v2.0.1 — the update path, followed on a real machine

EgressView 2.0.1 = Hub 1.10.0 (unchanged) + Agent for Mac 0.3.8.

Everything here is the Mac agent. Most of it comes from following the in-app update path on a real machine for the first time, which broke four times in a row — and every one of those faults had passing tests.

What was wrong with updating

• Verification could never succeed. The agent shelled out to spctl, which inherits the sandbox and cannot reach syspolicyd. Every check failed with "internal error in Code Signing subsystem", which reads like a problem with the package and was not. Verification is now done in process.
• The app could not be replaced while running. The drag to Applications failed with "the item is in use", an error that says nothing about what to do. The agent now offers to quit at the moment the installer opens, and says that nothing is recorded until the new copy is running.
• An update to an older version was offered. A package downloaded earlier stayed on disk after the app was updated some other way, and the menu was only rebuilt when the monitoring status changed — so clearing it did not remove it from the menu.
• The downloaded application could not be launched at all. This one was not a bug. macOS marks everything a sandboxed application writes and refuses to launch an app taken from it. No amount of verifying the bytes changes that, and stripping the quarantine attribute would be defeating the control rather than satisfying it.

So the agent no longer downloads its own updates. The check is unchanged and the address it offers still comes from a manifest signed with the release key — that signature is what makes the address ours. The bytes are fetched by the browser and checked by macOS at first launch, as for any other download.

Installing still means quitting the agent and replacing it by hand. That is not a finished feature, and it is recorded as unfinished rather than as done. A proper .pkg installer is the decided fix.

Also in the Mac agent

• Threat rows open a detail pane showing the full address as well as the name, which value was actually on the list — a parent domain, sometimes, rather than the destination itself — what kind of indicator it was, and when it started. It ends by saying what the finding does and does not mean: a feed listing is not proof of harm.
• Data volume joins the threats table, reading "N or more" where connections are still open, because byte counts arrive when a connection closes.
• Controls that do nothing on a tab are disabled rather than left looking live.
• The threat detail pane no longer resizes when a row is selected, which used to move the table under the pointer that had just clicked it.

Upgrading

Nothing to do on the Hub. Agents on 0.3.0 or newer will offer 0.3.8 when they next check.

Full detail in the changelog.