Security Enhancements

.babelrc

@@ -29,6 +29,7 @@
   "exclude": [
     "./.git/",
     "./bitlocker-status/",
+    "./mac-screenlock-check/",
     "./build/",
     "./dist/",
     "./docs/",

.env

@@ -1,3 +1,4 @@
 STETHOSCOPE_ENV=development
 BROWSER=none
 HOST=127.0.0.1
+REACT_APP_NAME=DrSprinto

.nvmrc

@@ -0,0 +1 @@
+v18.18.0

app.manifest

@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+  <assemblyIdentity
+    version="1.0.0.0"
+    processorArchitecture="*"
+    name="DrSprinto.App"
+    type="win32"
+  />
+  <description>DrSprinto Application</description>
+
+  <!-- Specify the security requirements -->
+  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
+    <security>
+      <requestedPrivileges>
+        <!-- Run with least privileges -->
+        <requestedExecutionLevel level="asInvoker" uiAccess="false" />
+      </requestedPrivileges>
+    </security>
+  </trustInfo>
+
+  <!-- Enable Windows security features -->
+  <application xmlns="urn:schemas-microsoft-com:asm.v3">
+    <windowsSettings>
+      <!-- Enable DLL security features -->
+      <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
+      <longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware>
+      <heapType xmlns="http://schemas.microsoft.com/SMI/2020/WindowsSettings">SegmentHeap</heapType>
+    </windowsSettings>
+  </application>
+
+  <!-- Specify dependency assemblies -->
+  <dependency>
+    <dependentAssembly>
+      <assemblyIdentity
+        type="win32"
+        name="Microsoft.Windows.Common-Controls"
+        version="6.0.0.0"
+        processorArchitecture="*"
+        publicKeyToken="6595b64144ccf1df"
+        language="*"
+      />
+    </dependentAssembly>
+  </dependency>
+</assembly>

compute-hash.js

@@ -0,0 +1,39 @@
+const path = require('path');
+const fs = require('fs');
+const crypto = require('crypto');
+
+const YOUR_FILE_PATH = 'stethoscope-app/dist/DrSprinto-2.5.0.AppImage';  //  POPULATE THIS
+
+function hashFile(file, algorithm = 'sha512', encoding = 'base64', options) {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash(algorithm);
+    hash.on('error', reject).setEncoding(encoding);
+    fs.createReadStream(
+      file,
+      Object.assign({}, options, {
+        highWaterMark: 1024 * 1024,
+        /* better to use more memory but hash faster */
+      })
+    )
+      .on('error', reject)
+      .on('end', () => {
+        hash.end();
+        console.log('hash done');
+        console.log(hash.read());
+        resolve(hash.read());
+      })
+      .pipe(
+        hash,
+        {
+          end: false,
+        }
+      );
+  });
+}
+
+const installerPath = path.resolve(
+  __dirname,
+  YOUR_FILE_PATH
+);
+
+hashFile(installerPath);

dev-app-update.yml

@@ -1,2 +1,2 @@
 provider: generic
-url: https://s3-us-west-2.amazonaws.com/nflx-stethoscope-public-securityprod-us-west-2/
+url: https://drsprinto.s3.amazonaws.com/

entitlements.mac.plist

@@ -2,7 +2,16 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
   <dict>
-    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+  <!-- https://github.com/electron/electron-notarize#prerequisites -->
+    <key>com.apple.security.cs.allow-jit</key>
     <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <false/>
+    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+    <false/>
+    <key>com.apple.security.device.microphone</key>
+    <false/>
+    <key>com.apple.security.device.audio-input</key>
+    <false/>
   </dict>
 </plist>