Windows Firewall prompt on every new binary

[deansheather]

Every time there's a new version on the server (which is multiple times per day in dev.coder.com) the extension will download a new binary and Windows firewall will prompt to allow network access.

We should figure out a way to prevent the windows firewall thing from popping up (we only need to access over localhost anyways).

[kylecarbs]

@deansheather are you aware of a way for us to automagically do this? Maybe we'll have to sign the Windows binary........ 👻

[deansheather]

@kylecarbs Signing the binary doesn't help. As soon as you do any listening with a new binary you get a firewall popup unless the firewall is disabled completely.

I think the only way to avoid this would be to listen on a named pipe instead of a TCP socket on Windows, which wouldn't trigger the firewall:

https://pkg.go.dev/github.com/Microsoft/go-winio?GOOS=windows#ListenPipe

[deansheather]

Turns out this is caused by tailscale and not listening because we listen over stdio anyways!

From my tests putting the binary in the same path causes the popup to only occur on the first time, even if the binary is changed.

[mafredri]

Same issue on macOS using Little Snitch. I believe always storing the binary in the same path would fix the issue for me. Currently I have to flick through about 100 popups every update 😄. (Let me know if I should turn this into a separate issue.)

We could store the binaries per-deployment (assuming we get support for multiple), and hard link the downloaded version as coder. We could store current-1 so that we can revert, in case of error/regression.

Process example:

mkdir -p [..]/Code/User/globalStorage/coder.coder-remote/somedeployment.coder.com/bin
cd $_
wget -O coder-darwin-arm64-v0.14.3-devel+592ce3b1 https://somedeployment...
# Hardlink to save space
ln -f coder-darwin-arm64-v0.14.3-devel+592ce3b1 coder

[jsjoeio]

Notes from chatting with Dean

Nicer solution. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag

Client can specify this. We can use a SHA256 of the binary and the server can see if it's set and it matches, it will not reply with binary and will reply 304 not-modified

"I already have this version. Here is the version (in the etag)"

Dean to make change on server
Joe to make change on frontend/inside the extension

[jsjoeio]

Testing Locally

You can test the new server changes like so:

1. Use HTTP Client like Postman
2. Send a GET request to https://dev.coder.com/bin/coder-darwin-amd64 with the Header If-None-Match set to "2e088a18803ad28fa7905c8f8438e5e3607c3ad3"
3. See response

Note: sha1sum may be different on macOS. See this.