fix: signature-issue dialog and preserve policy across ACL re-key

Two bugs combined to wipe user policy on the v3 ACL migration:

1. NSXPC allowed-classes list for `signatureIssueDetected(_:)` was
   `[SignatureIssueNotification.self]` only. The notification's
   `init(coder:)` decodes `NSData` fields, which NSSecureCoding silently
   rejects when NSData is not in the allowed list. The entire call was
   dropped by NSXPC, so the suspect-signature dialog never fired and
   users had no way to recover quarantined `user_rules` and
   `user_allowlist` after a verification failure. Latent since the
   feature was introduced — masked because real-world signature
   failures were rare until the v3 re-key forced everyone into the
   suspect path at once.

2. ACL migration was lossy by design. Re-keying happened inside the
   first call to `PolicySigner.verify`, which invalidated every
   existing signature. With the dialog also broken (#1), the
   `user_rules` and `user_allowlist` quarantine was inaccessible, and
   `user_ancestor_allowlist`, `user_jail_rules`,
   `bundle_updater_signatures`, and `feature_flags` were silently
   discarded.

Migration now runs explicitly inside `Database.init` after schema
migrations: every table whose signature still verifies under the
about-to-be-rotated key is captured, the key is rotated, and the
captured content is re-signed with the new key in a single SQLite
transaction. Nothing is lost across the upgrade.

For users already on 5780b84: if no mutation has been made to the
affected tables since the broken upgrade, the on-disk rows are still
present and the now-working dialog will surface them on next launch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: craigjbass

clearancekit/App/XPCClient.swift

@@ -129,7 +129,7 @@ final class XPCClient: NSObject, ObservableObject {
             ofReply: false
         )
         conn.exportedInterface?.setClasses(
-            NSSet(array: [SignatureIssueNotification.self]) as! Set<AnyHashable>,
+            NSSet(array: [SignatureIssueNotification.self, NSData.self]) as! Set<AnyHashable>,
             for: #selector(ClientProtocol.signatureIssueDetected(_:)),
             argumentIndex: 0,
             ofReply: false

opfilter/Database/Database.swift

@@ -55,6 +55,7 @@ final class Database {
         execute("PRAGMA foreign_keys=ON")
 
         runMigrations()
+        migrateAclIfNeeded()
     }
 
     deinit {
@@ -565,6 +566,125 @@ final class Database {
         case suspect
     }
 
+    // MARK: - ACL migration
+
+    /// Captures every signed table whose existing signature verifies under the
+    /// current (about-to-be-rotated) key, rotates the signing key so the next
+    /// load creates a fresh one bound to opfilter's explicit executable path,
+    /// then re-signs every captured table with the new key. Tables whose
+    /// signatures don't verify under the old key are left alone — they'll
+    /// enter the existing `.suspect` flow on next load.
+    private func migrateAclIfNeeded() {
+        guard PolicySigner.aclMigrationVersion() < PolicySigner.currentAclVersion() else { return }
+
+        let captured = captureAllVerifiableTableContent()
+
+        PolicySigner.rotateKey()
+
+        // Force creation of the new key now so re-sign uses it.
+        _ = try? PolicySigner.loadOrCreateKey()
+
+        inTransaction {
+            for (table, content) in captured {
+                updateSignature(table: table, content: content)
+            }
+        }
+
+        PolicySigner.recordAclMigrationVersion()
+        NSLog("Database: ACL migration v%d complete — re-signed %d table(s) with new key", PolicySigner.currentAclVersion(), captured.count)
+    }
+
+    private func captureAllVerifiableTableContent() -> [(String, Data)] {
+        var captured: [(String, Data)] = []
+        for (table, content) in allTablesWithCanonicalContent() {
+            let signature = readSignatureBlob(table: table)
+            guard let sig = signature else { continue }
+            // Existing signatures (pre-epoch migration) are over `content`
+            // alone; the new format is `content || epoch.bigEndian`. At v3
+            // migration time the epoch column was just added with default 0,
+            // so the legacy format applies for every row we encounter here.
+            if PolicySigner.canVerify(content, signature: sig) {
+                captured.append((table, content))
+            }
+        }
+        return captured
+    }
+
+    private func readSignatureBlob(table: String) -> Data? {
+        var signature: Data?
+        query("SELECT signature FROM data_signatures WHERE table_name = ?", bindings: [.text(table)]) { stmt in
+            guard let blobPtr = sqlite3_column_blob(stmt, 0) else { return }
+            let blobLen = sqlite3_column_bytes(stmt, 0)
+            signature = Data(bytes: blobPtr, count: Int(blobLen))
+        }
+        return signature
+    }
+
+    private func allTablesWithCanonicalContent() -> [(String, Data)] {
+        var result: [(String, Data)] = []
+
+        var rules: [FAARule] = []
+        query("""
+            SELECT id, protected_path_prefix,
+                   allowed_process_paths, allowed_signatures,
+                   allowed_ancestor_process_paths, allowed_ancestor_signatures,
+                   enforce_on_write_only, require_valid_signing,
+                   authorized_signatures, requires_authorization,
+                   authorization_session_duration
+            FROM user_rules ORDER BY rowid
+        """) { stmt in
+            if let rule = ruleFromRow(stmt) { rules.append(rule) }
+        }
+        result.append(("user_rules", canonicalRulesJSON(rules)))
+
+        var allowlist: [AllowlistEntry] = []
+        query("""
+            SELECT id, signing_id, process_path, platform_binary, team_id
+            FROM user_allowlist ORDER BY rowid
+        """) { stmt in
+            if let entry = allowlistEntryFromRow(stmt) { allowlist.append(entry) }
+        }
+        result.append(("user_allowlist", canonicalAllowlistJSON(allowlist)))
+
+        var ancestor: [AncestorAllowlistEntry] = []
+        query("""
+            SELECT id, signing_id, process_path, platform_binary, team_id
+            FROM user_ancestor_allowlist ORDER BY rowid
+        """) { stmt in
+            if let entry = ancestorAllowlistEntryFromRow(stmt) { ancestor.append(entry) }
+        }
+        result.append(("user_ancestor_allowlist", canonicalAncestorAllowlistJSON(ancestor)))
+
+        var jail: [JailRule] = []
+        query("""
+            SELECT id, name, jailed_signature, allowed_path_prefixes
+            FROM user_jail_rules ORDER BY rowid
+        """) { stmt in
+            if let rule = jailRuleFromRow(stmt) { jail.append(rule) }
+        }
+        result.append(("user_jail_rules", canonicalJailRulesJSON(jail)))
+
+        var flags: [FeatureFlag] = []
+        query("SELECT id, name, enabled FROM feature_flags ORDER BY rowid") { stmt in
+            if let flag = featureFlagFromRow(stmt) { flags.append(flag) }
+        }
+        result.append(("feature_flags", canonicalFeatureFlagsJSON(flags)))
+
+        var updaterSigs: [BundleUpdaterSignature] = []
+        query("SELECT id, team_id, signing_id FROM bundle_updater_signatures ORDER BY rowid") { stmt in
+            let uuidString = columnText(stmt, 0)
+            guard let id = UUID(uuidString: uuidString) else { return }
+            updaterSigs.append(BundleUpdaterSignature(
+                id: id,
+                teamID: columnText(stmt, 1),
+                signingID: columnText(stmt, 2)
+            ))
+        }
+        result.append(("bundle_updater_signatures", canonicalBundleUpdaterSignaturesJSON(updaterSigs)))
+
+        return result
+    }
+
     private func updateSignature(table: String, content: Data) {
         let diskEpoch = readDiskEpoch(table: table) ?? 0
         let keychainEpoch = EpochRatchet.epoch(forTable: table) ?? 0

opfilter/Policy/PolicySigner.swift

@@ -90,11 +90,49 @@ enum PolicySigner {
     // MARK: - Key lifecycle
 
     static func loadOrCreateKey() throws -> SecKey {
-        rekeyForExplicitPathAclOnce()
         if let key = try? loadKey() { return key }
         return try createSoftwareKey()
     }
 
+    /// Verifies `signature` against `data` using the currently-loaded signing
+    /// key and reports the result as a Bool, without throwing. Used by
+    /// `migrateAclIfNeeded` to capture tables whose existing signature is
+    /// valid under the old (about-to-be-rotated) key.
+    static func canVerify(_ data: Data, signature: Data) -> Bool {
+        (try? verify(data, signature: signature)) != nil
+    }
+
+    /// Forces the next call to `loadOrCreateKey` to mint a fresh key by
+    /// deleting any existing one. Used only by `migrateAclIfNeeded` after the
+    /// caller has already captured everything they want to re-sign under the
+    /// new key.
+    static func rotateKey() {
+        var query: [CFString: Any] = [
+            kSecClass:              kSecClassKey,
+            kSecAttrApplicationTag: keyTag,
+            kSecAttrKeyType:        kSecAttrKeyTypeECSECPrimeRandom,
+            kSecAttrKeyClass:       kSecAttrKeyClassPrivate,
+        ]
+        if let kc = systemKeychain { query[kSecUseKeychain] = kc }
+
+        let status = SecItemDelete(query as CFDictionary)
+        switch status {
+        case errSecSuccess:
+            NSLog("PolicySigner: Rotated System Keychain key")
+        case errSecItemNotFound:
+            NSLog("PolicySigner: rotateKey — no existing key")
+        default:
+            NSLog("PolicySigner: SecItemDelete during rotateKey failed (%d)", status)
+        }
+    }
+
+    static func aclMigrationVersion() -> Int { readAclMigrationVersion() }
+    static func currentAclVersion() -> Int { currentAclMigrationVersion }
+    static func recordAclMigrationVersion() {
+        for marker in legacyAclMarkers { try? FileManager.default.removeItem(at: marker) }
+        writeAclMigrationVersion(currentAclMigrationVersion)
+    }
+
     private static func loadKey() throws -> SecKey {
         var query: [CFString: Any] = [
             kSecClass:              kSecClassKey,
@@ -180,55 +218,6 @@ enum PolicySigner {
         return String(cString: buffer)
     }
 
-    // MARK: - One-time migration
-
-    /// Deletes any existing System Keychain key so that the next call to
-    /// `loadOrCreateKey` rebuilds it with an explicit-executable-path ACL.
-    /// Previous migration (v2) used `SecTrustedApplicationCreateFromPath(nil, …)`
-    /// which observably produced an empty trusted-apps list when called from a
-    /// system extension. v3 forces resolution against `_NSGetExecutablePath`.
-    ///
-    /// The keychain version counter (`aclVersionService`) is the sole trust
-    /// anchor — any state where the counter is below the current version is
-    /// treated as needing migration. Because the counter is written with an
-    /// opfilter-only ACL once v3 is active, an attacker cannot force a
-    /// re-migration by tampering with on-disk markers; the legacy marker
-    /// files written by earlier builds are ignored and cleaned up.
-    ///
-    /// Existing signed tables become unverifiable because the signing key is
-    /// fresh; PolicyRepository's load path quarantines or resets each table:
-    ///   - user_rules / user_allowlist → suspect dialog (Touch ID re-approve)
-    ///   - user_ancestor_allowlist / user_jail_rules / bundle_updater_signatures
-    ///     → silently discarded (existing behavior)
-    ///   - feature_flags → safe defaults (bundle protection ON)
-    private static func rekeyForExplicitPathAclOnce() {
-        if readAclMigrationVersion() >= currentAclMigrationVersion { return }
-
-        var query: [CFString: Any] = [
-            kSecClass:              kSecClassKey,
-            kSecAttrApplicationTag: keyTag,
-            kSecAttrKeyType:        kSecAttrKeyTypeECSECPrimeRandom,
-            kSecAttrKeyClass:       kSecAttrKeyClassPrivate,
-        ]
-        if let kc = systemKeychain { query[kSecUseKeychain] = kc }
-
-        let status = SecItemDelete(query as CFDictionary)
-        switch status {
-        case errSecSuccess:
-            NSLog("PolicySigner: Deleted prior System Keychain key — re-keying with explicit-path ACL. User rules and allowlist will require Touch ID re-approval via the suspect-signature dialog; jail rules, ancestor allowlist, and bundle updater entries will be reset.")
-        case errSecItemNotFound:
-            NSLog("PolicySigner: No prior System Keychain key — fresh install, new key will be created with explicit-path ACL")
-        default:
-            NSLog("PolicySigner: Could not delete old key (%d) — it may need manual removal from Keychain Access", status)
-        }
-
-        for marker in legacyAclMarkers {
-            try? FileManager.default.removeItem(at: marker)
-        }
-
-        writeAclMigrationVersion(currentAclMigrationVersion)
-    }
-
     // MARK: - ACL migration version counter
 
     private static func readAclMigrationVersion() -> Int {