unsigned Dashlane

[BenjaminO]

Hello @vitor

 

Here is a workflow I would like to share.

 

Author : me

Link to the Github repo : https://github.com/BenjaminOddou/alfred-dashlane

List of dependencies : Python and Dashlane CLI (mentioned also in the README.md)

Screenshots in the README as well

 

Don't hesitate to tell me if something needs to be updated. 🙂

[vitor]

Thank you, but due to external factors we (us and you) cannot control, this doesn’t look like it can go in the Gallery. The nature of the workflow makes it particularly sensitive, and there are a few problem flags:

• The required installation requires downloading an external binary, which is a no-go.
  • The automated step runs an external script from your repo, which while done outside the workflow is the sort of thing the point above aims to avoid. Tangentially, note the script is non-working as it hardcodes your user directory.
  • The manual step is going to be too complicated for many users, who won’t know the right thing to download or what <workflow folder> means.
    
• But the biggest blockers are with the Dashlane CLI itself:
  • It is unsigned, meaning it won’t run on user’s machines without further modification, complicating even more the manual steps. But more importantly, being unsigned removes security guarantees so it’s also a no-go.
  • It is Intel-only, so won’t work on Apple Silicon without forcing an installation of Rosetta.
  • Dashlane themselves don’t seem to take care of the CLI. They mention it’s experimental, discard every responsibility, and kind of dump it on the community. For a tool that interacts with sensitive user data, that matters.
    

Several of the above could likely be mitigated if the tool shipped in Homebrew’s default tap. At the moment that’s not possible because it does not pass the threshold for popularity. A better alternative would be for Dashlane to support the CLI officially, which at the moment they specifically do not do. If the situation changes, we can reconsider and I’ll gladly take another look.

That is in no way a reflection on your work! No doubt this workflow will be useful to others who use Dashlane, but for the Gallery we strive to provide a few assurances which the current state of the Dashlane CLI makes it impossible to adhere to.

Regarding the things you can fix for your users, pointed out above, do ask if anything was unclear. While the workflow can’t go in the Gallery now, we can still make it the best it can be!

[BenjaminO]

Hello @vitor and thank you for the feedback. I totally understand your position and I can only agree with you.

However, regarding the two points below:

27 minutes ago, vitor said:

The required installation requires downloading an external binary, which is a no-go.

• The automated step runs an external script from your repo, which while done outside the workflow is the sort of thing the point above aims to avoid. Tangentially, note the script is non-working as it hardcodes your user directory.
• The manual step is going to be too complicated for many users, who won’t know the right thing to download or what <workflow folder> means.

I think I can't change this as there is no Homebrew Formulae for now. I do not wish to ship the binary inside the workflow because it's super heavy (74MB). I only see two "kind of easy steps":

- To install the binary which are using a script to automate the process

- Manually install the binary and move it to the workflow directory.

Do not hesitate to tell me if you see a better way to achieve this !

 

41 minutes ago, vitor said:

Tangentially, note the script is non-working as it hardcodes your user directory.

I am not very clear about this. Did the `curl -sSL https://raw.githubusercontent.com/BenjaminOddou/alfred-dashlane/main/install.sh | bash` failed to work properly ? Or is it something else ?

 

Thank you again for the feedback. Do not hesitate to come back to me if you see anything that could be improved (pull request ?).😃

[vitor]

Yes, currently there are no better options regarding the binary installation. Bundling it with the workflow wouldn’t be a solution either as it would not subside the points regarding their CLI.

Regarding your script, look inside it. You’ve hardcoded your own paths (/Users/benjaminoddou) which won’t work for others. Also, it assumes Alfred Preferences are not being synced (the path will be different), and because it’s saving into the workflow’s folder it will be deleted on updates. Instead consider saving to the workflow’s data directory (see alfred_workflow_data).

[BenjaminO]

@vitor I totally missed that ! Thank you 🙏. I will need to update the reset script also because it removes everything from the data folder (favicons downloaded by the user). Thank you again !

[BenjaminO]

Should be resolved now with the release of the v1.0.3. https://github.com/BenjaminOddou/alfred-dashlane/releases/tag/v1.0.3

Don't hesitate to tell me if you see other issues 😄

 

Thank you again for the feedback !

[vitor]

1 hour ago, BenjaminO said:

everything from the data folder (favicons downloaded by the user).

 

Those are a good use case for the cache folder instead of the data folder, because (presumably) having those deleted by macOS if a user is low on disk space won’t be disruptive.

[BenjaminO]

Hum I see, so better to move favicons to cache folder and let dcli in data folder ? 🤔

[vitor]

I’d say so, yes. It won’t make a huge difference but it may help to think of the cache as having data which a user wouldn’t mind having nuked because it’s easily rebuilt and the data dir as having what’s supposed to be more “permanent”.

[BenjaminO]

Hello @vitor, it should be solved with the v1.0.4 -> https://github.com/BenjaminOddou/alfred-dashlane/releases/tag/v1.0.4 😃

[BenjaminO]

Hello @vitor, with the release v1.1.0, I updated the installation script to use homebrew formula installation with a ruby script (it's not perfect but I think it's better than downloading binary directly) ->https://github.com/BenjaminOddou/alfred-dashlane/blob/main/src/dashlane-cli.rb

This script is embed with the workflow and is used to install the dashlane cli binary based on the user system (it should work on arm64). The dashlane cli project is still "experimental" but it's updated regularly.

Do you have some insight for me to know what could be improved in order for this workflow to be accepted in the gallery ? Many thanks in advance

[vitor]

54 minutes ago, BenjaminO said:

to use homebrew formula installation with a ruby script

 

Unfortunately, it has to be a formula from the official main Homebrew tap (i.e. homebrew-core). The Dashlane’s CLI’s repo is near the acceptance threshold, so it may be accepted if you submit it.

 

1 hour ago, BenjaminO said:

This script is embed with the workflow and is used to install the dashlane cli binary

 

That would be a no-go because it’s still downloading a binary:

 

Quote

Bundling libraries is fine (following the signing prerequisite), but they must be included from the start. The workflow must not download extra software by itself, such as (but not limited to) running a pip install or brew install or curling a binary.

 

[BenjaminO]

ok thanks for the feedback, I'll post a message when the cli will be in homebrew-core