Simplify macOS setup

[waldekmastykarz]

Enabling the proxy on macOS requires manual steps. In comparison, on Windows, after starting the proxy, it automatically registers as a system-wide proxy. We should look for ways to simplify the steps, either via a script people can run, or have the proxy automatically register as a system-wide proxy, just like it does on Windows.

[waldekmastykarz]

Original feedback from @chanezon

[sebastienlevert]

Request from @ddyett also

[garrytrinder]

We currently have three manual steps when configuring the proxy for use on macOS, the following steps can be removed or automated:

1. Trust the application, this is needed as the app is not signed, we should look to get the executable signed with a Developer ID to remove this step, see https://developer.apple.com/developer-id/
2. Trust the certificate, this is needed as we don't do this automatically which is performed in Windows, this can be scripted using the security tool, see https://stackoverflow.com/questions/35031149/set-imported-certificate-to-always-be-trusted-in-mac-os-x
3. Configure network adapter, we don't do this automatically which is performed in Windows, this can be scripted using the networksetup tool, see https://stackoverflow.com/questions/36127254/change-proxy-on-mac-osx-programmatically

[waldekmastykarz]

For 3. we should also consider letting users on Windows not automatically hook up the Proxy as a system-wide proxy. This is very important if you only want to intercept requests from your app and want other apps, like Teams, connect directly to the cloud.

[sebastienlevert]

So am I reading correctly that a lot of this could be handled directly by an onboarding script?

[waldekmastykarz]

Correct, although we should strive for 0-manual steps, even such as running a script IMHO. Let's see if we can get more information about what it would mean to address each of the points @garrytrinder mentioned and if it's worth the effort.

[garrytrinder]

Ok little more on this...

1. Trust the application, there is a utility called spctl that can be used to manage Gatekeeper settings. Unfortunately, I've not been successful in trusting and revoking the proxy executable using this. As this issue will go away when the executable is signed, I think the manual step we currently have is OK to leave in place, it is also a common task that most macOS users are aware of and is well documented by Apple.
2. Trust the certificate, there is a utility called security that can be used to manage the keychain. Unfortunately, it is not possible to amend trust on a cert that has already been added to the keychain. You can however set trust options when you add a new cert using the tool (ex: sudo security add-trusted-cert -d -r trustRoot -p [option] -k /Library/Keychains/System.keychain <certificate>). I wonder if we can set the options when the proxy initially installs the certificate? Which would eradicate this step.
3. Configure network adapter, I have confirmed that this can be scripted using the networksetup tool. See below.

• Setup and enable proxy on network device
  • List network devices: networksetup -listallnetworkservices
  • Set proxy config: networksetup -setsecurewebproxy <networkservice> <domain> <port> (ex: networksetup -setsecurewebproxy Wi-Fi 0.0.0.0 8000)
• Disable proxy: networksetup -setsecurewebproxystate <networkservice> off (ex: networksetup -setsecurewebproxystate Wi-Fi off)
• Enable proxy: networksetup -setsecurewebproxystate <networkservice> on (ex: networksetup -setsecurewebproxystate Wi-Fi on)

[waldekmastykarz]

2. I wonder if we can set the options when the proxy initially installs the certificate?

Developer Proxy uses Titanium to create its certificate. We'd need to check if there are any configuration options that are exposed and which we could use towards this.

3. Configure network adapter, I have confirmed that this can be scripted using the networksetup tool. See below.

Should we look into the possibility to execute these commands from the Developer Proxy on macOS?

[garrytrinder]

Developer Proxy uses Titanium to create its certificate. We'd need to check if there are any configuration options that are exposed and which we could use towards this.

I looked at this.

The EnsureRootCertificate() method has some overloads for trusting the certificate in the store. Unfortunately none of these changed the trust settings in Keychain.

Should we look into the possibility to execute these commands from the Developer Proxy on macOS?

Yes, I was thinking of this as remembering the full command isn't easy. Adding commands to the tool to make this easier to setup, enable and disable the proxy would be much easier to remember.

[waldekmastykarz]

Adding commands to the tool to make this easier to setup, enable and disable the proxy would be much easier to remember.

Let's add a new issue for this