to
30s.
At present, this timer also guards, how often we actually update the
timer state within `boringtun`. Instead of following a "only update
exactly when this timer fires"-policy, we now adopt a "update at least
this often"-policy. The difference here is that while we are executing
the `handle_timeout` function, we might as well call into `boringtun`
and update its timer state too.
Another side-effect of this timer is that `boringtun` may not be woken
in time to initiate a rekey when the session expires. WireGuard sessions
without activity expire after 3 minutes. Only the initiater should then
recreate the session. If this doesn't happen in time, the responder
(Gateway) may trigger a keep-alive timeout. Without an active session,
keep-alives also initiate sessions, resulting in us having two competing
sessions.
This fixes the failing test cases added in this PR: There, we ran into a
situation where a WireGuard tunnel idled for so long that the spec
requires the session to expire. In the test, we then sent a packet using
such an expired session but that packet got discarded by the Gateway
because of the expired session. The timers are what check whether a
session is expired:
- By calling `update_timers_at` more often, we can expire the session in
time and `boringtun` will buffer the to-be-sent packet until the new
session is established.
- By deactivating the keep-alive on the Gateway, we ensure that we only
ever have a single WireGuard session active.
- With https://github.com/firezone/boringtun/pull/53, we ensure the
Gateway doesn't initiate a new session in the beginning.
- With https://github.com/firezone/boringtun/pull/51, we ensure the
Client only ever initiates a single session.
To be entirely reliable, we also had to remove the idle WG timer and
update `boringtun`'s state every second. This is unfortunate but can
long-term be fixed by patching WireGuard to tell us, when it exactly
wants to be woken instead of us having to proactively wake it every
second _in case_ it needs to act on a timer.
Related: https://github.com/firezone/boringtun/issues/54.
