santactl/log: enable/disable vnode logging options in the kernel to test performance impact

.allstar/binary_artifacts.yaml

@@ -1,19 +0,0 @@
-# Ignore reason: These crafted binaries are used in tests
-ignorePaths:
-- Fuzzing/common/MachOParse_corpus/ret0
-- Source/common/testdata/bad_pagezero
-- Source/common/testdata/missing_pagezero
-- Source/common/testdata/missing_pagezero
-- Source/common/testdata/missing_pagezero
-- Source/common/testdata/32bitplist
-- Source/common/testdata/BundleExample.app/Contents/MacOS/BundleExample
-- Source/common/testdata/DirectoryBundle/Contents/MacOS/DirectoryBundle
-- Source/common/testdata/DirectoryBundle/Contents/Resources/BundleExample.app/Contents/MacOS/BundleExample
-- Source/santad/testdata/binaryrules/badbinary
-- Source/santad/testdata/binaryrules/goodbinary
-- Source/santad/testdata/binaryrules/badcert
-- Source/santad/testdata/binaryrules/banned_teamid_allowed_binary
-- Source/santad/testdata/binaryrules/banned_teamid
-- Source/santad/testdata/binaryrules/goodcert
-- Source/santad/testdata/binaryrules/noop
-- Source/santad/testdata/binaryrules/rules.db

.bazelrc

@@ -1,47 +0,0 @@
-build --apple_generate_dsym --define=apple.propagate_embedded_extra_outputs=yes
-
-build --copt=-Werror
-build --copt=-Wall
-build --copt=-Wno-error=deprecated-declarations
-# Disable -Wunknown-warning-option because deprecated-non-prototype
-# isn't recognized on older SDKs
-build --copt=-Wno-unknown-warning-option
-build --copt=-Wno-error=deprecated-non-prototype
-build --per_file_copt=.*\.mm\$@-std=c++17
-build --cxxopt=-std=c++17
-build --host_cxxopt=-std=c++17
-
-build --copt=-DSANTA_OPEN_SOURCE=1
-build --cxxopt=-DSANTA_OPEN_SOURCE=1
-
-# Many config options for sanitizers pulled from
-# https://github.com/protocolbuffers/protobuf/blob/main/.bazelrc
-build:san-common --strip=never
-build:san-common --copt="-Wno-macro-redefined"
-build:san-common --copt="-D_FORTIFY_SOURCE=0"
-build:san-common --copt="-O1"
-build:san-common --copt="-fno-omit-frame-pointer"
-
-build:asan --config=san-common
-build:asan --copt="-fsanitize=address"
-build:asan --copt="-DADDRESS_SANITIZER"
-build:asan --linkopt="-fsanitize=address"
-build:asan --test_env="ASAN_OPTIONS=log_path=/tmp/san_out"
-
-build:tsan --config=san-common
-build:tsan --copt="-fsanitize=thread"
-build:tsan --copt="-DTHREAD_SANITIZER=1"
-build:tsan --linkopt="-fsanitize=thread"
-build:tsan --test_env="TSAN_OPTIONS=log_path=/tmp/san_out:halt_on_error=true"
-
-build:ubsan --config=san-common
-build:ubsan --copt="-fsanitize=undefined"
-build:ubsan --copt="-DUNDEFINED_SANITIZER=1"
-build:ubsan --copt="-fno-sanitize=function" --copt="-fno-sanitize=vptr"
-build:ubsan --linkopt="-fsanitize=undefined"
-build:ubsan --test_env="UBSAN_OPTIONS=log_path=/tmp/san_out"
-
-build:fuzz --config=san-common
-build:fuzz --@rules_fuzzing//fuzzing:cc_engine=@rules_fuzzing//fuzzing/engines:libfuzzer
-build:fuzz --@rules_fuzzing//fuzzing:cc_engine_instrumentation=libfuzzer
-build:fuzz --@rules_fuzzing//fuzzing:cc_engine_sanitizer=asan

.bazelversion

@@ -1 +0,0 @@
-7.0.0

.clang-format

@@ -1,18 +1,18 @@
-Language: ObjC
 BasedOnStyle: Google
+Language: Cpp
+Standard: Cpp11
 
-IndentWidth: 2
-ObjCBlockIndentWidth: 2
-ContinuationIndentWidth: 2
-
-# For ObjC, the line limit is 100
-ColumnLimit: 100
+# Disable ColumnLimit because it causes some very weird line breaks.
+# For ObjC the limit is 100
+# For Cpp  the limit is 80
+ColumnLimit: 0
 
 # Allow short case statements to be on a single line
 AllowShortCaseLabelsOnASingleLine: true
 
+# Ban short loops and functions on a single line
 AllowShortLoopsOnASingleLine: false
-AllowShortFunctionsOnASingleLine: Inline
+AllowShortFunctionsOnASingleLine: false
 
 # Allow spaces in NSArray/NSDictionary literals @[ and @{
 SpacesInContainerLiterals: true
@@ -20,13 +20,3 @@ SpacesInContainerLiterals: true
 # For pointers, always put the * next to the variable name.
 DerivePointerAlignment: false
 PointerAlignment: Right
-
-
----
-Language: Cpp
-Standard: Cpp11
-
-BasedOnStyle: Google
-
-# For C++, the line limit is 80
-ColumnLimit: 80

.github/workflows/check-markdown.yml

@@ -1,20 +0,0 @@
-name: Check Markdown
-
-on:
-  pull_request:
-    paths:
-      - "**.md"
-
-jobs:
-  markdown-check:
-    runs-on: ubuntu-latest
-    steps:
-      - name: "Checkout Santa"
-        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # ratchet:actions/checkout@v4
-      - name: "Check for deadlinks"
-        uses: lycheeverse/lychee-action@2b973e86fc7b1f6b36a93795fe2c9c6ae1118621 # ratchet:lycheeverse/lychee-action@v1
-        with:
-          fail: true
-      - name: "Check for trailing whitespace and newlines"
-        if: '!cancelled()'
-        run: "! git grep -EIn $'[ \t]+$' -- ':(exclude)*.patch'"

.github/workflows/ci.yml

@@ -1,51 +0,0 @@
-name: CI
-on:
-  push:
-    branches:
-      - '*'
-    paths:
-      - 'Source/**'
-  pull_request:
-    branches:
-      - main
-    paths:
-      - 'Source/**'
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
-      - name: Run linters
-        run: ./Testing/lint.sh
-  build_userspace:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [macos-12, macos-13, macos-14]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
-      - name: Build Userspace
-        run: bazel build --apple_generate_dsym -c opt :release --define=SANTA_BUILD_TYPE=adhoc
-  unit_tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [macos-12, macos-13, macos-14]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
-      - name: Run All Tests
-        run: bazel test :unit_tests --define=SANTA_BUILD_TYPE=adhoc --test_output=errors
-  test_coverage:
-    runs-on: macos-14
-    steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
-      - name: Generate test coverage
-        run: sh ./generate_cov.sh
-      - name: Coveralls
-        uses: coverallsapp/github-action@09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d # ratchet:coverallsapp/github-action@master
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          path-to-lcov: ./bazel-out/_coverage/_coverage_report.dat
-          flag-name: Unit

.github/workflows/continuous.yml

@@ -1,13 +0,0 @@
-name: continuous
-on:
-  schedule:
-    - cron: '0 10 * * *' # Every day at 10:00 UTC
-  workflow_dispatch:  # Allows you to run this workflow manually from the Actions tab
-
-jobs:
-  preqs:
-    runs-on: macos-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Checks for flaky tests
-        run: bazel test --test_strategy=exclusive --test_output=errors --runs_per_test 50 -t- :unit_tests --define=SANTA_BUILD_TYPE=adhoc

.github/workflows/e2e.yml

@@ -1,67 +0,0 @@
-name: E2E
-
-on:
-  schedule:
-    - cron: '0 4 * * *' # Every day at 4:00 UTC (not to interfere with fuzzing)
-  workflow_dispatch:
-
-jobs:
-  update_vm:
-    runs-on: e2e-host
-    steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
-      - name: Update VM
-        env:
-          GCS_KEY: ${{ secrets.GCS_SERVICE_ACCOUNT_KEY }}
-        run: |
-          export GOOGLE_APPLICATION_CREDENTIALS=/tmp/gcp.json
-          echo "${GCS_KEY}" > ${GOOGLE_APPLICATION_CREDENTIALS}
-          function cleanup {
-            rm /tmp/gcp.json
-          }
-          trap cleanup EXIT
-          python3 Testing/integration/actions/update_vm.py macOS_14.bundle.tar.gz
-
-  start_vm:
-    runs-on: e2e-host
-    steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
-      - name: Start VM
-        env:
-          RUNNER_REG_TOKEN: ${{ secrets.RUNNER_REG_TOKEN }}
-        run: python3 Testing/integration/actions/start_vm.py macOS_14.bundle.tar.gz
-
-  integration:
-    runs-on: e2e-vm
-    env:
-      VM_PASSWORD: ${{ secrets.VM_PASSWORD }}
-    steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
-      - name: Add homebrew to PATH
-        run: echo "/opt/homebrew/bin/" >> $GITHUB_PATH
-      - name: Install configuration profile
-        run: bazel run //Testing/integration:install_profile -- Testing/integration/configs/default.mobileconfig
-      - name: Build, install, and sync santa
-        run: |
-          bazel run :reload --define=SANTA_BUILD_TYPE=adhoc
-          bazel run //Testing/integration:allow_sysex
-      - name: Test config changes
-        run: ./Testing/integration/test_config_changes.sh
-      - name: Build, install, and start moroz
-        run: |
-          bazel build @com_github_groob_moroz//cmd/moroz:moroz
-          cp bazel-bin/external/com_github_groob_moroz/cmd/moroz/moroz_/moroz /tmp/moroz
-          /tmp/moroz -configs="$GITHUB_WORKSPACE/Testing/integration/configs/moroz_default/global.toml" -use-tls=false &
-          sudo santactl sync --debug
-      - name: Run integration test binaries
-        run: |
-          bazel test //Testing/integration:integration_tests
-          sleep 3
-          bazel run //Testing/integration:dismiss_santa_popup || true
-      - name: Test sync server changes
-        run: ./Testing/integration/test_sync_changes.sh
-      - name: Test USB blocking
-        run: ./Testing/integration/test_usb.sh
-      - name: Poweroff
-        if: ${{ always() }}
-        run: sudo shutdown -h +1

.github/workflows/fuzz.yml

@@ -1,35 +0,0 @@
-name: Fuzzing
-
-on:
-  schedule:
-    - cron: '0 6 * * *' # Every day at 6:00 UTC
-  workflow_dispatch:  # Allows you to run this workflow manually from the Actions tab
-
-jobs:
-  start_vm:
-    runs-on: e2e-host
-    steps:
-      - uses: actions/checkout@v3
-      - name: Start VM
-        run: python3 Testing/integration/actions/start_vm.py macOS_13.bundle.tar.gz
-
-  fuzz:
-    runs-on: e2e-vm
-    steps:
-      - uses: actions/checkout@v3
-      - name: Setup libfuzzer
-        run: Fuzzing/install_libclang_fuzzer.sh
-      - name: Fuzz
-        run: |
-          for target in $(bazel query 'kind(fuzzing_launcher, //Fuzzing:all)'); do
-            bazel run --config=fuzz $target -- -- -max_len=32768 -runs=1000000 -timeout=5
-          done
-      - name: Upload crashes
-        uses: actions/upload-artifact@v1
-        if: failure()
-        with:
-          name: artifacts
-          path: /tmp/fuzzing/artifacts
-      - name: Poweroff VM
-        if: ${{ always() }}
-        run: sudo shutdown -h +1

.github/workflows/sanitizers.yml

@@ -1,30 +0,0 @@
-name: sanitizers
-on:
-  schedule:
-    - cron: '0 16 * * *'
-  workflow_dispatch:
-
-jobs:
-  test:
-    runs-on: macos-latest
-    strategy:
-      matrix:
-        sanitizer: [asan, tsan, ubsan]
-    steps:
-      - uses: actions/checkout@v3
-      - name: ${{ matrix.sanitizer }}
-        run: |
-          CLANG_VERSION=$(clang --version | head -n 1 | cut -d' ' -f 4)
-          DYLIB_PATH="$(xcode-select -p)/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/${CLANG_VERSION}/lib/darwin/libclang_rt.${{ matrix.sanitizer }}_osx_dynamic.dylib"
-
-          bazel test --config=${{ matrix.sanitizer }} \
-            --test_strategy=exclusive --test_output=all \
-            --test_env=DYLD_INSERT_LIBRARIES=${DYLIB_PATH} \
-            --runs_per_test 5 -t- :unit_tests \
-            --define=SANTA_BUILD_TYPE=adhoc
-      - name: Upload logs
-        uses: actions/upload-artifact@v1
-        if: failure()
-        with:
-          name: logs
-          path: /tmp/san_out*

.gitignore

@@ -1,20 +1,9 @@
 .DS_Store
-*.profraw
-*.provisionprofile
-bazel-*
-MODULE.bazel.lock
-Santa.xcodeproj/*
-Santa.xcworkspace/*
-CoverageData/*
-*.tulsiconf-user
-xcuserdata
-tulsigen-*
-*.crt
-*.key
-*.pem
-*.p12
-*.keychain
-*.swp
-compile_commands.json
-.cache/
-.vscode/*
+Build
+santa-*
+Pods
+Santa.xcodeproj/xcuserdata
+Santa.xcodeproj/project.xcworkspace
+Santa.xcworkspace/xcuserdata
+Santa.xcworkspace/xcshareddata
+Source/DevelopmentTeam.xcconfig

.pyink-config

@@ -1,5 +0,0 @@
-[tool.pyink]
-pyink = true
-line-length = 80
-pyink-indentation = 2
-pyink-use-majority-quotes = true

.travis.yml

@@ -0,0 +1,14 @@
+---
+language: objective-c
+cache:
+  - bundler
+  - cocoapods
+sudo: false
+osx_image: xcode7
+
+before_install:
+ - gem install cocoapods xcpretty
+ - pod setup >/dev/null
+
+script:
+ - xcodebuild -workspace Santa.xcworkspace -scheme All -derivedDataPath build build test CODE_SIGN_IDENTITY='' | xcpretty -sc && exit ${PIPESTATUS[0]}

BUILD

@@ -1,202 +0,0 @@
-load("@build_bazel_rules_apple//apple:versioning.bzl", "apple_bundle_version")
-load("//:helper.bzl", "run_command")
-
-package(
-    default_visibility = ["//:santa_package_group"],
-)
-
-licenses(["notice"])
-
-exports_files(["LICENSE"])
-
-# The version label for mac_* rules.
-apple_bundle_version(
-    name = "version",
-    build_label_pattern = ".*santa_{release}\\.{build}",
-    build_version = "{release}.{build}",
-    capture_groups = {
-        "release": "\\d{4}\\.\\d+",
-        "build": "\\d+",
-    },
-    fallback_build_label = "santa_9999.1.1",
-    short_version_string = "{release}",
-)
-
-# Used to detect release builds
-config_setting(
-    name = "release_build",
-    values = {"define": "SANTA_BUILD_TYPE=release"},
-    visibility = [":santa_package_group"],
-)
-
-# Adhoc signed - provisioning profiles are not used.
-# Used for CI runs and dev builds when SIP is disabled.
-config_setting(
-    name = "adhoc_build",
-    values = {"define": "SANTA_BUILD_TYPE=adhoc"},
-    visibility = [":santa_package_group"],
-)
-
-# Used to detect optimized builds
-config_setting(
-    name = "opt_build",
-    values = {"compilation_mode": "opt"},
-)
-
-package_group(
-    name = "santa_package_group",
-    packages = ["//..."],
-)
-
-################################################################################
-# Loading/Unloading/Reloading
-################################################################################
-run_command(
-    name = "unload",
-    cmd = """
-sudo launchctl unload /Library/LaunchDaemons/com.google.santad.plist 2>/dev/null
-sudo launchctl unload /Library/LaunchDaemons/com.google.santa.bundleservice.plist 2>/dev/null
-sudo launchctl unload /Library/LaunchDaemons/com.google.santa.metricservice.plist 2>/dev/null
-sudo launchctl unload /Library/LaunchDaemons/com.google.santa.syncservice.plist 2>/dev/null
-launchctl unload /Library/LaunchAgents/com.google.santa.plist 2>/dev/null
-""",
-)
-
-run_command(
-    name = "load",
-    cmd = """
-sudo launchctl load /Library/LaunchDaemons/com.google.santad.plist
-sudo launchctl load /Library/LaunchDaemons/com.google.santa.bundleservice.plist
-sudo launchctl load /Library/LaunchDaemons/com.google.santa.metricservice.plist
-sudo launchctl load /Library/LaunchDaemons/com.google.santa.syncservice.plist
-launchctl load /Library/LaunchAgents/com.google.santa.plist
-""",
-)
-
-run_command(
-    name = "reload",
-    srcs = [
-        "//Source/gui:Santa",
-    ],
-    cmd = """
-set -e
-
-rm -rf /tmp/bazel_santa_reload
-unzip -d /tmp/bazel_santa_reload \
-    $${BUILD_WORKSPACE_DIRECTORY}/bazel-out/*$(COMPILATION_MODE)*/bin/Source/gui/Santa.zip >/dev/null
-echo "You may be asked for your password for sudo"
-sudo BINARIES=/tmp/bazel_santa_reload CONF=$${BUILD_WORKSPACE_DIRECTORY}/Conf \
-    $${BUILD_WORKSPACE_DIRECTORY}/Conf/install.sh
-rm -rf /tmp/bazel_santa_reload
-echo "Time to stop being naughty"
-""",
-)
-
-################################################################################
-# Release rules - used to create a release tarball
-################################################################################
-genrule(
-    name = "release",
-    srcs = [
-        "//Source/gui:Santa",
-        "Conf/install.sh",
-        "Conf/uninstall.sh",
-        "Conf/com.google.santa.bundleservice.plist",
-        "Conf/com.google.santa.metricservice.plist",
-        "Conf/com.google.santa.syncservice.plist",
-        "Conf/com.google.santad.plist",
-        "Conf/com.google.santa.plist",
-        "Conf/com.google.santa.newsyslog.conf",
-        "Conf/Package/Distribution.xml",
-        "Conf/Package/notarization_tool.sh",
-        "Conf/Package/package_and_sign.sh",
-        "Conf/Package/postinstall",
-        "Conf/Package/preinstall",
-    ],
-    outs = ["santa-release.tar.gz"],
-    cmd = select({
-        "//conditions:default": """
-        echo "ERROR: Trying to create a release tarball without optimization."
-        echo "Please add '-c opt' flag to bazel invocation"
-        """,
-        ":opt_build": """
-      # Extract Santa.zip
-      for SRC in $(SRCS); do
-        if [ "$$(basename $${SRC})" == "Santa.zip" ]; then
-          mkdir -p $(@D)/binaries
-          unzip -q $${SRC} -d $(@D)/binaries >/dev/null
-        fi
-      done
-
-      # Copy config files
-      for SRC in $(SRCS); do
-        if [[ "$$(dirname $${SRC})" == *"Conf"* ]]; then
-          mkdir -p $(@D)/conf
-          cp -H $${SRC} $(@D)/conf/
-        fi
-      done
-
-      # Gather together the dSYMs. Throw an error if no dSYMs were found
-      for SRC in $(SRCS); do
-        case $${SRC} in
-          *santad.dSYM*Info.plist)
-            mkdir -p $(@D)/dsym
-            cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/santad.dSYM
-            ;;
-          *santactl.dSYM*Info.plist)
-            mkdir -p $(@D)/dsym
-            cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/santactl.dSYM
-            ;;
-          *santabundleservice.dSYM*Info.plist)
-            mkdir -p $(@D)/dsym
-            cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/santabundleservice.dSYM
-            ;;
-          *santametricservice.dSYM*Info.plist)
-            mkdir -p $(@D)/dsym
-            cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/santametricservice.dSYM
-            ;;
-          *santasyncservice.dSYM*Info.plist)
-            mkdir -p $(@D)/dsym
-            cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/santasyncservice.dSYM
-            ;;
-          *Santa.app.dSYM*Info.plist)
-            mkdir -p $(@D)/dsym
-            cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/Santa.app.dSYM
-            ;;
-          *com.google.santa.daemon.systemextension.dSYM*Info.plist)
-            mkdir -p $(@D)/dsym
-            cp -LR $$(dirname $$(dirname $${SRC})) $(@D)/dsym/com.google.santa.daemon.systemextension.dSYM
-            ;;
-        esac
-      done
-
-      # Cause a build failure if the dSYMs are missing.
-      if [[ ! -d "$(@D)/dsym" ]]; then
-        echo "dsym dir missing: Did you forget to use --apple_generate_dsym?"
-        echo "This flag is required for the 'release' target."
-        exit 1
-      fi
-
-      # Update all the timestamps to now. Bazel avoids timestamps to allow
-      # builds to be hermetic and cacheable but for releases we want the
-      # timestamps to be more-or-less correct.
-      find $(@D)/{binaries,conf,dsym} -exec touch {} \\;
-
-      # Create final output tar
-      tar -C $(@D) -czpf $(@) binaries dsym conf
-    """,
-    }),
-    heuristic_label_expansion = 0,
-)
-
-test_suite(
-    name = "unit_tests",
-    tests = [
-        "//Source/common:unit_tests",
-        "//Source/gui:unit_tests",
-        "//Source/santactl:unit_tests",
-        "//Source/santad:unit_tests",
-        "//Source/santametricservice:unit_tests",
-        "//Source/santasyncservice:unit_tests",
-    ],
-)

CODEOWNERS

@@ -1 +0,0 @@
-* @google/macendpoints

CONTRIBUTING.md

@@ -1 +0,0 @@
-docs/development/contributing.md

CONTRIBUTING.md

@@ -0,0 +1,37 @@
+Want to contribute? Great! First, read this page (including the small print at the end).
+
+### Before you contribute
+Before we can use your code, you must sign the
+[Google Individual Contributor License Agreement](https://developers.google.com/open-source/cla/individual)
+(CLA), which you can do online. The CLA is necessary mainly because you own the
+copyright to your changes, even after your contribution becomes part of our
+codebase, so we need your permission to use and distribute your code. We also
+need to be sure of various other things—for instance that you'll tell us if you
+know that your code infringes on other people's patents. You don't have to sign
+the CLA until after you've submitted your code for review and a member has
+approved it, but you must do it before we can put your code into our codebase.
+
+Before you start working on a larger contribution, you should get in touch with
+us first through the [issue tracker](https://github.com/google/santa/issues)
+with your idea so that we can help out and possibly guide you. Coordinating up 
+front makes it much easier to avoid frustration later on.
+
+### Code reviews
+All submissions, including submissions by project members, require review. We
+use GitHub pull requests for this purpose. It's also a good idea to run the
+tests beforehand, which you can do with the following commands:
+
+```sh
+rake tests:logic
+rake tests:kernel  # only necessary if you're changing the kext code
+```
+### Code Style
+
+All code submissions should try to match the surrounding code.  Wherever possible,
+code should adhere to either the
+[Google Objective-C Style Guide](https://google.github.io/styleguide/objcguide.xml)
+or the [Google C++ Style Guide](https://google.github.io/styleguide/cppguide.html).
+
+### The small print
+Contributions made by corporations are covered by a different agreement than
+the one above, the [Software Grant and Corporate Contributor License Agreement](https://developers.google.com/open-source/cla/corporate).

Conf/Package/Distribution.xml

@@ -1,16 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<installer-gui-script minSpecVersion="1">
-<title>Santa</title>
-<options customize="never" allow-external-scripts="no" hostArchitectures="x86_64,arm64" />
-
-<choices-outline>
-	<line choice="default" />
-</choices-outline>
-
-<choice id="default">
-    <pkg-ref id="com.google.santa"/>
-</choice>
-
-<pkg-ref id="com.google.santa">app.pkg</pkg-ref>
-
-</installer-gui-script>

Conf/Package/Makefile

@@ -0,0 +1,85 @@
+#
+#  Package Makefile for Santa
+#  Requires TheLuggage (github.com/unixorn/luggage) to be installed
+#
+#  Will generate a package based on the latest release. You can replace
+#  the PACKAGE_VERSION variable with a specific variable instead if you wish.
+#
+
+LUGGAGE:=/usr/local/share/luggage/luggage.make
+include ${LUGGAGE}
+
+TITLE:=santa
+REVERSE_DOMAIN:=com.google
+
+# Get latest Release version using the GitHub API. Each release is bound to a
+# git tag, which should always be a semantic version number. The most recent
+# release is always first in the API result.
+PACKAGE_VERSION:=$(shell curl -fs https://api.github.com/repos/google/santa/releases |\
+	python -c 'import json, sys; print json.load(sys.stdin)[0]["tag_name"]' 2>/dev/null)
+
+# Get the download URL for the latest Release. Each release should have a
+# tarball named santa-$version.tar.bz2 containing all of the files associated
+# with that release. The tarball layout is:
+#
+#   santa-$version.tar.bz2
+#   +--santa-$version
+#         |-- binaries
+#         |    |-- santa-driver.kext
+#         |    |-- Santa.app
+#         |-- conf
+#         |    |-- install.sh
+#         |    |-- com.google.santad.plist
+#         |    |-- com.google.santagui.plist
+#         |    +-- com.google.santa.asl.conf
+#         +--dsym
+#              |-- santa-driver.kext.dSYM
+#              |-- Santa.app.dSYM
+#              |-- santad.dSYM
+#              +-- santactl.dSYM
+PACKAGE_DOWNLOAD_URL:="https://github.com/google/santa/releases/download/${PACKAGE_VERSION}/santa-${PACKAGE_VERSION}.tar.bz2"
+
+PAYLOAD:=pack-Library-Extensions-santa-driver.kext \
+	pack-applications-Santa.app \
+	pack-Library-LaunchDaemons-com.google.santad.plist \
+	pack-Library-LaunchAgents-com.google.santagui.plist \
+	pack-etc-asl-com.google.santa.asl.conf \
+	pack-script-preinstall \
+	pack-script-postinstall
+
+santa-driver.kext: download
+Santa.app: download
+com.google.santad.plist: download
+com.google.santagui.plist: download
+com.google.santa.asl.conf: download
+
+download:
+	$(if $(PACKAGE_VERSION),, $(error GitHub API returned unexpected result. Wait a while and try again))
+
+	@curl -fL ${PACKAGE_DOWNLOAD_URL} | tar xvj --strip=2
+	@rm -rf *.dSYM
+
+pack-etc-asl-com.google.santa.asl.conf: com.google.santa.asl.conf l_private_etc
+	@sudo mkdir -p ${WORK_D}/private/etc/asl
+	@sudo chown root:wheel ${WORK_D}/private/etc/asl
+	@sudo chmod 755 ${WORK_D}/private/etc/asl
+	@sudo install -m 644 -o root -g wheel com.google.santa.asl.conf ${WORK_D}/private/etc/asl
+
+pack-Library-Extensions-santa-driver.kext: santa-driver.kext l_Library
+	@sudo mkdir -p ${WORK_D}/Library/Extensions
+	@sudo ${DITTO} --noqtn santa-driver.kext ${WORK_D}/Library/Extensions/santa-driver.kext
+	@sudo chown -R root:wheel ${WORK_D}/Library/Extensions/santa-driver.kext
+	@sudo chmod -R 755 ${WORK_D}/Library/Extensions/santa-driver.kext
+
+clean: myclean
+
+myclean:
+	@rm -rf *.dSYM
+	@rm -rf Santa.app
+	@rm -rf santa-driver.kext
+	@rm -f config.plist
+	@rm -f com.google.santa.asl.conf
+	@rm -f com.google.santad.plist
+	@rm -f com.google.santagui.plist
+	@rm -f install.sh
+	@rm -f uninstall.sh

Conf/Package/notarization_tool.sh

@@ -1,6 +0,0 @@
-#!/bin/bash
-
-# Example NOTARIZATION_TOOL wrapper.
-
-/usr/bin/xcrun notarytool submit "${2}" --wait \
-  --apple-id "${NOTARIZATION_USERNAME}" --password "${NOTARIZATION_PASSWORD}"

Conf/Package/package_and_sign.sh

@@ -1,171 +0,0 @@
-#!/bin/bash
-
-# This script signs all of Santa's components, verifies the signatures,
-# notarizes all of the components, staples them, packages them up, signs the
-# package, notarizes the package, puts the package in a DMG and notarizes the
-# DMG. It also outputs a single release tarball.
-# All of the following environment variables are required.
-
-# RELEASE_ROOT is a required environment variable that points to the root
-# of an extracted release tarball produced with the :release and :release_driver
-# rules in Santa's main BUILD file.
-[[ -n "${RELEASE_ROOT}" ]] || die "RELEASE_ROOT unset"
-
-# SIGNING_IDENTITY, SIGNING_TEAMID and SIGNING_KEYCHAIN are required environment
-# variables specifying the identity and keychain to pass to the codesign tool
-# and the team ID to use for verification.
-[[ -n "${SIGNING_IDENTITY}" ]] || die "SIGNING_IDENTITY unset"
-[[ -n "${SIGNING_TEAMID}" ]] || die "SIGNING_TEAMID unset"
-[[ -n "${SIGNING_KEYCHAIN}" ]] || die "SIGNING_KEYCHAIN unset"
-
-# INSTALLER_SIGNING_IDENTITY and INSTALLER_SIGNING_KEYCHAIN are required
-# environment variables specifying the identity and keychain to use when signing
-# the distribution package.
-[[ -n "${INSTALLER_SIGNING_IDENTITY}" ]] || die "INSTALLER_SIGNING_IDENTITY unset"
-[[ -n "${INSTALLER_SIGNING_KEYCHAIN}" ]] || die "INSTALLER_SIGNING_KEYCHAIN unset"
-
-# NOTARIZATION_TOOL is a required environment variable pointing to a wrapper
-# tool around the tool to use for notarization. The tool must take 2 flags:
-#    --file
-#        - pointing at a zip file containing the artifact to notarize
-[[ -n "${NOTARIZATION_TOOL}" ]] || die "NOTARIZATION_TOOL unset"
-
-# ARTIFACTS_DIR is a required environment variable pointing at a directory to
-# place the output artifacts in.
-[[ -n "${ARTIFACTS_DIR}" ]] || die "ARTIFACTS_DIR unset"
-
-################################################################################
-
-function die {
-  echo "${@}"
-  exit 2
-}
-
-readonly INPUT_APP="${RELEASE_ROOT}/binaries/Santa.app"
-readonly INPUT_SYSX="${INPUT_APP}/Contents/Library/SystemExtensions/com.google.santa.daemon.systemextension"
-readonly INPUT_SANTACTL="${INPUT_APP}/Contents/MacOS/santactl"
-readonly INPUT_SANTABS="${INPUT_APP}/Contents/MacOS/santabundleservice"
-readonly INPUT_SANTAMS="${INPUT_APP}/Contents/MacOS/santametricservice"
-readonly INPUT_SANTASS="${INPUT_APP}/Contents/MacOS/santasyncservice"
-
-readonly RELEASE_NAME="santa-$(/usr/bin/defaults read "${INPUT_APP}/Contents/Info.plist" CFBundleShortVersionString)"
-
-readonly SCRATCH=$(/usr/bin/mktemp -d "${TMPDIR}/santa-"XXXXXX)
-readonly APP_PKG_ROOT="${SCRATCH}/app_pkg_root"
-readonly APP_PKG_SCRIPTS="${SCRATCH}/pkg_scripts"
-
-readonly SCRIPT_PATH="$(/usr/bin/dirname -- ${BASH_SOURCE[0]})"
-
-/bin/mkdir -p "${APP_PKG_ROOT}" "${APP_PKG_SCRIPTS}"
-
-readonly DMG_PATH="${ARTIFACTS_DIR}/${RELEASE_NAME}.dmg"
-readonly TAR_PATH="${ARTIFACTS_DIR}/${RELEASE_NAME}.tar.gz"
-
-# Sign all of binaries/bundles. Maintain inside-out ordering where necessary
-for ARTIFACT in "${INPUT_SANTACTL}" "${INPUT_SANTABS}" "${INPUT_SANTAMS}" "${INPUT_SANTASS}" "${INPUT_SYSX}" "${INPUT_APP}"; do
-  BN=$(/usr/bin/basename "${ARTIFACT}")
-  echo "codesigning ${BN}"
-  /usr/bin/codesign --sign "${SIGNING_IDENTITY}" --keychain "${SIGNING_KEYCHAIN}" \
-        --preserve-metadata=entitlements --timestamp --force --generate-entitlement-der \
-        --options library,kill,runtime "${ARTIFACT}"
-done
-
-# Notarize all the bundles
-for ARTIFACT in "${INPUT_SYSX}" "${INPUT_APP}"; do
-  BN=$(/usr/bin/basename "${ARTIFACT}")
-
-  echo "zipping ${BN}"
-  /usr/bin/zip -9r "${SCRATCH}/${BN}.zip" "${ARTIFACT}"
-
-  echo "notarizing ${BN}"
-  PBID=$(/usr/bin/defaults read "${ARTIFACT}/Contents/Info.plist" CFBundleIdentifier)
-  "${NOTARIZATION_TOOL}" --file "${SCRATCH}/${BN}.zip"
-done
-
-# Staple the App.
-for ARTIFACT in "${INPUT_APP}"; do
-  BN=$(/usr/bin/basename "${ARTIFACT}")
-
-  echo "stapling ${BN}"
-  /usr/bin/xcrun stapler staple "${ARTIFACT}"
-done
-
-# Ensure _CodeSignature/CodeResources files have 0644 permissions so they can
-# be verified without using sudo.
-/usr/bin/find "${RELEASE_ROOT}/binaries" -type f -name CodeResources -exec chmod 0644 {} \;
-/usr/bin/find "${RELEASE_ROOT}/binaries" -type d -exec chmod 0755 {} \;
-/usr/bin/find "${RELEASE_ROOT}/conf" -type f -name "com.google.santa*" -exec chmod 0644 {} \;
-
-echo "verifying signatures"
-/usr/bin/codesign -vv -R="certificate leaf[subject.OU] = ${SIGNING_TEAMID}" \
-  "${RELEASE_ROOT}/binaries/"* || die "bad signature"
-
-echo "creating fresh release tarball"
-/bin/mkdir -p "${SCRATCH}/tar_root/${RELEASE_NAME}"
-/bin/cp -r "${RELEASE_ROOT}/binaries" "${SCRATCH}/tar_root/${RELEASE_NAME}"
-/bin/cp -r "${RELEASE_ROOT}/conf" "${SCRATCH}/tar_root/${RELEASE_NAME}"
-/bin/cp -r "${RELEASE_ROOT}/dsym" "${SCRATCH}/tar_root/${RELEASE_NAME}"
-/usr/bin/tar -C "${SCRATCH}/tar_root" -czvf "${TAR_PATH}" "${RELEASE_NAME}" || die "failed to create release tarball"
-
-echo "creating app pkg"
-/bin/mkdir -p "${APP_PKG_ROOT}/Applications" \
-  "${APP_PKG_ROOT}/Library/LaunchAgents" \
-  "${APP_PKG_ROOT}/Library/LaunchDaemons" \
-  "${APP_PKG_ROOT}/private/etc/asl" \
-  "${APP_PKG_ROOT}/private/etc/newsyslog.d"
-/bin/cp -vXR "${RELEASE_ROOT}/binaries/Santa.app" "${APP_PKG_ROOT}/Applications/"
-/bin/cp -vX "${RELEASE_ROOT}/conf/com.google.santad.plist" "${APP_PKG_ROOT}/Library/LaunchDaemons/"
-/bin/cp -vX "${RELEASE_ROOT}/conf/com.google.santa.plist" "${APP_PKG_ROOT}/Library/LaunchAgents/"
-/bin/cp -vX "${RELEASE_ROOT}/conf/com.google.santa.bundleservice.plist" "${APP_PKG_ROOT}/Library/LaunchDaemons/"
-/bin/cp -vX "${RELEASE_ROOT}/conf/com.google.santa.metricservice.plist" "${APP_PKG_ROOT}/Library/LaunchDaemons/"
-/bin/cp -vX "${RELEASE_ROOT}/conf/com.google.santa.syncservice.plist" "${APP_PKG_ROOT}/Library/LaunchDaemons/"
-/bin/cp -vX "${RELEASE_ROOT}/conf/com.google.santa.asl.conf" "${APP_PKG_ROOT}/private/etc/asl/"
-/bin/cp -vX "${RELEASE_ROOT}/conf/com.google.santa.newsyslog.conf" "${APP_PKG_ROOT}/private/etc/newsyslog.d/"
-/bin/cp -vXL "${SCRIPT_PATH}/preinstall" "${APP_PKG_SCRIPTS}/"
-/bin/cp -vXL "${SCRIPT_PATH}/postinstall" "${APP_PKG_SCRIPTS}/"
-/bin/chmod +x "${APP_PKG_SCRIPTS}/"*
-
-# Disable bundle relocation.
-/usr/bin/pkgbuild --analyze --root "${APP_PKG_ROOT}" "${SCRATCH}/component.plist"
-/usr/bin/plutil -replace BundleIsRelocatable -bool NO "${SCRATCH}/component.plist"
-/usr/bin/plutil -replace BundleIsVersionChecked -bool NO "${SCRATCH}/component.plist"
-/usr/bin/plutil -replace BundleOverwriteAction -string upgrade "${SCRATCH}/component.plist"
-/usr/bin/plutil -replace ChildBundles -json "[]" "${SCRATCH}/component.plist"
-
-# Build app package
-/usr/bin/pkgbuild --identifier "com.google.santa" \
-  --version "$(echo "${RELEASE_NAME}" | cut -d - -f2)" \
-  --root "${APP_PKG_ROOT}" \
-  --component-plist "${SCRATCH}/component.plist" \
-  --scripts "${APP_PKG_SCRIPTS}" \
-  "${SCRATCH}/app.pkg"
-
-# Build signed distribution package
-echo "productbuild pkg"
-/bin/mkdir -p "${SCRATCH}/${RELEASE_NAME}"
-/usr/bin/productbuild \
-  --distribution "${SCRIPT_PATH}/Distribution.xml" \
-  --package-path "${SCRATCH}" \
-  --sign "${INSTALLER_SIGNING_IDENTITY}" --keychain "${INSTALLER_SIGNING_KEYCHAIN}" \
-  "${SCRATCH}/${RELEASE_NAME}/${RELEASE_NAME}.pkg"
-
-echo "verifying pkg signature"
-/usr/sbin/pkgutil --check-signature "${SCRATCH}/${RELEASE_NAME}/${RELEASE_NAME}.pkg" || die "bad pkg signature"
-
-echo "notarizing pkg"
-"${NOTARIZATION_TOOL}" --file "${SCRATCH}/${RELEASE_NAME}/${RELEASE_NAME}.pkg"
-
-echo "stapling pkg"
-/usr/bin/xcrun stapler staple "${SCRATCH}/${RELEASE_NAME}/${RELEASE_NAME}.pkg" || die "failed to staple pkg"
-
-echo "wrapping pkg in dmg"
-/usr/bin/hdiutil create -fs HFS+ -format UDZO \
-    -volname "${RELEASE_NAME}" \
-    -ov -imagekey zlib-level=9 \
-    -srcfolder "${SCRATCH}/${RELEASE_NAME}/" "${DMG_PATH}" || die "failed to wrap pkg in dmg"
-
-echo "notarizing dmg"
-"${NOTARIZATION_TOOL}" --file "${DMG_PATH}"
-
-echo "stapling dmg"
-/usr/bin/xcrun stapler staple "${DMG_PATH}" || die "failed to staple dmg"

Conf/Package/postinstall

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Load com.google.santa.daemon and com.google.santa.bundleservice
+# Load the kernel extension, santad, sync client
 # If a user is logged in, also load the GUI agent.
 # If the target volume is not /, do nothing
 
@@ -9,28 +9,20 @@
 # Restart syslogd to pick up ASL configuration change
 /usr/bin/killall -HUP syslogd
 
-# Create hopefully useful symlink for santactl
-mkdir -p /usr/local/bin
-/bin/ln -sf /Applications/Santa.app/Contents/MacOS/santactl /usr/local/bin/santactl
+/sbin/kextload /Library/Extensions/santa-driver.kext
 
-# Remove the kext before com.google.santa.daemon loads if the SystemExtension is already present.
-/bin/launchctl list EQHXZ8M8AV.com.google.santa.daemon > /dev/null 2>&1 && rm -rf /Library/Extensions/santa-driver.kext
+sleep 1
 
-# Load com.google.santa.daemon, its main has logic to handle loading the kext
-# or relaunching itself as a SystemExtension.
 /bin/launchctl load -w /Library/LaunchDaemons/com.google.santad.plist
 
-# Load com.google.santa.bundleservice
-/bin/launchctl load -w /Library/LaunchDaemons/com.google.santa.bundleservice.plist
+sleep 1
 
-# Load com.google.santa.metricservice
-/bin/launchctl load -w /Library/LaunchDaemons/com.google.santa.metricservice.plist
+# Create hopefully useful symlink for santactl
+mkdir -p /usr/local/bin
+/bin/ln -sf /Library/Extensions/santa-driver.kext/Contents/MacOS/santactl /usr/local/bin/santactl
 
-# Load com.google.santa.syncservice
-/bin/launchctl load -w /Library/LaunchDaemons/com.google.santa.syncservice.plist
+user=$(/usr/bin/stat -f '%u' /dev/console)
+[[ -z "$user" ]] && exit 0
+/bin/launchctl asuser ${user} /bin/launchctl load /Library/LaunchAgents/com.google.santagui.plist
 
-GUI_USER=$(/usr/bin/stat -f '%u' /dev/console)
-[[ -z "${GUI_USER}" ]] && exit 0
-
-/bin/launchctl asuser "${GUI_USER}" /bin/launchctl load /Library/LaunchAgents/com.google.santa.plist
 exit 0

Conf/Package/preinstall

@@ -6,28 +6,21 @@
 
 [[ $3 != "/" ]] && exit 0
 
-/bin/launchctl remove com.google.santad || true
-/bin/launchctl remove com.google.santa.bundleservice || true
-/bin/launchctl remove com.google.santa.metricservice || true
-/bin/launchctl remove com.google.santa.syncservice || true
+/bin/launchctl remove com.google.santad
 
-/bin/sleep 1
+sleep 1
 
-/sbin/kextunload -b com.google.santa-driver >/dev/null 2>&1 || true
+/sbin/kextunload -b com.google.santa-driver >/dev/null 2>&1
 
 # Remove cruft from old Santa versions
-/bin/rm -f /usr/libexec/santad
-/bin/rm -f /usr/sbin/santactl
+/bin/rm /usr/libexec/santad
+/bin/rm /usr/sbin/santactl
 /bin/launchctl remove com.google.santasync
-/bin/rm -f /Library/LaunchDaemons/com.google.santasync.plist
-/bin/rm -rf /Applications/Santa.app
-/bin/rm -rf /Library/Extensions/santa-driver.kext
+/bin/rm /Library/LaunchDaemons/com.google.santasync.plist
 
-/bin/sleep 1
+sleep 1
 
-GUI_USER=$(/usr/bin/stat -f '%u' /dev/console)
-[[ -z "${GUI_USER}" ]] && exit 0
+user=$(/usr/bin/stat -f '%u' /dev/console)
+[[ -n "$user" ]] && /bin/launchctl asuser ${user} /bin/launchctl remove com.google.santagui
 
-/bin/launchctl asuser "${GUI_USER}" /bin/launchctl remove com.google.santagui
-/bin/launchctl asuser "${GUI_USER}" /bin/launchctl remove com.google.santa
 exit 0

Conf/com.google.santa.asl.conf

@@ -0,0 +1,6 @@
+# Copy this file to /etc/asl to log all messages from santa-driver to the log file
+> /var/log/santa.log format="[$((Time)(ISO8601Z.3))] $Message" mode=0644 rotate=seq compress file_max=25M all_max=100M uid=0 gid=0
+? [= Sender kernel] [S= Message santa-driver:] claim
+? [= Sender kernel] [S= Message santa-driver:] file /var/log/santa.log
+? [= Facility com.google.santa] claim
+? [= Facility com.google.santa] file /var/log/santa.log

Conf/com.google.santa.bundleservice.plist

@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>Label</key>
-	<string>com.google.santa.bundleservice</string>
-	<key>ProgramArguments</key>
-	<array>
-		<string>/Applications/Santa.app/Contents/MacOS/santabundleservice</string>
-		<string>--syslog</string>
-	</array>
-	<key>MachServices</key>
-	<dict>
-		<key>com.google.santa.bundleservice</key>
-		<true/>
-	</dict>
-	<key>RunAtLoad</key>
-	<false/>
-	<key>KeepAlive</key>
-	<false/>
-	<key>ProcessType</key>
-	<string>Interactive</string>
-	<key>ThrottleInterval</key>
-	<integer>0</integer>
-</dict>
-</plist>

Conf/com.google.santa.metricservice.plist

@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>Label</key>
-	<string>com.google.santa.metricservice</string>
-	<key>ProgramArguments</key>
-	<array>
-		<string>/Applications/Santa.app/Contents/MacOS/santametricservice</string>
-		<string>--syslog</string>
-	</array>
-	<key>MachServices</key>
-	<dict>
-		<key>com.google.santa.metricservice</key>
-		<true/>
-	</dict>
-	<key>RunAtLoad</key>
-	<true/>
-	<key>KeepAlive</key>
-	<true/>
-</dict>
-</plist>

Conf/com.google.santa.newsyslog.conf

@@ -1,2 +0,0 @@
-# logfilename             [owner:group]       mode   count size(KiB) when   flags [/pid_file] # [sig_num]
-/var/db/santa/santa.log   root:wheel          644    10    25000     *      Z

Conf/com.google.santa.syncservice.plist

@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>Label</key>
-	<string>com.google.santa.syncservice</string>
-	<key>ProgramArguments</key>
-	<array>
-		<string>/Applications/Santa.app/Contents/MacOS/santasyncservice</string>
-		<string>--syslog</string>
-	</array>
-	<key>MachServices</key>
-	<dict>
-		<key>com.google.santa.syncservice</key>
-		<true/>
-	</dict>
-	<key>RunAtLoad</key>
-	<false/>
-	<key>KeepAlive</key>
-	<false/>
-</dict>
-</plist>

Conf/com.google.santad.plist

@@ -1,24 +1,26 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>Label</key>
-	<string>com.google.santad</string>
-	<key>ProgramArguments</key>
-	<array>
-		<string>/Applications/Santa.app/Contents/Library/SystemExtensions/com.google.santa.daemon.systemextension/Contents/MacOS/com.google.santa.daemon</string>
-		<string>--syslog</string>
-	</array>
-	<key>MachServices</key>
-	<dict>
-		<key>com.google.santa.daemon</key>
-		<true/>
-	</dict>
-	<key>RunAtLoad</key>
-	<true/>
-	<key>KeepAlive</key>
-	<true/>
-	<key>ProcessType</key>
-	<string>Interactive</string>
+				<key>Label</key>
+				<string>com.google.santad</string>
+				<key>ProgramArguments</key>
+				<array>
+					<string>/Library/Extensions/santa-driver.kext/Contents/MacOS/santad</string>
+					<string>--syslog</string>
+				</array>
+				<key>MachServices</key>
+				<dict>
+					<key>SantaXPCControl</key>
+					<true/>
+				</dict>
+				<key>RunAtLoad</key>
+				<true/>
+				<key>KeepAlive</key>
+				<true />
+				<key>ProcessType</key>
+				<string>Interactive</string>
+				<key>ThrottleInterval</key>
+				<integer>1</integer>
 </dict>
 </plist>

Conf/com.google.santagui.plist

@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
 				<key>Label</key>
-				<string>com.google.santa</string>
+				<string>com.google.santagui</string>
 				<key>ProgramArguments</key>
 				<array>
 					<string>/Applications/Santa.app/Contents/MacOS/Santa</string>

Conf/config.plist

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<!-- Minimal Configuration -->
+	<key>ClientMode</key>
+	<integer>1</integer>
+
+	<!--  For documentation of other keys, see the following URL:
+  			https://github.com/google/santa/wiki/Configuration-Keys  -->
+</dict>
+</plist>

Conf/install.sh

@@ -5,84 +5,55 @@ if [[ $EUID -ne 0 ]]; then
   exit 1
 fi
 
-if [[ -z "${BINARIES}" || -z "${CONF}" ]]; then
-  if [[ -d "binaries" ]]; then
-    BINARIES="${PWD}/binaries"
-    CONF="${PWD}/conf"
-  elif [[ -d "../binaries" ]]; then
-    BINARIES="${PWD}/../binaries"
-    CONF="${PWD}/../conf"
-  else
-    echo "Can't find binaries, run install.sh from inside the conf directory" 1>&2
-    exit 1
-  fi
+if [[ -d "binaries" ]]; then
+  SOURCE="."
+elif [[ -d "../binaries" ]]; then
+  SOURCE=".."
+else
+  echo "Can't find binaries, run install.sh from inside the conf directory" 1>&2
+  exit 1
 fi
 
-# Unload santad and scheduled sync job.
-/bin/launchctl remove com.google.santad >/dev/null 2>&1
-
-# Unload bundle service
-/bin/launchctl remove com.google.santa.bundleservice >/dev/null 2>&1
-
-# Unload metric service
-/bin/launchctl remove com.google.santa.metricservice >/dev/null 2>&1
-
-# Unload sync service
-/bin/launchctl remove com.google.santa.syncservice >/dev/null 2>&1
-
-# Unload kext.
-/sbin/kextunload -b com.google.santa-driver >/dev/null 2>&1
-
 # Determine if anyone is logged into the GUI
 GUI_USER=$(/usr/bin/stat -f '%u' /dev/console)
 
+# Unload santad and scheduled sync job.
+/bin/launchctl remove com.google.santad >/dev/null 2>&1
+
+# Unload kext.
+/sbin/kextunload -b com.google.santa-driver >/dev/null 2>&1
+
 # Unload GUI agent if someone is logged in.
-[[ -n "${GUI_USER}" ]] && \
-  /bin/launchctl asuser "${GUI_USER}" /bin/launchctl remove com.google.santagui
 [[ -n "$GUI_USER" ]] && \
-  /bin/launchctl asuser "${GUI_USER}" /bin/launchctl remove com.google.santa
+  /bin/launchctl asuser ${GUI_USER} /bin/launchctl remove /Library/LaunchAgents/com.google.santagui.plist
 
 # Cleanup cruft from old versions
 /bin/launchctl remove com.google.santasync >/dev/null 2>&1
 /bin/rm /Library/LaunchDaemons/com.google.santasync.plist >/dev/null 2>&1
 /bin/rm /usr/libexec/santad >/dev/null 2>&1
 /bin/rm /usr/sbin/santactl >/dev/null 2>&1
-/bin/rm -rf /Applications/Santa.app 2>&1
-/bin/rm -rf /Library/Extensions/santa-driver.kext 2>&1
-/bin/rm /etc/asl/com.google.santa.asl.conf
 
 # Copy new files.
-/bin/mkdir -p /var/db/santa
+/bin/cp -r ${SOURCE}/binaries/santa-driver.kext /Library/Extensions
+/bin/cp -r ${SOURCE}/binaries/Santa.app /Applications
+mkdir -p /usr/local/bin
+/bin/ln -s /Library/Extensions/santa-driver.kext/Contents/MacOS/santactl /usr/local/bin
 
-/bin/cp -r ${BINARIES}/Santa.app /Applications
-
-/bin/mkdir -p /usr/local/bin
-/bin/ln -s /Applications/Santa.app/Contents/MacOS/santactl /usr/local/bin 2>/dev/null
-
-/bin/cp ${CONF}/com.google.santa.plist /Library/LaunchAgents
-/bin/cp ${CONF}/com.google.santa.bundleservice.plist /Library/LaunchDaemons
-/bin/cp ${CONF}/com.google.santa.metricservice.plist /Library/LaunchDaemons
-/bin/cp ${CONF}/com.google.santa.syncservice.plist /Library/LaunchDaemons
-/bin/cp ${CONF}/com.google.santad.plist /Library/LaunchDaemons
-/bin/cp ${CONF}/com.google.santa.newsyslog.conf /etc/newsyslog.d/
+/bin/cp ${SOURCE}/conf/com.google.santad.plist /Library/LaunchDaemons
+/bin/cp ${SOURCE}/conf/com.google.santagui.plist /Library/LaunchAgents
+/bin/cp ${SOURCE}/conf/com.google.santa.asl.conf /etc/asl/
 
 # Reload syslogd to pick up ASL configuration change.
 /usr/bin/killall -HUP syslogd
 
-# Load com.google.santa.daemon
+# Load kext.
+/sbin/kextload /Library/Extensions/santa-driver.kext
+
+# Load santad and scheduled sync jobs.
 /bin/launchctl load /Library/LaunchDaemons/com.google.santad.plist
 
-# Load com.google.santa.bundleservice
-/bin/launchctl load /Library/LaunchDaemons/com.google.santa.bundleservice.plist
-
-# Load com.google.santa.metricservice
-/bin/launchctl load /Library/LaunchDaemons/com.google.santa.metricservice.plist
-
-# Load com.google.santa.syncservice
-/bin/launchctl load /Library/LaunchDaemons/com.google.santa.syncservice.plist
-
 # Load GUI agent if someone is logged in.
-[[ -z "${GUI_USER}" ]] && exit 0
+[[ -n "$GUI_USER" ]] && \
+  /bin/launchctl asuser ${GUI_USER} /bin/launchctl load /Library/LaunchAgents/com.google.santagui.plist
 
-/bin/launchctl asuser "${GUI_USER}" /bin/launchctl load -w /Library/LaunchAgents/com.google.santa.plist
 exit 0

Conf/uninstall.sh

@@ -6,34 +6,20 @@
 
 [ "$EUID" != 0 ] && printf "%s\n" "This requires running as root/sudo." && exit 1
 
-# For macOS 10.15+ this will block up to 60 seconds
-/bin/launchctl list EQHXZ8M8AV.com.google.santa.daemon > /dev/null 2>&1 && /Applications/Santa.app/Contents/MacOS/Santa --unload-system-extension
-
 /bin/launchctl remove com.google.santad
-# remove helper XPC services
-/bin/launchctl remove com.google.santa.bundleservice
-/bin/launchctl remove com.google.santa.metricservice
-/bin/launchctl remove com.google.santa.syncservice
 sleep 1
 /sbin/kextunload -b com.google.santa-driver >/dev/null 2>&1
 user=$(/usr/bin/stat -f '%u' /dev/console)
 [[ -n "$user" ]] && /bin/launchctl asuser ${user} /bin/launchctl remove com.google.santagui
-[[ -n "$user" ]] && /bin/launchctl asuser ${user} /bin/launchctl remove com.google.santa
 # and to clean out the log config, although it won't write after wiping the binary
 /usr/bin/killall -HUP syslogd
 # delete artifacts on-disk
 /bin/rm -rf /Applications/Santa.app
 /bin/rm -rf /Library/Extensions/santa-driver.kext
 /bin/rm -f /Library/LaunchAgents/com.google.santagui.plist
-/bin/rm -f /Library/LaunchAgents/com.google.santa.plist
 /bin/rm -f /Library/LaunchDaemons/com.google.santad.plist
-/bin/rm -f /Library/LaunchDaemons/com.google.santa.bundleservice.plist
-/bin/rm -f /Library/LaunchDaemons/com.google.santa.metricservice.plist
-/bin/rm -f /Library/LaunchDaemons/com.google.santa.syncservice.plist
 /bin/rm -f /private/etc/asl/com.google.santa.asl.conf
-/bin/rm -f /private/etc/newsyslog.d/com.google.santa.newsyslog.conf
 /bin/rm -f /usr/local/bin/santactl # just a symlink
-
 #uncomment to remove the config file and all databases, log files
 #/bin/rm -rf /var/db/santa
 #/bin/rm -f /var/log/santa*

Fuzzing/BUILD

@@ -1,11 +0,0 @@
-load("fuzzing.bzl", "objc_fuzz_test")
-
-objc_fuzz_test(
-    name = "MachOParse",
-    srcs = ["common/MachOParse.mm"],
-    corpus = glob(["common/MachOParse_corpus/*"]),
-    linkopts = ["-lsqlite3"],
-    deps = [
-        "//Source/common:SNTFileInfo",
-    ],
-)

Fuzzing/common/MachOParse.mm

@@ -1,40 +0,0 @@
-#import <Foundation/Foundation.h>
-#include <libproc.h>
-#include <stddef.h>
-#include <stdint.h>
-
-#import "Source/common/SNTFileInfo.h"
-
-int get_num_fds() {
-  return proc_pidinfo(getpid(), PROC_PIDLISTFDS, 0, NULL, 0) / PROC_PIDLISTFD_SIZE;
-}
-
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
-  static NSString *tmpPath =
-    [NSTemporaryDirectory() stringByAppendingPathComponent:[[NSUUID UUID] UUIDString]];
-
-  int num_fds_pre = get_num_fds();
-
-  @autoreleasepool {
-    NSData *input = [NSData dataWithBytesNoCopy:(void *)data length:size freeWhenDone:false];
-    [input writeToFile:tmpPath atomically:false];
-
-    NSError *error;
-    SNTFileInfo *fi = [[SNTFileInfo alloc] initWithResolvedPath:tmpPath error:&error];
-    if (!fi || error != nil) {
-      NSLog(@"Error: %@", error);
-      return -1;
-    }
-
-    // Mach-O Parsing
-    [fi architectures];
-    [fi isMissingPageZero];
-    [fi infoPlist];
-  }
-
-  if (num_fds_pre != get_num_fds()) {
-    abort();
-  }
-
-  return 0;
-}

Fuzzing/fuzzing.bzl

@@ -1,20 +0,0 @@
-"""Utilities for fuzzing Santa"""
-
-load("@rules_fuzzing//fuzzing:cc_defs.bzl", "cc_fuzz_test")
-
-def objc_fuzz_test(name, srcs, deps, corpus, linkopts = [], **kwargs):
-    native.objc_library(
-        name = "%s_lib" % name,
-        srcs = srcs,
-        deps = deps,
-        **kwargs
-    )
-
-    cc_fuzz_test(
-        name = name,
-        deps = [
-            "%s_lib" % name,
-        ],
-        linkopts = linkopts,
-        corpus = corpus,
-    )

Fuzzing/install_libclang_fuzzer.sh

@@ -1,14 +0,0 @@
-#!/bin/bash
-# Xcode doesn't include the fuzzer runtime, but the one LLVM ships is compatible with Apple clang.
-set -uexo pipefail
-
-CLANG_VERSION=$(clang --version | head -n 1 | cut -d' ' -f 4)
-DST_PATH="$(xcode-select -p)/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/${CLANG_VERSION}/lib/darwin/libclang_rt.fuzzer_osx.a"
-
-if [ -f ${DST_PATH} ]; then
-  exit 0;
-fi
-
-curl -O -L https://github.com/llvm/llvm-project/releases/download/llvmorg-${CLANG_VERSION}/clang+llvm-${CLANG_VERSION}-x86_64-apple-darwin.tar.xz
-tar xvf clang+llvm-${CLANG_VERSION}-x86_64-apple-darwin.tar.xz clang+llvm-${CLANG_VERSION}-x86_64-apple-darwin/lib/clang/${CLANG_VERSION}/lib/darwin/libclang_rt.fuzzer_osx.a
-cp clang+llvm-${CLANG_VERSION}-x86_64-apple-darwin/lib/clang/${CLANG_VERSION}/lib/darwin/libclang_rt.fuzzer_osx.a ${DST_PATH}

Fuzzing/santacache/.gitignore

@@ -1,3 +0,0 @@
-santacache.dSYM
-santacache
-

Fuzzing/santacache/src/main.cpp

@@ -1,43 +0,0 @@
-/// Copyright 2018 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#include <SantaCache.h>
-
-#include <cstdint>
-#include <iostream>
-
-extern "C" int LLVMFuzzerTestOneInput(const std::uint8_t *data,
-                                      std::size_t size) {
-  static SantaCache<uint64_t, uint64_t> decision_cache(5000, 2);
-
-  std::uint64_t fields[2] = {};
-
-  if (size > 16) {
-    std::cout << "Invalid size! Start with -max_len=16\n";
-    return 1;
-  }
-
-  std::memcpy(fields, data, size);
-
-  decision_cache.set(fields[0], fields[1]);
-  auto returned_value = decision_cache.get(fields[0]);
-
-  if (returned_value != fields[1]) {
-    std::cout << fields[0] << ", " << fields[1] << " -> " << returned_value
-              << "\n";
-    return 1;
-  }
-
-  return 0;
-}

Fuzzing/santactl/santactl_fuzzer_seed_corpus/example01

@@ -1,16 +0,0 @@
-{
-  "rules": [
-    {
-      "rule_type": "BINARY",
-      "policy": "BLACKLIST",
-      "sha256": "2dc104631939b4bdf5d6bccab76e166e37fe5e1605340cf68dab919df58b8eda",
-      "custom_msg": "blacklist firefox"
-    },
-    {
-      "rule_type": "CERTIFICATE",
-      "policy": "BLACKLIST",
-      "sha256": "e7726cf87cba9e25139465df5bd1557c8a8feed5c7dd338342d8da0959b63c8d",
-      "custom_msg": "blacklist dash app certificate"
-    }
-  ]
-}

Fuzzing/santactl/src/main.mm

@@ -1,62 +0,0 @@
-/// Copyright 2018 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#include <cstdint>
-#include <iostream>
-#include <vector>
-
-#include <SNTRule.h>
-#include <SNTSyncConstants.h>
-#include <SNTSyncRuleDownload.h>
-#include <SNTSyncState.h>
-
-extern "C" int LLVMFuzzerTestOneInput(const std::uint8_t *data, std::size_t size) {
-  NSData *buffer = [NSData dataWithBytes:static_cast<const void *>(data) length:size];
-  if (!buffer) {
-    return 0;
-  }
-
-  NSError *error;
-  NSDictionary *response = [NSJSONSerialization JSONObjectWithData:buffer options:0 error:&error];
-  if (!response) {
-    return 0;
-  }
-
-  if (![response isKindOfClass:[NSDictionary class]]) {
-    return 0;
-  }
-
-  if (![response objectForKey:kRules]) {
-    return 0;
-  }
-
-  SNTSyncState *state = [[SNTSyncState alloc] init];
-  if (!state) {
-    return 0;
-  }
-
-  SNTSyncRuleDownload *obj = [[SNTSyncRuleDownload alloc] initWithState:state];
-  if (!obj) {
-    return 0;
-  }
-
-  for (NSDictionary *ruleDict in response[kRules]) {
-    SNTRule *rule = [obj ruleFromDictionary:ruleDict];
-    if (rule) {
-      std::cerr << "Rule: " << [[rule description] UTF8String] << "\n";
-    }
-  }
-
-  return 0;
-}

Fuzzing/santad/santad_databaseRemoveEventsWithIDs_fuzzer_seed_corpus/example01

@@ -1 +0,0 @@
-К'.p▒└G╗М┐║ЙSЮ╝и▌РУерЭxt1iАЫШ9ы*H╩4R"═©$-├Уww╙+Р╝╘[┼иу╧oС┬ОwRpЗя≤х°е

Fuzzing/santad/src/checkCacheForVnodeID.mm

@@ -1,59 +0,0 @@
-/// Copyright 2018 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#include <cstdint>
-#include <iostream>
-
-#import <MOLXPCConnection/MOLXPCConnection.h>
-
-#import "SNTCommandController.h"
-#import "SNTRule.h"
-#import "SNTXPCControlInterface.h"
-#import "Source/common/SNTCommonEnums.h"
-
-extern "C" int LLVMFuzzerTestOneInput(const std::uint8_t *data, std::size_t size) {
-  if (size > 16) {
-    std::cerr << "Invalid buffer size of " << size << " (should be <= 16)" << std::endl;
-
-    return 1;
-  }
-
-  SantaVnode vnodeID = {};
-  std::memcpy(&vnodeID, data, size);
-
-  MOLXPCConnection *daemonConn = [SNTXPCControlInterface configuredConnection];
-  daemonConn.invalidationHandler = ^{
-    printf("An error occurred communicating with the daemon, is it running?\n");
-    exit(1);
-  };
-
-  [daemonConn resume];
-
-  [[daemonConn remoteObjectProxy]
-    checkCacheForVnodeID:vnodeID
-               withReply:^(SNTAction action) {
-                 if (action == SNTActionRespondAllow) {
-                   std::cerr << "File exists in [whitelist] kernel cache" << std::endl;
-                   ;
-                 } else if (action == SNTActionRespondDeny) {
-                   std::cerr << "File exists in [blacklist] kernel cache" << std::endl;
-                   ;
-                 } else if (action == SNTActionUnset) {
-                   std::cerr << "File does not exist in cache" << std::endl;
-                   ;
-                 }
-               }];
-
-  return 0;
-}

Fuzzing/santad/src/databaseRemoveEventsWithIDs.mm

@@ -1,51 +0,0 @@
-/// Copyright 2018 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#include <cstdint>
-#include <iostream>
-
-#import <MOLXPCConnection/MOLXPCConnection.h>
-
-#import "SNTCommandController.h"
-#import "SNTRule.h"
-#import "SNTXPCControlInterface.h"
-
-#pragma pack(push, 1)
-
-#pragma pack(pop)
-
-extern "C" int LLVMFuzzerTestOneInput(const std::uint8_t *data, std::size_t size) {
-  auto *eventId = reinterpret_cast<const std::uint64_t *>(data);
-  std::size_t eventIdCount = size / sizeof(std::uint64_t);
-  if (eventIdCount == 0) {
-    return 0;
-  }
-
-  MOLXPCConnection *daemonConn = [SNTXPCControlInterface configuredConnection];
-  daemonConn.invalidationHandler = ^{
-    printf("An error occurred communicating with the daemon, is it running?\n");
-    exit(1);
-  };
-
-  [daemonConn resume];
-
-  NSMutableSet *eventIds = [NSMutableSet setWithCapacity:eventIdCount];
-  for (std::size_t i = 0; i < eventIdCount; i++) {
-    auto id = [NSNumber numberWithInteger:eventId[i]];
-    [eventIds addObject:id];
-  }
-
-  [[daemonConn remoteObjectProxy] databaseRemoveEventsWithIDs:[eventIds allObjects]];
-  return 0;
-}

Fuzzing/santad/src/databaseRuleAddRules.mm

@@ -1,74 +0,0 @@
-/// Copyright 2018 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#include <cstdint>
-#include <iostream>
-
-#import <MOLXPCConnection/MOLXPCConnection.h>
-
-#import "SNTCommandController.h"
-#import "SNTCommonEnums.h"
-#import "SNTRule.h"
-#import "SNTXPCControlInterface.h"
-
-#pragma pack(push, 1)
-
-struct InputData {
-  std::uint32_t cleanSlate;
-  std::uint32_t state;
-  std::uint32_t type;
-  char hash[33];
-};
-
-#pragma pack(pop)
-
-extern "C" int LLVMFuzzerTestOneInput(const std::uint8_t *data, std::size_t size) {
-  if (size > sizeof(InputData)) {
-    std::cerr << "Invalid buffer size of " << size << " (should be <= " << sizeof(InputData) << ")"
-              << std::endl;
-
-    return 1;
-  }
-
-  InputData input_data = {};
-  std::memcpy(&input_data, data, size);
-
-  SNTRule *newRule = [[SNTRule alloc] init];
-  newRule.state = (SNTRuleState)input_data.state;
-  newRule.type = (SNTRuleType)input_data.type;
-  newRule.identifier = @(input_data.hash);
-  newRule.customMsg = @"";
-
-  MOLXPCConnection *daemonConn = [SNTXPCControlInterface configuredConnection];
-  daemonConn.invalidationHandler = ^{
-    printf("An error occurred communicating with the daemon, is it running?\n");
-    exit(1);
-  };
-
-  [daemonConn resume];
-  [[daemonConn remoteObjectProxy]
-    databaseRuleAddRules:@[ newRule ]
-             ruleCleanup:SNTRuleCleanupNone
-                   reply:^(NSError *error) {
-                     if (!error) {
-                       if (newRule.state == SNTRuleStateRemove) {
-                         printf("Removed rule for SHA-256: %s.\n", [newRule.identifier UTF8String]);
-                       } else {
-                         printf("Added rule for SHA-256: %s.\n", [newRule.identifier UTF8String]);
-                       }
-                     }
-                   }];
-
-  return 0;
-}

LICENSE

@@ -200,4 +200,3 @@
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.
-

MODULE.bazel

@@ -1,56 +0,0 @@
-module(name = "santa")
-
-bazel_dep(name = "apple_support", version = "1.15.1", repo_name = "build_bazel_apple_support")
-bazel_dep(name = "abseil-cpp", version = "20240116.2", repo_name = "com_google_absl")
-bazel_dep(name = "rules_python", version = "0.33.2")
-bazel_dep(name = "rules_cc", version = "0.0.9")
-bazel_dep(name = "rules_apple", version = "3.8.0", repo_name = "build_bazel_rules_apple")
-bazel_dep(name = "rules_swift", version = "2.0.0-rc1", repo_name = "build_bazel_rules_swift")
-bazel_dep(name = "rules_fuzzing", version = "0.5.2")
-bazel_dep(name = "protobuf", version = "27.2", repo_name = "com_google_protobuf")
-bazel_dep(name = "googletest", version = "1.14.0.bcr.1", repo_name = "com_google_googletest")
-
-# MOLCertificate
-bazel_dep(name = "molcertificate", version = "2.1", repo_name = "MOLCertificate")
-git_override(
-    module_name = "molcertificate",
-    commit = "34f0ccf68a34a07cc636ada89057c529f90bec3a",
-    remote = "https://github.com/google/macops-molcertificate.git",
-)
-
-# MOLAuthenticatingURLSession
-bazel_dep(name = "molauthenticatingurlsession", version = "3.0", repo_name = "MOLAuthenticatingURLSession")
-git_override(
-    module_name = "molauthenticatingurlsession",
-    commit = "0a50a67f29d635a4012981714c1dedef9ac25fe6",
-    remote = "https://github.com/google/macops-molauthenticatingurlsession.git",
-)
-
-# MOLCodesignChecker
-bazel_dep(name = "molcodesignchecker", version = "3.0", repo_name = "MOLCodesignChecker")
-git_override(
-    module_name = "molcodesignchecker",
-    commit = "5060bcc8baa90bae3b0ca705d14850328bbbec53",
-    remote = "https://github.com/google/macops-molcodesignchecker.git",
-)
-
-# MOLXPCConnection
-bazel_dep(name = "molxpcconnection", version = "2.1", repo_name = "MOLXPCConnection")
-git_override(
-    module_name = "molxpcconnection",
-    commit = "da816dc49becac96d941ef6a5c4153ed39d1fe7c",
-    remote = "https://github.com/russellhancox/macops-molxpcconnection.git",
-)
-
-# FMDB
-non_module_deps = use_extension("//:non_module_deps.bzl", "non_module_deps")
-use_repo(non_module_deps, "FMDB")
-use_repo(non_module_deps, "OCMock")
-
-# Hedron's Compile Commands Extractor
-bazel_dep(name = "hedron_compile_commands", dev_dependency = True)
-git_override(
-    module_name = "hedron_compile_commands",
-    commit = "0e990032f3c5a866e72615cf67e5ce22186dcb97",
-    remote = "https://github.com/hedronvision/bazel-compile-commands-extractor.git",
-)

Podfile

@@ -0,0 +1,49 @@
+platform :osx, "10.9"
+
+inhibit_all_warnings!
+
+target :Santa do
+  pod 'MOLCertificate'
+  pod 'MOLCodesignChecker'
+end
+
+target :santad do
+  pod 'FMDB'
+  pod 'MOLCertificate'
+  pod 'MOLCodesignChecker'
+end
+
+target :santactl do
+  pod 'FMDB'
+  pod 'MOLAuthenticatingURLSession'
+  pod 'MOLCertificate'
+  pod 'MOLCodesignChecker'
+  pod 'MOLFCMClient', '~> 1.3'
+end
+
+target :LogicTests do
+  pod 'FMDB'
+  pod 'MOLAuthenticatingURLSession'
+  pod 'MOLCertificate'
+  pod 'MOLCodesignChecker'
+  pod 'OCMock'
+end
+
+post_install do |installer|
+  installer.pods_project.targets.each do |target|
+    target.build_configurations.each do |config|
+      if config.name != 'Release' then
+        break
+      end
+
+      # This is necessary to get FMDB to not NSLog stuff.
+      config.build_settings['GCC_PREPROCESSOR_DEFINITIONS'] ||= ''
+      config.build_settings['GCC_PREPROCESSOR_DEFINITIONS'] <<= "NDEBUG=1"
+
+      # Enable more compiler optimizations.
+      config.build_settings['GCC_OPTIMIZATION_LEVEL'] = 'fast'
+      config.build_settings['LLVM_LTO'] = 'YES'
+    end
+  end
+end
+

Podfile.lock

@@ -0,0 +1,32 @@
+PODS:
+  - FMDB (2.6.2):
+    - FMDB/standard (= 2.6.2)
+  - FMDB/standard (2.6.2)
+  - MOLAuthenticatingURLSession (2.2):
+    - MOLCertificate (~> 1.5)
+  - MOLCertificate (1.5)
+  - MOLCodesignChecker (1.5):
+    - MOLCertificate (~> 1.3)
+  - MOLFCMClient (1.3):
+    - MOLAuthenticatingURLSession (~> 2.1)
+  - OCMock (3.4)
+
+DEPENDENCIES:
+  - FMDB
+  - MOLAuthenticatingURLSession
+  - MOLCertificate
+  - MOLCodesignChecker
+  - MOLFCMClient (~> 1.3)
+  - OCMock
+
+SPEC CHECKSUMS:
+  FMDB: 854a0341b4726e53276f2a8996f06f1b80f9259a
+  MOLAuthenticatingURLSession: 5a5e31eb73248c3e92c79b9a285f031194e8404c
+  MOLCertificate: c39cae866d24d36fbc78032affff83d401b5384a
+  MOLCodesignChecker: fc9c64147811d7b0d0739127003e0630dff9213a
+  MOLFCMClient: 13d8b42db9d750e772f09cc38fc453922fece09f
+  OCMock: 35ae71d6a8fcc1b59434d561d1520b9dd4f15765
+
+PODFILE CHECKSUM: 1728b86e95e7cdb481dd91ab9c38af38e060a023
+
+COCOAPODS: 1.2.1

README.md

@@ -1,155 +1,169 @@
-# Santa
-
-> [!NOTE]
-> **As of 2025, Santa is no longer maintained by Google.**  We encourage
-> existing users to migrate to an actively maintained fork of Santa, such as
-> https://github.com/northpolesec/santa.
-
----
-
-[![license](https://img.shields.io/github/license/google/santa)](https://github.com/google/santa/blob/main/LICENSE)
-[![CI](https://github.com/google/santa/actions/workflows/ci.yml/badge.svg)](https://github.com/google/santa/actions/workflows/ci.yml)
-[![latest release](https://img.shields.io/github/v/release/google/santa.svg)](https://github.com/google/santa/releases/latest)
-[![latest release date](https://img.shields.io/github/release-date/google/santa.svg)](https://github.com/google/santa/releases/latest)
-[![downloads](https://img.shields.io/github/downloads/google/santa/latest/total)](https://github.com/google/santa/releases/latest)
+Santa  [![Build Status](https://travis-ci.org/google/santa.png?branch=master)](https://travis-ci.org/google/santa)
+=====
 
 <p align="center">
-    <img src="./docs/images/santa-sleigh-256.png" height="128" alt="Santa Icon" />
+<a href="#santa--">
+<img src="./Source/SantaGUI/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-128.png" alt="Santa Icon" />
+</a>
 </p>
 
-Santa is a binary and file access authorization system for macOS. It consists of a system
-extension that monitors for executions, a daemon that makes execution decisions
-based on the contents of a local database, a GUI agent that notifies the user in
-case of a block decision and a command-line utility for managing the system and
-synchronizing the database with a server.
+Santa is a binary whitelisting/blacklisting system for macOS. It consists of
+a kernel extension that monitors for executions, a userland daemon that makes
+execution decisions based on the contents of a SQLite database, a GUI agent that
+notifies the user in case of a block decision and a command-line utility for
+managing the system and synchronizing the database with a server.
+
+Santa is not yet a 1.0. We're writing more tests, fixing bugs, working on TODOs
+and finishing up a security audit.
 
 It is named Santa because it keeps track of binaries that are naughty or nice.
 
-# Docs
+Santa is a project of Google's Macintosh Operations Team.
 
-The Santa docs are stored in the
-[Docs](https://github.com/google/santa/blob/main/docs) directory and are published
-at https://santa.dev.
+Admin-Related Features
+========
 
-The docs include deployment options, details on how parts of Santa work and
-instructions for developing Santa itself.
+* Multiple modes: In the default MONITOR mode, all binaries except
+those marked as blacklisted will be allowed to run, whilst being logged and recorded in the events database. In LOCKDOWN mode, only whitelisted binaries are
+allowed to run.
 
-# Get Help
+* Event logging: When the kext is loaded, all binary launches are logged.
+When in either mode, all unknown or denied binaries are stored in the database to enable later aggregation.
 
-If you have questions or otherwise need help getting started,
-the [santa-dev](https://groups.google.com/forum/#!forum/santa-dev) group is a
-great place.
+* Certificate-based rules, with override levels: Instead of relying on a binaries hash (or 'fingerprint'), executables can be whitelisted/blacklisted by their signing
+certificate. You can therefore trust/block all binaries by a given publisher that were signed with that cert across version updates. A
+binary can only be whitelisted by its certificate if its signature validates
+correctly, but a rule for a binaries fingerprint will override a decision for a
+certificate; i.e. you can whitelist a certificate while blacklisting a binary
+signed with that certificate, or vice-versa.
 
-If you believe you have a bug, feel free to report [an
-issue](https://github.com/google/santa/issues) and we'll respond as soon as we
-can.
+* Path-based rules (via NSRegularExpression/ICU): This allows a similar feature as Managed Client for OS X's (the precursor to configuration profiles, which used the same implementation mechanism) Application Launch Restrictions via the mcxalr binary. This implementation carries the added benefit of being configurable via regex, and doesn't rely on LaunchServices. As detailed in the wiki, when evaluating rules this holds the lowest precendence.
 
-If you believe you've found a vulnerability, please read the
-[security policy](https://github.com/google/santa/security/policy) for
-disclosure reporting.
-
-# Features
-
-* Multiple modes: In the default MONITOR mode, all binaries except those marked
-  as blocked will be allowed to run, whilst being logged and recorded in
-  the events database. In LOCKDOWN mode, only listed binaries are allowed to
-  run.
-
-* Event logging: When the system extension is loaded, all binary launches are logged. When in either mode, all unknown or denied binaries are stored in the database to enable later aggregation.
-
-* Certificate-based rules, with override levels: Instead of relying on a
-  binary's hash (or 'fingerprint'), executables can be allowed/blocked by their
-  signing certificate. You can therefore allow/block all binaries by a
-  given publisher that were signed with that cert across version updates. A
-  binary can only be allowed by its certificate if its signature validates
-  correctly but a rule for a binary's fingerprint will override a decision for
-  a certificate; i.e. you can allowlist a certificate while blocking a binary
-  signed with that certificate, or vice-versa.
-
-* Path-based rules (via NSRegularExpression/ICU): This allows a similar feature
-  to that found in Managed Client (the precursor to configuration profiles,
-  which used the same implementation mechanism), Application Launch
-  Restrictions via the mcxalr binary. This implementation carries the added
-  benefit of being configurable via regex, and not relying on LaunchServices.
-  As detailed in the wiki, when evaluating rules this holds the lowest
-  precedence.
-
-* Failsafe cert rules: You cannot put in a deny rule that would block the
-  certificate used to sign launchd, a.k.a. pid 1, and therefore all components
-  used in macOS. The binaries in every OS update (and in some cases entire new
-  versions) are therefore automatically allowed. This does not affect binaries
-  from Apple's App Store, which use various certs that change regularly for
-  common apps. Likewise, you cannot block Santa itself, and Santa uses a
-  distinct separate cert than other Google apps.
-
-* Userland components validate each other: each of the userland components (the
-  daemon, the GUI agent and the command-line utility) communicate with each
-  other using XPC and check that their signing certificates are identical
-  before any communication is accepted.
-
-* Caching: allowed binaries are cached so the processing required to make a
-  request is only done if the binary isn't already cached.
-
-# Intentions and Expectations
+* Failsafe cert rules: You cannot put in a deny rule that would block the certificate used to sign launchd, a.k.a. pid 1, and therefore all components used in macOS. The binaries in every OS update (and in some cases entire new versions) are therefore auto-whitelisted. This does not affect binaries from Apple's App Store, which use various certs that change regularly for common apps. Likewise, you cannot blacklist Santa itself, and Santa uses a distinct separate cert than other Google apps.
 
+Intentions and Expectations
+===========================
 No single system or process will stop *all* attacks, or provide 100% security.
 Santa is written with the intention of helping protect users from themselves.
 People often download malware and trust it, giving the malware credentials, or
 allowing unknown software to exfiltrate more data about your system. As a
 centrally managed component, Santa can help stop the spread of malware among a
-large fleet of machines. Independently, Santa can aid in analyzing what is
+larger fleet of machines. Independently, Santa can aid in analyzing what is
 running on your computer.
 
-Santa is part of a defense-in-depth strategy, and you should continue to
-protect hosts in whatever other ways you see fit.
+Santa is part of a defense-in-depth strategy, and you should continue to protect
+hosts in whatever other ways you see fit.
 
-# Security and Performance-Related Features
+Get Help
+========
 
-# Known Issues
+If you have questions or otherwise need help getting started, the
+[santa-dev](https://groups.google.com/forum/#!forum/santa-dev) group is a
+great place. Please consult the [wiki](https://github.com/google/santa/wiki) and [issues](https://github.com/google/santa/issues) as well.
+
+Security and Performance-Related Features
+============
+* In-kernel caching: whitelisted binaries are cached in the kernel so the
+processing required to make a request is only done if the binary
+isn't already cached.
+
+* Userland components validate each other: each of the userland components (the
+daemon, the GUI agent and the command-line utility) communicate with each other
+using XPC and check that their signing certificates are identical before any
+communication is accepted.
+
+* Kext uses only KPIs: the kernel extension only uses provided kernel
+programming interfaces to do its job. This means that the kext code should
+continue to work across OS versions.
+
+Known Issues
+============
+Santa is not yet a 1.0 and we have some known issues to be aware of:
 
 * Santa only blocks execution (execve and variants), it doesn't protect against
-  dynamic libraries loaded with dlopen, libraries on disk that have been
-  replaced, or libraries loaded using `DYLD_INSERT_LIBRARIES`.
+dynamic libraries loaded with dlopen, libraries on disk that have been replaced, or
+libraries loaded using `DYLD_INSERT_LIBRARIES`. As of version 0.9.1 we *do* address [__PAGEZERO missing issues](b87482e) that were exploited in some versions of macOS. We are working on also protecting against similar avenues of attack.
+
+* Kext communication security: the kext will only accept a connection from a
+single client at a time and said client must be running as root. We haven't yet
+found a good way to ensure the kext only accepts connections from a valid client.
+
+* Database protection: the SQLite database is installed with permissions so that
+only the root user can read/write it. We're considering approaches to secure
+this further.
+
+* Sync client: The `santactl` command-line client includes a flag to synchronize with a management server, which uploads events that have occurred on the
+machine and downloads new rules. We're still very heavily working on this
+server (which is AppEngine-based and will be open-sourced in the future), so the
+sync client code is unfinished. It does show the 'API' that we're expecting to
+use so if you'd like to write your own management server, feel free to look at
+how the client currently works (and suggest changes!)
 
 * Scripts: Santa is currently written to ignore any execution that isn't a
-  binary. This is because after weighing the administration cost vs the
-  benefit, we found it wasn't worthwhile. Additionally, a number of
-  applications make use of temporary generated scripts, which we can't possibly
-  allowlist and not doing so would cause problems. We're happy to revisit this
-  (or at least make it an option) if it would be useful to others.
+binary. This is because after weighing the administration cost vs the benefit,
+we found it wasn't worthwhile. Additionally, a number of applications make use
+of temporary generated scripts, which we can't possibly whitelist and not doing
+so would cause problems. We're happy to revisit this (or at least make it an
+option) if it would be useful to others.
 
-# Sync Servers
+* Documentation: This is currently limited.
 
-* The `santactl` command-line client includes a flag to synchronize with a
-  management server, which uploads events that have occurred on the machine and
-  downloads new rules. There are several open-source servers you can sync with:
+* Tests: There aren't enough of them.
 
-    * [Moroz](https://github.com/groob/moroz) - A simple golang server that
-      serves hardcoded rules from simple configuration files.
-    * [Rudolph](https://github.com/airbnb/rudolph) - An AWS-based serverless sync service
-      primarily built on API GW, DynamoDB, and Lambda components to reduce operational burden.
-      Rudolph is designed to be fast, easy-to-use, and cost-efficient.
-    * [Zentral](https://github.com/zentralopensource/zentral/wiki) - A
-      centralized service that pulls data from multiple sources and deploy
-      configurations to multiple services.
-    * [Zercurity](https://github.com/zercurity/zercurity) - A dockerized service
-      for managing and monitoring applications across a large fleet utilizing
-      Santa + Osquery.
+Screenshots
+===========
 
-* Alternatively, `santactl` can configure rules locally (without a sync
-  server).
+A tool like Santa doesn't really lend itself to screenshots, so here's a video instead.
 
-# Screenshots
+<p align="center">
+<img src="https://zippy.gfycat.com/MadFatalAmphiuma.gif" alt="Santa Block Video" />
+</p>
 
-A tool like Santa doesn't really lend itself to screenshots, so here's a video
-instead.
+Building
+========
+Firstly, make sure you're using Xcode 7.3.1 as currently we do not support
+building with Xcode 8.
 
+```sh
+git clone https://github.com/google/santa
+cd santa
 
-<p align="center"> <img src="./docs/images/santa-block.gif" alt="Santa Block Video" /> </p>
+# Build a debug build. This will install any necessary CocoaPods, create the
+# workspace and build, outputting the full log only if an error occurred.
+# If CocoaPods is not installed, you'll be prompted to install it.
+#
+# For other build/install/run options, run rake without any arguments
+rake build:debug
+```
 
-# Contributing
-Patches to this project are very much welcome. Please see the
-[CONTRIBUTING](https://santa.dev/development/contributing) doc.
+Note: the Xcode project is setup to use any installed "Mac Developer" certificate
+and for security-reasons parts of Santa will not operate properly if not signed.
 
-# Disclaimer
+Kext Signing
+============
+Kernel extensions on macOS 10.9 and later must be signed using an Apple-provided
+Developer ID certificate with a kernel extension flag. Without it, the only way
+to load an extension is to enable kext-dev-mode or disable SIP, depending on the
+OS version.
+
+There are two possible solutions for this, for distribution purposes:
+
+1) Use a [pre-built, pre-signed version](https://github.com/google/santa/releases)
+of the kext that we supply. Each time changes are made to the kext code we will
+update the pre-built version that you can make use of. This doesn't prevent you
+from making changes to the non-kext parts of Santa and distributing those.
+If you make changes to the kext and make a pull request, we can merge them in
+and distribute a new version of the pre-signed kext.
+
+2) Apply for your own [kext signing certificate](https://developer.apple.com/contact/kext/).
+Apple will only grant this for broad distribution within an organization, they
+won't issue them just for testing purposes.
+
+Contributing
+============
+Patches to this project are very much welcome. Please see the [CONTRIBUTING](https://github.com/google/santa/blob/master/CONTRIBUTING.md)
+file.
+
+Disclaimer
+==========
 This is **not** an official Google product.

Rakefile

@@ -0,0 +1,224 @@
+require 'openssl'
+
+WORKSPACE           = 'Santa.xcworkspace'
+DEFAULT_SCHEME      = 'All'
+OUTPUT_PATH         = 'Build'
+BINARIES            = ['Santa.app', 'santa-driver.kext']
+DSYMS               = ['Santa.app.dSYM', 'santa-driver.kext.dSYM', 'santad.dSYM', 'santactl.dSYM']
+XCPRETTY_DEFAULTS   = '-sc'
+XCODEBUILD_DEFAULTS = "-workspace #{WORKSPACE} -derivedDataPath #{OUTPUT_PATH} -parallelizeTargets"
+DEVTEAM_FILE        = 'Source/DevelopmentTeam.xcconfig'
+DEVTEAM_CERT_CN     = 'Mac Developer'
+$DISABLE_XCPRETTY   = false
+
+task :default do
+  system("rake -sT")
+end
+
+def xcodebuild(opts)
+  command = "xcodebuild #{XCODEBUILD_DEFAULTS} #{opts}"
+  if not $DISABLE_XCPRETTY
+    command << " | xcpretty #{XCPRETTY_DEFAULTS} && exit ${PIPESTATUS[0]}"
+  end
+
+  if system command
+    puts "\e[32mPass\e[0m"
+  else
+    raise "\e[31mFail\e[0m"
+  end
+end
+
+def xcodebuilddir
+  if not $xcode_build_dir
+    output = `xcodebuild #{XCODEBUILD_DEFAULTS} -scheme All -showBuildSettings`
+    if match = output.match(/BUILD_DIR = (.*)/)
+        $xcode_build_dir = match.captures.first
+        puts "Found Xcode build dir #{$xcode_build_dir}"
+    end
+  end
+  $xcode_build_dir
+end
+
+task :init do
+  unless File.exists?(WORKSPACE) and File.exists?('Pods')
+    puts "Pods missing, running 'pod install'"
+    system "pod install" or raise "CocoaPods is not installed. Install with 'sudo gem install cocoapods'"
+  end
+  unless system 'xcpretty -v >/dev/null 2>&1'
+    puts "xcpretty is not installed. Install with 'sudo gem install xcpretty'"
+    $DISABLE_XCPRETTY = true
+  end
+  cert_pem = `security find-certificate -p -c '#{DEVTEAM_CERT_CN}'`
+  cert = OpenSSL::X509::Certificate.new cert_pem
+  team_id = cert.subject.to_a.find {|f| f[0] == "OU"}[1]
+  File.open(DEVTEAM_FILE, 'w') { |f|
+    f.puts("// This file is auto-generated. Do not edit manually")
+    f.puts("DEVELOPMENT_TEAM = #{team_id}")
+  }
+end
+
+task :remove_existing do
+  system 'sudo rm -rf /Library/Extensions/santa-driver.kext'
+  system 'sudo rm -rf /Applications/Santa.app'
+end
+
+desc "Clean"
+task :clean => :init do
+  puts "Cleaning"
+  FileUtils.rm_rf(OUTPUT_PATH)
+  xcodebuild("-scheme All clean")
+end
+
+# Build
+namespace :build do
+  desc "Build: Debug"
+  task :debug do
+    Rake::Task['build:build'].invoke("Debug")
+  end
+
+  desc "Build: Release"
+  task :release do
+    Rake::Task['build:build'].invoke("Release")
+  end
+
+  task :build, [:configuration] => :init do |t, args|
+    config = args[:configuration]
+    puts "Building with configuration: #{config}"
+    xcodebuild("-scheme All -configuration #{config} build")
+  end
+end
+
+
+# Install
+namespace :install do
+  desc "Install: Debug"
+  task :debug do
+    Rake::Task['install:install'].invoke("Debug")
+  end
+
+  desc "Install: Release"
+  task :release do
+    Rake::Task['install:install'].invoke("Release")
+  end
+
+  task :install, [:configuration] do |t, args|
+    config = args[:configuration]
+    system 'sudo cp conf/com.google.santad.plist /Library/LaunchDaemons'
+    system 'sudo cp conf/com.google.santagui.plist /Library/LaunchAgents'
+    system 'sudo cp conf/com.google.santa.asl.conf /etc/asl'
+    Rake::Task['build:build'].invoke(config)
+    puts "Installing with configuration: #{config}"
+    Rake::Task['remove_existing'].invoke()
+    system "sudo cp -r #{xcodebuilddir}/#{config}/santa-driver.kext /Library/Extensions"
+    system "sudo cp -r #{xcodebuilddir}/#{config}/Santa.app /Applications"
+  end
+end
+
+# Dist
+task :dist do
+  desc "Create distribution folder"
+
+  Rake::Task['clean'].invoke()
+  Rake::Task['build:build'].invoke("Release")
+
+  dist_path = "santa-#{`defaults read #{xcodebuilddir}/Release/santa-driver.kext/Contents/Info.plist CFBundleVersion`.strip}"
+
+  FileUtils.rm_rf(dist_path)
+
+  FileUtils.mkdir_p("#{dist_path}/binaries")
+  FileUtils.mkdir_p("#{dist_path}/conf")
+  FileUtils.mkdir_p("#{dist_path}/dsym")
+
+  BINARIES.each do |x|
+    FileUtils.cp_r("#{xcodebuilddir}/Release/#{x}", "#{dist_path}/binaries")
+  end
+
+  DSYMS.each do |x|
+    FileUtils.cp_r("#{xcodebuilddir}/Release/#{x}", "#{dist_path}/dsym")
+  end
+
+
+  Dir.glob("Conf/*") {|x| File.directory?(x) or FileUtils.cp(x, "#{dist_path}/conf")}
+
+  puts "Distribution folder #{dist_path} created"
+end
+
+# Tests
+namespace :tests do
+  desc "Tests: Logic"
+  task :logic => [:init] do
+    puts "Running logic tests"
+    xcodebuild("-scheme LogicTests test")
+  end
+
+  desc "Tests: Kernel"
+  task :kernel do
+    Rake::Task['unload'].invoke()
+    Rake::Task['install:debug'].invoke()
+    Rake::Task['load_kext'].invoke
+    FileUtils.mkdir_p("/tmp/santa_kerneltests_tmp")
+    begin
+      puts "\033[?25l\033[12h"  # hide cursor
+      puts "Running kernel tests"
+      system "cd /tmp/santa_kerneltests_tmp && sudo #{xcodebuilddir}/Debug/KernelTests"
+    rescue Exception
+    ensure
+      puts "\033[?25h\033[12l\n\n"  # unhide cursor
+      FileUtils.rm_rf("/tmp/santa_kerneltests_tmp")
+      Rake::Task['unload_kext'].execute
+    end
+  end
+end
+
+# Load/Unload
+task :unload_daemon do
+  puts "Unloading daemon"
+  system "sudo launchctl unload /Library/LaunchDaemons/com.google.santad.plist 2>/dev/null"
+end
+
+task :unload_kext do
+  puts "Unloading kernel extension"
+  system "sudo kextunload -b com.google.santa-driver 2>/dev/null"
+end
+
+task :unload_gui do
+  puts "Unloading GUI agent"
+  system "launchctl unload /Library/LaunchAgents/com.google.santagui.plist 2>/dev/null"
+end
+
+desc "Unload"
+task :unload => [:unload_daemon, :unload_kext, :unload_gui]
+
+task :load_daemon do
+  puts "Loading daemon"
+  system "sudo launchctl load /Library/LaunchDaemons/com.google.santad.plist"
+end
+
+task :load_kext do
+  puts "Loading kernel extension"
+  system "sudo kextload /Library/Extensions/santa-driver.kext"
+end
+
+task :load_gui do
+  puts "Loading GUI agent"
+  system "launchctl load /Library/LaunchAgents/com.google.santagui.plist 2>/dev/null"
+end
+
+desc "Load"
+task :load => [:load_kext, :load_daemon, :load_gui]
+
+namespace :reload do
+  desc "Reload: Debug"
+  task :debug do
+    Rake::Task['unload'].invoke()
+    Rake::Task['install:debug'].invoke()
+    Rake::Task['load'].invoke()
+  end
+
+  desc "Reload: Release"
+  task :release do
+    Rake::Task['unload'].invoke()
+    Rake::Task['install:release'].invoke()
+    Rake::Task['load'].invoke()
+  end
+end

SECURITY.md

@@ -1,14 +0,0 @@
-# Reporting a Vulnerability
-
-If you believe you have found a security vulnerability, we would appreciate a private report
-so that we can work on and release a fix before public disclosure. Any vulnerabilities reported to us will be
-disclosed publicly either when a new version with fixes is released or 90 days has passed,
-whichever comes first.
-
-To report vulnerabilities to us privately, either:
-
-1) Report the vulnerability [through GitHub](https://github.com/google/santa/security/advisories/new).
-
-2) E-mail `santa-team@google.com`. If you want to encrypt your e-mail, you can use our GPG key `0x92AFE41DAB49BBB6` available on keyserver.ubuntu.com:
-
-    `gpg --keyserver keyserver.ubuntu.com --recv-key 0x92AFE41DAB49BBB6`

Santa.xcodeproj/xcshareddata/xcschemes/All.xcscheme

@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0730"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "0D91BCDC174E8AE600131A7D"
+               BuildableName = "All"
+               BlueprintName = "All"
+               ReferencedContainer = "container:Santa.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      codeCoverageEnabled = "YES"
+      enableAddressSanitizer = "YES">
+      <Testables>
+         <TestableReference
+            skipped = "NO">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "0D260DAB18B68E12002A0B55"
+               BuildableName = "LogicTests.xctest"
+               BlueprintName = "LogicTests"
+               ReferencedContainer = "container:Santa.xcodeproj">
+            </BuildableReference>
+         </TestableReference>
+      </Testables>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D91BCDC174E8AE600131A7D"
+            BuildableName = "All"
+            BlueprintName = "All"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

Santa.xcodeproj/xcshareddata/xcschemes/KernelTests.xcscheme

@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0730"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "0D0016A1192BCD3C005E7FCD"
+               BuildableName = "KernelTests"
+               BlueprintName = "KernelTests"
+               ReferencedContainer = "container:Santa.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES">
+      <Testables>
+      </Testables>
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D0016A1192BCD3C005E7FCD"
+            BuildableName = "KernelTests"
+            BlueprintName = "KernelTests"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D0016A1192BCD3C005E7FCD"
+            BuildableName = "KernelTests"
+            BlueprintName = "KernelTests"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D0016A1192BCD3C005E7FCD"
+            BuildableName = "KernelTests"
+            BlueprintName = "KernelTests"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

Santa.xcodeproj/xcshareddata/xcschemes/LogicTests.xcscheme

@@ -0,0 +1,99 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0730"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "NO"
+            buildForArchiving = "NO"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "0D260DAB18B68E12002A0B55"
+               BuildableName = "LogicTests.xctest"
+               BlueprintName = "LogicTests"
+               ReferencedContainer = "container:Santa.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES">
+      <Testables>
+         <TestableReference
+            skipped = "NO">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "0D260DAB18B68E12002A0B55"
+               BuildableName = "LogicTests.xctest"
+               BlueprintName = "LogicTests"
+               ReferencedContainer = "container:Santa.xcodeproj">
+            </BuildableReference>
+         </TestableReference>
+      </Testables>
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D260DAB18B68E12002A0B55"
+            BuildableName = "LogicTests.xctest"
+            BlueprintName = "LogicTests"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D260DAB18B68E12002A0B55"
+            BuildableName = "LogicTests.xctest"
+            BlueprintName = "LogicTests"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D260DAB18B68E12002A0B55"
+            BuildableName = "LogicTests.xctest"
+            BlueprintName = "LogicTests"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

Santa.xcodeproj/xcshareddata/xcschemes/Santa.xcscheme

@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0730"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "0D385DB5180DE4A900418BC6"
+               BuildableName = "Santa.app"
+               BlueprintName = "Santa"
+               ReferencedContainer = "container:Santa.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES">
+      <Testables>
+      </Testables>
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D385DB5180DE4A900418BC6"
+            BuildableName = "Santa.app"
+            BlueprintName = "Santa"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D385DB5180DE4A900418BC6"
+            BuildableName = "Santa.app"
+            BlueprintName = "Santa"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D385DB5180DE4A900418BC6"
+            BuildableName = "Santa.app"
+            BlueprintName = "Santa"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

Santa.xcodeproj/xcshareddata/xcschemes/santa-driver.xcscheme

@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0730"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "0D91BCB3174E8A7E00131A7D"
+               BuildableName = "santa-driver.kext"
+               BlueprintName = "santa-driver"
+               ReferencedContainer = "container:Santa.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES">
+      <Testables>
+      </Testables>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D91BCB3174E8A7E00131A7D"
+            BuildableName = "santa-driver.kext"
+            BlueprintName = "santa-driver"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

Santa.xcodeproj/xcshareddata/xcschemes/santactl.xcscheme

@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0730"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "0D35BD9D18FD71CE00921A21"
+               BuildableName = "santactl"
+               BlueprintName = "santactl"
+               ReferencedContainer = "container:Santa.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES">
+      <Testables>
+      </Testables>
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D35BD9D18FD71CE00921A21"
+            BuildableName = "santactl"
+            BlueprintName = "santactl"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D35BD9D18FD71CE00921A21"
+            BuildableName = "santactl"
+            BlueprintName = "santactl"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D35BD9D18FD71CE00921A21"
+            BuildableName = "santactl"
+            BlueprintName = "santactl"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

Santa.xcodeproj/xcshareddata/xcschemes/santad.xcscheme

@@ -0,0 +1,92 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "0730"
+   version = "1.3">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "0D9A7F3C1759330400035EB5"
+               BuildableName = "santad"
+               BlueprintName = "santad"
+               ReferencedContainer = "container:Santa.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES">
+      <Testables>
+      </Testables>
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D9A7F3C1759330400035EB5"
+            BuildableName = "santad"
+            BlueprintName = "santad"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      debugAsWhichUser = "root"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D9A7F3C1759330400035EB5"
+            BuildableName = "santad"
+            BlueprintName = "santad"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+      <AdditionalOptions>
+      </AdditionalOptions>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "0D9A7F3C1759330400035EB5"
+            BuildableName = "santad"
+            BlueprintName = "santad"
+            ReferencedContainer = "container:Santa.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

Santa.xcworkspace/contents.xcworkspacedata

@@ -0,0 +1 @@
+<?xml version='1.0' encoding='UTF-8'?><Workspace version='1.0'><FileRef location='group:Santa.xcodeproj'/><FileRef location='group:Pods/Pods.xcodeproj'/></Workspace>

Source/SantaGUI/Resources/AboutWindow.xib

@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="6254" systemVersion="14E46" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
+    <dependencies>
+        <deployment identifier="macosx"/>
+        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="6254"/>
+    </dependencies>
+    <objects>
+        <customObject id="-2" userLabel="File's Owner" customClass="SNTAboutWindowController">
+            <connections>
+                <outlet property="moreInfoButton" destination="SRu-Kf-vu5" id="Vj2-9Q-05d"/>
+                <outlet property="window" destination="F0z-JX-Cv5" id="gIp-Ho-8D9"/>
+            </connections>
+        </customObject>
+        <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
+        <customObject id="-3" userLabel="Application" customClass="NSObject"/>
+        <window title="Santa" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" oneShot="NO" releasedWhenClosed="NO" visibleAtLaunch="NO" animationBehavior="default" id="F0z-JX-Cv5">
+            <windowStyleMask key="styleMask" titled="YES" closable="YES"/>
+            <rect key="contentRect" x="196" y="240" width="480" height="200"/>
+            <rect key="screenRect" x="0.0" y="0.0" width="2560" height="1577"/>
+            <view key="contentView" id="se5-gp-TjO">
+                <rect key="frame" x="0.0" y="0.0" width="480" height="200"/>
+                <autoresizingMask key="autoresizingMask"/>
+                <subviews>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="BnL-ZS-kXw">
+                        <rect key="frame" x="199" y="140" width="83" height="40"/>
+                        <constraints>
+                            <constraint firstAttribute="height" constant="40" id="UK2-2L-lPx"/>
+                            <constraint firstAttribute="width" constant="79" id="lDf-D7-qlY"/>
+                        </constraints>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" title="Santa" id="VVj-gU-bzy">
+                            <font key="font" size="34" name="HelveticaNeue-UltraLight"/>
+                            <color key="textColor" red="0.1869618941" green="0.1869618941" blue="0.1869618941" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                    </textField>
+                    <textField verticalHuggingPriority="750" horizontalCompressionResistancePriority="250" fixedFrame="YES" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="uh6-q0-RzL">
+                        <rect key="frame" x="18" y="65" width="444" height="60"/>
+                        <textFieldCell key="cell" sendsActionOnEndEditing="YES" alignment="center" id="CcT-ul-1eA">
+                            <font key="font" metaFont="system"/>
+                            <string key="title">Santa is an application whitelisting system for macOS.
+
+There are no user-configurable settings.</string>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                    </textField>
+                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="SRu-Kf-vu5">
+                        <rect key="frame" x="130" y="21" width="111" height="32"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="99" id="JHv-2J-QSe"/>
+                        </constraints>
+                        <buttonCell key="cell" type="push" title="More Info..." bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="6fe-ju-aET">
+                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
+                            <font key="font" metaFont="system"/>
+                        </buttonCell>
+                        <connections>
+                            <action selector="openMoreInfoURL:" target="-2" id="dps-TN-rkS"/>
+                        </connections>
+                    </button>
+                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="Udo-BY-n7e">
+                        <rect key="frame" x="240" y="21" width="111" height="32"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="99" id="2Xc-ax-2bV"/>
+                        </constraints>
+                        <buttonCell key="cell" type="push" title="Dismiss" bezelStyle="rounded" alignment="center" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="uSw-o1-lWW">
+                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
+                            <font key="font" metaFont="system"/>
+                            <string key="keyEquivalent" base64-UTF8="YES">
+DQ
+</string>
+                        </buttonCell>
+                        <connections>
+                            <action selector="orderOut:" target="-1" id="6oW-zI-zn5"/>
+                        </connections>
+                    </button>
+                </subviews>
+                <constraints>
+                    <constraint firstItem="Udo-BY-n7e" firstAttribute="leading" secondItem="se5-gp-TjO" secondAttribute="leading" priority="900" constant="191" id="1T4-DB-Dz8"/>
+                    <constraint firstItem="SRu-Kf-vu5" firstAttribute="leading" secondItem="se5-gp-TjO" secondAttribute="leading" constant="136" id="Ake-nU-qhW"/>
+                    <constraint firstItem="BnL-ZS-kXw" firstAttribute="top" secondItem="se5-gp-TjO" secondAttribute="top" constant="20" symbolic="YES" id="Fj1-SG-mzF"/>
+                    <constraint firstAttribute="bottom" secondItem="Udo-BY-n7e" secondAttribute="bottom" constant="28" id="bpF-hC-haN"/>
+                    <constraint firstAttribute="bottom" secondItem="SRu-Kf-vu5" secondAttribute="bottom" constant="28" id="fCB-02-SEt"/>
+                    <constraint firstItem="BnL-ZS-kXw" firstAttribute="centerX" secondItem="se5-gp-TjO" secondAttribute="centerX" id="kez-S0-6Gg"/>
+                    <constraint firstItem="Udo-BY-n7e" firstAttribute="leading" secondItem="SRu-Kf-vu5" secondAttribute="trailing" constant="11" id="sYO-yY-w9w"/>
+                </constraints>
+            </view>
+            <connections>
+                <outlet property="delegate" destination="-2" id="0bl-1N-AYu"/>
+            </connections>
+            <point key="canvasLocation" x="323" y="317"/>
+        </window>
+    </objects>
+</document>

Source/SantaGUI/Resources/Images.xcassets/Contents.json

@@ -3,4 +3,4 @@
     "version" : 1,
     "author" : "xcode"
   }
-}
+}

Source/SantaGUI/Resources/MessageWindow.xib

@@ -1,36 +1,31 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="32700.99.1234" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<document type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="3.0" toolsVersion="10117" systemVersion="15G31" targetRuntime="MacOSX.Cocoa" propertyAccessControl="none" useAutolayout="YES">
     <dependencies>
-        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="22689"/>
-        <capability name="documents saved in the Xcode 8 format" minToolsVersion="8.0"/>
+        <deployment identifier="macosx"/>
+        <development version="6300" identifier="xcode"/>
+        <plugIn identifier="com.apple.InterfaceBuilder.CocoaPlugin" version="10117"/>
     </dependencies>
     <objects>
         <customObject id="-2" userLabel="File's Owner" customClass="SNTMessageWindowController">
             <connections>
                 <outlet property="applicationNameLabel" destination="qgf-Jf-cJr" id="1JX-X8-03v"/>
-                <outlet property="bundleHashLabel" destination="xP7-jE-NF8" id="i8B-Gs-2E3"/>
-                <outlet property="bundleHashTitle" destination="MhO-U0-MLR" id="KT0-bK-fpV"/>
-                <outlet property="foundFileCountLabel" destination="LHV-gV-vyf" id="Sr0-T2-xGx"/>
-                <outlet property="hashingIndicator" destination="VyY-Yg-JOe" id="Yq4-tZ-9ep"/>
                 <outlet property="openEventButton" destination="7ua-5a-uSd" id="9s4-ZA-Vlo"/>
-                <outlet property="dismissEventButton" destination="BbV-3h-mmL" id="5s4-ZB-xlo"/>
                 <outlet property="window" destination="9Bq-yh-54f" id="Uhs-WF-TV9"/>
             </connections>
         </customObject>
         <customObject id="-1" userLabel="First Responder" customClass="FirstResponder"/>
         <customObject id="-3" userLabel="Application" customClass="NSObject"/>
-        <window title="Santa Blocked Execution" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" visibleAtLaunch="NO" animationBehavior="none" titlebarAppearsTransparent="YES" titleVisibility="hidden" id="9Bq-yh-54f" customClass="SNTMessageWindow">
-            <windowStyleMask key="styleMask" titled="YES" utility="YES"/>
-            <rect key="contentRect" x="167" y="107" width="540" height="479"/>
-            <rect key="screenRect" x="0.0" y="0.0" width="1916" height="1099"/>
+        <window title="Santa Blocked Execution" allowsToolTipsWhenApplicationIsInactive="NO" autorecalculatesKeyViewLoop="NO" oneShot="NO" showsToolbarButton="NO" visibleAtLaunch="NO" animationBehavior="none" id="9Bq-yh-54f" customClass="SNTMessageWindow">
+            <windowStyleMask key="styleMask" utility="YES"/>
+            <rect key="contentRect" x="167" y="107" width="497" height="439"/>
+            <rect key="screenRect" x="0.0" y="0.0" width="2560" height="1417"/>
             <view key="contentView" id="Iwq-Lx-rLv">
-                <rect key="frame" x="0.0" y="0.0" width="540" height="462"/>
+                <rect key="frame" x="0.0" y="0.0" width="497" height="439"/>
                 <autoresizingMask key="autoresizingMask" widthSizable="YES" heightSizable="YES"/>
                 <subviews>
                     <button focusRingType="none" verticalHuggingPriority="750" fixedFrame="YES" translatesAutoresizingMaskIntoConstraints="NO" id="kiB-jZ-69S">
-                        <rect key="frame" x="16" y="434" width="37" height="23"/>
-                        <autoresizingMask key="autoresizingMask" flexibleMaxX="YES" flexibleMinY="YES"/>
-                        <buttonCell key="cell" type="roundTextured" title="Hidden Button" alternateTitle="This button exists so neither of the other two buttons is pre-selected when the dialog opens." bezelStyle="texturedRounded" alignment="center" borderStyle="border" focusRingType="none" transparent="YES" imageScaling="proportionallyDown" inset="2" id="XGa-Sl-F4t">
+                        <rect key="frame" x="-6" y="411" width="37" height="32"/>
+                        <buttonCell key="cell" type="push" title="Hidden Button" alternateTitle="This button exists so neither of the other two buttons is pre-selected when the dialog opens." bezelStyle="rounded" alignment="center" borderStyle="border" focusRingType="none" transparent="YES" imageScaling="proportionallyDown" inset="2" id="XGa-Sl-F4t">
                             <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
                             <font key="font" metaFont="system"/>
                             <userDefinedRuntimeAttributes>
@@ -41,14 +36,28 @@
                             <outlet property="nextKeyView" destination="7ua-5a-uSd" id="vl5-A8-O0H"/>
                         </connections>
                     </button>
-                    <textField verticalHuggingPriority="750" horizontalCompressionResistancePriority="250" setsMaxLayoutWidthAtFirstLayout="YES" textCompletion="NO" translatesAutoresizingMaskIntoConstraints="NO" id="cD5-Su-lXR" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="43" y="354" width="454" height="16"/>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="t8c-Fx-e5h">
+                        <rect key="frame" x="206" y="368" width="85" height="41"/>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" refusesFirstResponder="YES" sendsActionOnEndEditing="YES" title="Santa" id="7YA-iB-Zma">
+                            <font key="font" metaFont="systemUltraLight" size="34"/>
+                            <color key="textColor" red="0.20000000000000001" green="0.20000000000000001" blue="0.20000000000000001" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                        <connections>
+                            <outlet property="nextKeyView" destination="7ua-5a-uSd" id="z5y-RR-IEH"/>
+                        </connections>
+                    </textField>
+                    <textField verticalHuggingPriority="750" horizontalCompressionResistancePriority="250" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="cD5-Su-lXR" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="22" y="329" width="454" height="17"/>
                         <constraints>
                             <constraint firstAttribute="width" constant="450" id="XgJ-EV-tBa"/>
                         </constraints>
                         <textFieldCell key="cell" selectable="YES" refusesFirstResponder="YES" allowsUndo="NO" sendsActionOnEndEditing="YES" alignment="center" title="A message to the user goes here..." allowsEditingTextAttributes="YES" id="5tH-bG-UJA">
                             <font key="font" metaFont="system"/>
-                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
                             <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
                         </textFieldCell>
                         <connections>
@@ -56,308 +65,8 @@
                             <outlet property="nextKeyView" destination="7ua-5a-uSd" id="VC7-bE-uHc"/>
                         </connections>
                     </textField>
-                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="d9e-Wv-Y5H" userLabel="Label: Path">
-                        <rect key="frame" x="8" y="283" width="142" height="16"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="138" id="Kqd-nX-7df"/>
-                        </constraints>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Filename" id="KgY-X1-ESG">
-                            <font key="font" metaFont="systemBold"/>
-                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                            <userDefinedRuntimeAttributes>
-                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
-                            </userDefinedRuntimeAttributes>
-                        </textFieldCell>
-                    </textField>
-                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="YNz-ka-cBi" userLabel="Label: Path">
-                        <rect key="frame" x="8" y="259" width="142" height="16"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="138" id="3wU-P0-gAC"/>
-                        </constraints>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Path" id="adC-be-Beh">
-                            <font key="font" metaFont="systemBold"/>
-                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                            <userDefinedRuntimeAttributes>
-                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
-                            </userDefinedRuntimeAttributes>
-                        </textFieldCell>
-                    </textField>
-                    <textField toolTip="Binary Name" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="pc8-G9-4pJ" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="187" y="283" width="315" height="16"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="311" id="xVR-j3-dLw"/>
-                        </constraints>
-                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Binary Name" id="E7T-9h-ofr">
-                            <font key="font" metaFont="system"/>
-                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                        <connections>
-                            <binding destination="-2" name="value" keyPath="self.event.filePath.lastPathComponent" id="bOu-gv-1Vh"/>
-                        </connections>
-                    </textField>
-                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="lvJ-Rk-UT5" userLabel="Label: Publisher">
-                        <rect key="frame" x="8" y="235" width="142" height="16"/>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Publisher" id="yL9-yD-JXX">
-                            <font key="font" metaFont="systemBold"/>
-                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                            <userDefinedRuntimeAttributes>
-                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
-                            </userDefinedRuntimeAttributes>
-                        </textFieldCell>
-                    </textField>
-                    <textField toolTip="Publisher" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="C3G-wL-u7w" userLabel="Publisher" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="187" y="235" width="315" height="16"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="311" id="Dem-wH-KHm"/>
-                        </constraints>
-                        <textFieldCell key="cell" selectable="YES" allowsUndo="NO" sendsActionOnEndEditing="YES" title="Code signing information" placeholderString="" id="ztA-La-XgT">
-                            <font key="font" metaFont="system"/>
-                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                        <connections>
-                            <binding destination="-2" name="value" keyPath="self.publisherInfo" id="CEI-Cu-7pC">
-                                <dictionary key="options">
-                                    <string key="NSNullPlaceholder">Not code-signed</string>
-                                </dictionary>
-                            </binding>
-                        </connections>
-                    </textField>
-                    <button toolTip="Show code signing certificate chain" translatesAutoresizingMaskIntoConstraints="NO" id="cJf-k6-OxS" userLabel="Publisher Certs Button">
-                        <rect key="frame" x="62" y="235" width="15" height="15"/>
-                        <buttonCell key="cell" type="bevel" bezelStyle="regularSquare" image="NSInfo" imagePosition="overlaps" alignment="center" refusesFirstResponder="YES" imageScaling="proportionallyDown" inset="2" id="R72-Qy-Xbb">
-                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                            <font key="font" metaFont="system"/>
-                            <userDefinedRuntimeAttributes>
-                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
-                            </userDefinedRuntimeAttributes>
-                        </buttonCell>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="15" id="QTm-Iv-m5p"/>
-                            <constraint firstAttribute="height" constant="15" id="YwG-0s-jop"/>
-                        </constraints>
-                        <connections>
-                            <action selector="showCertInfo:" target="-2" id="dB0-a3-X31"/>
-                            <binding destination="-2" name="hidden" keyPath="self.publisherInfo" id="fFR-f3-Oiw">
-                                <dictionary key="options">
-                                    <string key="NSValueTransformerName">NSIsNil</string>
-                                </dictionary>
-                            </binding>
-                        </connections>
-                    </button>
-                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="KEB-eH-x2Y" userLabel="Label: Identifier">
-                        <rect key="frame" x="8" y="212" width="142" height="16"/>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Identifier" id="eKN-Ic-5zy">
-                            <font key="font" metaFont="systemBold"/>
-                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                            <userDefinedRuntimeAttributes>
-                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
-                            </userDefinedRuntimeAttributes>
-                        </textFieldCell>
-                    </textField>
-                    <textField toolTip="SHA-256" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="PXc-xv-A28">
-                        <rect key="frame" x="187" y="214" width="219" height="13"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="215" id="4hh-R2-86s"/>
-                        </constraints>
-                        <textFieldCell key="cell" lineBreakMode="charWrapping" selectable="YES" sendsActionOnEndEditing="YES" title="SHA-256" id="X4W-9e-eIu">
-                            <font key="font" metaFont="fixedUser" size="11"/>
-                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                            <userDefinedRuntimeAttributes>
-                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
-                            </userDefinedRuntimeAttributes>
-                        </textFieldCell>
-                        <connections>
-                            <binding destination="-2" name="value" keyPath="self.event.fileSHA256" id="9KB-0b-qLV"/>
-                        </connections>
-                    </textField>
-                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="MhO-U0-MLR" userLabel="Label: Bundle Identifier">
-                        <rect key="frame" x="8" y="191" width="142" height="16"/>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Bundle Identifier" id="LEe-u0-52o">
-                            <font key="font" metaFont="systemBold"/>
-                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                            <userDefinedRuntimeAttributes>
-                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
-                            </userDefinedRuntimeAttributes>
-                        </textFieldCell>
-                        <connections>
-                            <binding destination="-2" name="hidden" keyPath="self.event.needsBundleHash" id="2kb-3z-Kyn">
-                                <dictionary key="options">
-                                    <string key="NSValueTransformerName">NSNegateBoolean</string>
-                                </dictionary>
-                            </binding>
-                        </connections>
-                    </textField>
-                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="eQb-0a-76J" userLabel="Label: Parent">
-                        <rect key="frame" x="8" y="156" width="142" height="16"/>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Parent" id="gze-4A-1w5">
-                            <font key="font" metaFont="systemBold"/>
-                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                            <userDefinedRuntimeAttributes>
-                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
-                            </userDefinedRuntimeAttributes>
-                        </textFieldCell>
-                    </textField>
-                    <textField toolTip="Parent Process" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="f1p-GL-O3o" userLabel="Parent" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="187" y="156" width="294" height="16"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="290" id="h3Y-mO-38F"/>
-                        </constraints>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" sendsActionOnEndEditing="YES" title="Parent Name" id="ieo-WK-aDD">
-                            <font key="font" metaFont="system"/>
-                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                        <connections>
-                            <binding destination="-2" name="displayPatternValue1" keyPath="self.event.parentName" id="Lce-TO-q9V">
-                                <dictionary key="options">
-                                    <string key="NSDisplayPattern">%{value1}@ (%{value2}@)</string>
-                                </dictionary>
-                            </binding>
-                            <binding destination="-2" name="displayPatternValue2" keyPath="self.event.ppid" previousBinding="Lce-TO-q9V" id="ofI-kH-F2d">
-                                <dictionary key="options">
-                                    <string key="NSDisplayPattern">%{value1}@ (%{value2}@)</string>
-                                </dictionary>
-                            </binding>
-                        </connections>
-                    </textField>
-                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="oFj-ol-xpL" userLabel="Label: User">
-                        <rect key="frame" x="8" y="132" width="142" height="16"/>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="User" id="1ut-uT-hQD">
-                            <font key="font" metaFont="systemBold"/>
-                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                            <userDefinedRuntimeAttributes>
-                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
-                            </userDefinedRuntimeAttributes>
-                        </textFieldCell>
-                    </textField>
-                    <button verticalHuggingPriority="750" horizontalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="7ua-5a-uSd">
-                        <rect key="frame" x="147" y="30" width="126" height="32"/>
-                        <buttonCell key="cell" type="push" title="Open..." bezelStyle="rounded" alignment="center" state="on" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="X1b-TF-1TL">
-                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                            <font key="font" metaFont="system"/>
-                            <string key="keyEquivalent" base64-UTF8="YES">
-DQ
-</string>
-                            <modifierMask key="keyEquivalentModifierMask" command="YES"/>
-                        </buttonCell>
-                        <constraints>
-                            <constraint firstAttribute="width" priority="900" constant="112" id="Pec-Pa-4aZ"/>
-                        </constraints>
-                        <connections>
-                            <action selector="openEventDetails:" target="-2" id="VhL-ql-rCV"/>
-                            <outlet property="nextKeyView" destination="BbV-3h-mmL" id="Xkz-va-iGc"/>
-                        </connections>
-                    </button>
-                    <textField toolTip="Binary Path" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="bDE-Tl-UHg" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="187" y="259" width="315" height="16"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="311" id="p1W-f9-KBX"/>
-                        </constraints>
-                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Binary Path" id="H1b-Ui-CYo">
-                            <font key="font" metaFont="system"/>
-                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                        <connections>
-                            <binding destination="-2" name="value" keyPath="self.event.filePath" id="Sry-KY-HDb"/>
-                        </connections>
-                    </textField>
-                    <button translatesAutoresizingMaskIntoConstraints="NO" id="5D8-GP-a4l">
-                        <rect key="frame" x="110" y="80" width="319" height="29"/>
-                        <buttonCell key="cell" type="check" title="Prevent future notifications for this application for a day" bezelStyle="regularSquare" imagePosition="left" alignment="center" inset="2" id="R5Y-Uc-rEP">
-                            <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
-                            <font key="font" metaFont="smallSystem"/>
-                        </buttonCell>
-                        <constraints>
-                            <constraint firstAttribute="height" constant="25" id="KvD-X6-CsO"/>
-                        </constraints>
-                        <connections>
-                            <binding destination="-2" name="value" keyPath="self.silenceFutureNotifications" id="tEb-2A-sht"/>
-                        </connections>
-                    </button>
-                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="BbV-3h-mmL" userLabel="Dismiss Button">
-                        <rect key="frame" x="271" y="28" width="124" height="34"/>
-                        <buttonCell key="cell" type="push" title="Dismiss" bezelStyle="rounded" alignment="center" state="on" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="XR6-Xa-gP4">
-                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
-                            <font key="font" metaFont="system"/>
-                            <string key="keyEquivalent" base64-UTF8="YES">
-Gw
-</string>
-                        </buttonCell>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="110" id="6Uh-Bd-N64"/>
-                            <constraint firstAttribute="height" constant="22" id="GH6-nw-6rD"/>
-                        </constraints>
-                        <accessibility description="Dismiss Dialog"/>
-                        <connections>
-                            <action selector="closeWindow:" target="-2" id="qQq-gh-8lw"/>
-                            <outlet property="nextKeyView" destination="7ua-5a-uSd" id="4KL-Z2-1op"/>
-                        </connections>
-                    </button>
-                    <textField toolTip="Executing User" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="h6f-PY-cc0" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="187" y="132" width="294" height="16"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="290" id="on6-pj-m2k"/>
-                        </constraints>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" sendsActionOnEndEditing="YES" title="Executing User" id="HRT-Be-ePf">
-                            <font key="font" metaFont="system"/>
-                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                        <connections>
-                            <binding destination="-2" name="value" keyPath="self.event.executingUser" id="IcM-Lt-xTT">
-                                <dictionary key="options">
-                                    <string key="NSNullPlaceholder">Unknown</string>
-                                </dictionary>
-                            </binding>
-                        </connections>
-                    </textField>
-                    <progressIndicator wantsLayer="YES" horizontalHuggingPriority="750" verticalHuggingPriority="750" maxValue="1" bezeled="NO" controlSize="small" style="bar" translatesAutoresizingMaskIntoConstraints="NO" id="VyY-Yg-JOe">
-                        <rect key="frame" x="187" y="193" width="217" height="12"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="217" id="M22-Dv-KIP"/>
-                        </constraints>
-                    </progressIndicator>
-                    <textField toolTip="Bundle SHA-256" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="xP7-jE-NF8">
-                        <rect key="frame" x="187" y="193" width="219" height="13"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="215" id="s7W-o9-2nN"/>
-                        </constraints>
-                        <textFieldCell key="cell" lineBreakMode="charWrapping" selectable="YES" sendsActionOnEndEditing="YES" title="Calculating..." id="yJa-yL-X9a">
-                            <font key="font" metaFont="fixedUser" size="11"/>
-                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                            <userDefinedRuntimeAttributes>
-                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
-                            </userDefinedRuntimeAttributes>
-                        </textFieldCell>
-                        <connections>
-                            <binding destination="-2" name="value" keyPath="self.event.fileBundleHash" id="CnT-q6-bot"/>
-                        </connections>
-                    </textField>
-                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="LHV-gV-vyf">
-                        <rect key="frame" x="187" y="180" width="219" height="13"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="215" id="LUu-Vd-peN"/>
-                        </constraints>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" title="1000 related binaries" id="AVM-vB-hB8">
-                            <font key="font" metaFont="fixedUser" size="11"/>
-                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                    </textField>
-                    <box horizontalHuggingPriority="750" boxType="custom" borderType="line" title="Line" titlePosition="noTitle" translatesAutoresizingMaskIntoConstraints="NO" id="4Li-ul-zIi">
-                        <rect key="frame" x="168" y="132" width="1" height="191"/>
+                    <box horizontalHuggingPriority="750" title="Line" boxType="custom" borderType="line" titlePosition="noTitle" translatesAutoresizingMaskIntoConstraints="NO" id="4Li-ul-zIi">
+                        <rect key="frame" x="146" y="132" width="1" height="167"/>
                         <constraints>
                             <constraint firstAttribute="width" constant="1" id="0o1-Jh-epf"/>
                         </constraints>
@@ -365,28 +74,10 @@ Gw
                         <color key="fillColor" white="0.0" alpha="0.0" colorSpace="calibratedWhite"/>
                         <font key="titleFont" metaFont="system"/>
                     </box>
-                    <textField toolTip="Application Name" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="qgf-Jf-cJr" customClass="SNTAccessibleTextField">
-                        <rect key="frame" x="187" y="307" width="315" height="17"/>
-                        <constraints>
-                            <constraint firstAttribute="width" constant="311" id="Pav-ZA-iAu"/>
-                        </constraints>
-                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Application Name" id="3UG-ca-d1k">
-                            <font key="font" metaFont="systemBold"/>
-                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
-                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
-                        </textFieldCell>
-                        <connections>
-                            <binding destination="-2" name="value" keyPath="self.event.fileBundleName" id="enC-Cl-UWt">
-                                <dictionary key="options">
-                                    <string key="NSNullPlaceholder">Unknown</string>
-                                </dictionary>
-                            </binding>
-                        </connections>
-                    </textField>
                     <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="pDa-fA-vnC" userLabel="Label: Application">
-                        <rect key="frame" x="8" y="307" width="142" height="16"/>
+                        <rect key="frame" x="8" y="282" width="120" height="17"/>
                         <constraints>
-                            <constraint firstAttribute="width" constant="138" id="8mA-zi-Ev7"/>
+                            <constraint firstAttribute="width" constant="116" id="8mA-zi-Ev7"/>
                         </constraints>
                         <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Application" id="Hy7-WF-6xW">
                             <font key="font" metaFont="systemBold"/>
@@ -404,52 +95,301 @@ Gw
                             </binding>
                         </connections>
                     </textField>
-                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="t8c-Fx-e5h">
-                        <rect key="frame" x="229" y="392" width="82" height="40"/>
-                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" refusesFirstResponder="YES" sendsActionOnEndEditing="YES" title="Santa" id="7YA-iB-Zma">
-                            <font key="font" metaFont="systemUltraLight" size="34"/>
-                            <color key="textColor" name="labelColor" catalog="System" colorSpace="catalog"/>
+                    <textField toolTip="Application Name" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="qgf-Jf-cJr" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="165" y="282" width="294" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="290" id="Pav-ZA-iAu"/>
+                        </constraints>
+                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Application Name" id="3UG-ca-d1k">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.event.fileBundleName" id="enC-Cl-UWt">
+                                <dictionary key="options">
+                                    <string key="NSNullPlaceholder">Unknown</string>
+                                </dictionary>
+                            </binding>
+                        </connections>
+                    </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="d9e-Wv-Y5H" userLabel="Label: Path">
+                        <rect key="frame" x="8" y="257" width="120" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="116" id="Kqd-nX-7df"/>
+                        </constraints>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Filename" id="KgY-X1-ESG">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                    </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="YNz-ka-cBi" userLabel="Label: Path">
+                        <rect key="frame" x="8" y="232" width="120" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="116" id="3wU-P0-gAC"/>
+                        </constraints>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Path" id="adC-be-Beh">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                    </textField>
+                    <textField toolTip="Binary Path" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="pc8-G9-4pJ" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="165" y="257" width="294" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="290" id="xVR-j3-dLw"/>
+                        </constraints>
+                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Binary Name" id="E7T-9h-ofr">
+                            <font key="font" metaFont="system"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.event.filePath.lastPathComponent" id="bOu-gv-1Vh"/>
+                        </connections>
+                    </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="lvJ-Rk-UT5" userLabel="Label: Publisher">
+                        <rect key="frame" x="8" y="207" width="120" height="17"/>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Publisher" id="yL9-yD-JXX">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                    </textField>
+                    <textField toolTip="Publisher" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="C3G-wL-u7w" userLabel="Publisher" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="165" y="207" width="294" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="290" id="Dem-wH-KHm"/>
+                        </constraints>
+                        <textFieldCell key="cell" selectable="YES" allowsUndo="NO" sendsActionOnEndEditing="YES" title="Code signing information" placeholderString="" id="ztA-La-XgT">
+                            <font key="font" metaFont="system"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.publisherInfo" id="CEI-Cu-7pC">
+                                <dictionary key="options">
+                                    <string key="NSNullPlaceholder">Not code-signed</string>
+                                </dictionary>
+                            </binding>
+                        </connections>
+                    </textField>
+                    <button toolTip="Show code signing certificate chain" translatesAutoresizingMaskIntoConstraints="NO" id="cJf-k6-OxS" userLabel="Publisher Certs Button">
+                        <rect key="frame" x="40" y="208" width="15" height="15"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="15" id="QTm-Iv-m5p"/>
+                            <constraint firstAttribute="height" constant="15" id="YwG-0s-jop"/>
+                        </constraints>
+                        <buttonCell key="cell" type="bevel" bezelStyle="regularSquare" image="NSInfo" imagePosition="overlaps" alignment="center" refusesFirstResponder="YES" imageScaling="proportionallyDown" inset="2" id="R72-Qy-Xbb">
+                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
+                            <font key="font" metaFont="system"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </buttonCell>
+                        <connections>
+                            <action selector="showCertInfo:" target="-2" id="dB0-a3-X31"/>
+                            <binding destination="-2" name="hidden" keyPath="self.publisherInfo" id="fFR-f3-Oiw">
+                                <dictionary key="options">
+                                    <string key="NSValueTransformerName">NSIsNil</string>
+                                </dictionary>
+                            </binding>
+                        </connections>
+                    </button>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="KEB-eH-x2Y" userLabel="Label: Identifier">
+                        <rect key="frame" x="8" y="182" width="120" height="17"/>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Identifier" id="eKN-Ic-5zy">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                    </textField>
+                    <textField verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="PXc-xv-A28">
+                        <rect key="frame" x="165" y="182" width="219" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="215" id="4hh-R2-86s"/>
+                        </constraints>
+                        <textFieldCell key="cell" lineBreakMode="charWrapping" selectable="YES" sendsActionOnEndEditing="YES" title="SHA-256" id="X4W-9e-eIu">
+                            <font key="font" metaFont="fixedUser" size="11"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
                             <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
                             <userDefinedRuntimeAttributes>
                                 <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
                             </userDefinedRuntimeAttributes>
                         </textFieldCell>
                         <connections>
-                            <outlet property="nextKeyView" destination="7ua-5a-uSd" id="z5y-RR-IEH"/>
+                            <binding destination="-2" name="value" keyPath="self.event.fileSHA256" id="9KB-0b-qLV"/>
                         </connections>
                     </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="eQb-0a-76J" userLabel="Label: Parent">
+                        <rect key="frame" x="8" y="157" width="120" height="17"/>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="Parent" id="gze-4A-1w5">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                    </textField>
+                    <textField toolTip="Parent Process" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="f1p-GL-O3o" userLabel="Parent" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="165" y="157" width="294" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="290" id="h3Y-mO-38F"/>
+                        </constraints>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" sendsActionOnEndEditing="YES" title="Parent Name" id="ieo-WK-aDD">
+                            <font key="font" metaFont="system"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="displayPatternValue1" keyPath="self.event.parentName" id="Lce-TO-q9V">
+                                <dictionary key="options">
+                                    <string key="NSDisplayPattern">%{value1}@ (%{value2}@)</string>
+                                </dictionary>
+                            </binding>
+                            <binding destination="-2" name="displayPatternValue2" keyPath="self.event.ppid" previousBinding="Lce-TO-q9V" id="ofI-kH-F2d">
+                                <dictionary key="options">
+                                    <string key="NSDisplayPattern">%{value1}@ (%{value2}@)</string>
+                                </dictionary>
+                            </binding>
+                        </connections>
+                    </textField>
+                    <textField horizontalHuggingPriority="251" verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="oFj-ol-xpL" userLabel="Label: User">
+                        <rect key="frame" x="8" y="132" width="120" height="17"/>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" sendsActionOnEndEditing="YES" alignment="right" title="User" id="1ut-uT-hQD">
+                            <font key="font" metaFont="systemBold"/>
+                            <color key="textColor" name="controlTextColor" catalog="System" colorSpace="catalog"/>
+                            <color key="backgroundColor" name="controlColor" catalog="System" colorSpace="catalog"/>
+                            <userDefinedRuntimeAttributes>
+                                <userDefinedRuntimeAttribute type="boolean" keyPath="accessibilityElement" value="NO"/>
+                            </userDefinedRuntimeAttributes>
+                        </textFieldCell>
+                    </textField>
+                    <textField toolTip="Executing User" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="h6f-PY-cc0" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="165" y="132" width="294" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="290" id="on6-pj-m2k"/>
+                        </constraints>
+                        <textFieldCell key="cell" scrollable="YES" lineBreakMode="clipping" selectable="YES" sendsActionOnEndEditing="YES" title="Executing User" id="HRT-Be-ePf">
+                            <font key="font" metaFont="system"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.event.executingUser" id="IcM-Lt-xTT">
+                                <dictionary key="options">
+                                    <string key="NSNullPlaceholder">Unknown</string>
+                                </dictionary>
+                            </binding>
+                        </connections>
+                    </textField>
+                    <button verticalHuggingPriority="750" horizontalCompressionResistancePriority="1000" translatesAutoresizingMaskIntoConstraints="NO" id="7ua-5a-uSd">
+                        <rect key="frame" x="132" y="33" width="112" height="25"/>
+                        <constraints>
+                            <constraint firstAttribute="width" priority="900" constant="112" id="Pec-Pa-4aZ"/>
+                        </constraints>
+                        <buttonCell key="cell" type="roundTextured" title="Open Event..." bezelStyle="texturedRounded" alignment="center" state="on" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="X1b-TF-1TL">
+                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
+                            <font key="font" metaFont="system"/>
+                            <string key="keyEquivalent" base64-UTF8="YES">
+DQ
+</string>
+                            <modifierMask key="keyEquivalentModifierMask" command="YES"/>
+                        </buttonCell>
+                        <connections>
+                            <action selector="openEventDetails:" target="-2" id="VhL-ql-rCV"/>
+                            <outlet property="nextKeyView" destination="BbV-3h-mmL" id="Xkz-va-iGc"/>
+                        </connections>
+                    </button>
+                    <button verticalHuggingPriority="750" translatesAutoresizingMaskIntoConstraints="NO" id="BbV-3h-mmL" userLabel="Dismiss Button">
+                        <rect key="frame" x="256" y="33" width="110" height="25"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="110" id="6Uh-Bd-N64"/>
+                            <constraint firstAttribute="height" constant="22" id="GH6-nw-6rD"/>
+                        </constraints>
+                        <buttonCell key="cell" type="roundTextured" title="Ignore" bezelStyle="texturedRounded" alignment="center" state="on" borderStyle="border" imageScaling="proportionallyDown" inset="2" id="XR6-Xa-gP4">
+                            <behavior key="behavior" pushIn="YES" lightByBackground="YES" lightByGray="YES"/>
+                            <font key="font" metaFont="system"/>
+                            <string key="keyEquivalent" base64-UTF8="YES">
+DQ
+</string>
+                            <modifierMask key="keyEquivalentModifierMask" shift="YES"/>
+                        </buttonCell>
+                        <accessibility description="Dismiss Dialog"/>
+                        <connections>
+                            <action selector="closeWindow:" target="-2" id="qQq-gh-8lw"/>
+                            <outlet property="nextKeyView" destination="7ua-5a-uSd" id="4KL-Z2-1op"/>
+                        </connections>
+                    </button>
+                    <textField toolTip="Binary Path" verticalHuggingPriority="900" horizontalCompressionResistancePriority="250" verticalCompressionResistancePriority="1000" setsMaxLayoutWidthAtFirstLayout="YES" translatesAutoresizingMaskIntoConstraints="NO" id="bDE-Tl-UHg" customClass="SNTAccessibleTextField">
+                        <rect key="frame" x="165" y="232" width="294" height="17"/>
+                        <constraints>
+                            <constraint firstAttribute="width" constant="290" id="p1W-f9-KBX"/>
+                        </constraints>
+                        <textFieldCell key="cell" selectable="YES" sendsActionOnEndEditing="YES" alignment="left" title="Binary Path" id="H1b-Ui-CYo">
+                            <font key="font" metaFont="system"/>
+                            <color key="textColor" red="0.40000000000000002" green="0.40000000000000002" blue="0.40000000000000002" alpha="1" colorSpace="calibratedRGB"/>
+                            <color key="backgroundColor" name="textBackgroundColor" catalog="System" colorSpace="catalog"/>
+                        </textFieldCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.event.filePath" id="Sry-KY-HDb"/>
+                        </connections>
+                    </textField>
+                    <button translatesAutoresizingMaskIntoConstraints="NO" id="5D8-GP-a4l">
+                        <rect key="frame" x="91" y="80" width="315" height="29"/>
+                        <constraints>
+                            <constraint firstAttribute="height" constant="25" id="KvD-X6-CsO"/>
+                        </constraints>
+                        <buttonCell key="cell" type="check" title="Prevent future notifications for this application for a day" bezelStyle="regularSquare" imagePosition="left" alignment="center" inset="2" id="R5Y-Uc-rEP">
+                            <behavior key="behavior" changeContents="YES" doesNotDimImage="YES" lightByContents="YES"/>
+                            <font key="font" metaFont="smallSystem"/>
+                        </buttonCell>
+                        <connections>
+                            <binding destination="-2" name="value" keyPath="self.silenceFutureNotifications" id="tEb-2A-sht"/>
+                        </connections>
+                    </button>
                 </subviews>
                 <constraints>
                     <constraint firstItem="oFj-ol-xpL" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="0AD-PS-5V1"/>
                     <constraint firstItem="f1p-GL-O3o" firstAttribute="centerY" secondItem="eQb-0a-76J" secondAttribute="centerY" id="2Aq-1E-Ybz"/>
                     <constraint firstItem="BbV-3h-mmL" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" priority="500" constant="193" id="2uo-Cm-Tfp"/>
                     <constraint firstItem="h6f-PY-cc0" firstAttribute="top" secondItem="f1p-GL-O3o" secondAttribute="bottom" constant="8" id="496-VQ-Fx5"/>
-                    <constraint firstItem="xP7-jE-NF8" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="5Mr-By-PAU"/>
                     <constraint firstItem="pDa-fA-vnC" firstAttribute="centerY" secondItem="qgf-Jf-cJr" secondAttribute="centerY" id="AKX-pe-hEX"/>
                     <constraint firstItem="C3G-wL-u7w" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="ALv-0v-szi"/>
+                    <constraint firstItem="f1p-GL-O3o" firstAttribute="top" secondItem="PXc-xv-A28" secondAttribute="bottom" constant="8" id="E6D-7P-17g"/>
                     <constraint firstItem="d9e-Wv-Y5H" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="FPe-Rd-G4n"/>
                     <constraint firstItem="cJf-k6-OxS" firstAttribute="centerY" secondItem="C3G-wL-u7w" secondAttribute="centerY" id="FdL-ZZ-Vbe"/>
                     <constraint firstItem="t8c-Fx-e5h" firstAttribute="top" secondItem="Iwq-Lx-rLv" secondAttribute="top" constant="30" id="FuB-GX-0jg"/>
                     <constraint firstItem="oFj-ol-xpL" firstAttribute="bottom" secondItem="4Li-ul-zIi" secondAttribute="bottom" id="G0I-O2-S91"/>
-                    <constraint firstItem="lvJ-Rk-UT5" firstAttribute="leading" secondItem="cJf-k6-OxS" secondAttribute="trailing" constant="-67" id="GD2-Ka-deo"/>
+                    <constraint firstItem="lvJ-Rk-UT5" firstAttribute="leading" secondItem="cJf-k6-OxS" secondAttribute="trailing" constant="-45" id="GD2-Ka-deo"/>
                     <constraint firstItem="BbV-3h-mmL" firstAttribute="top" secondItem="5D8-GP-a4l" secondAttribute="bottom" priority="900" constant="25" id="GT2-tO-2td"/>
                     <constraint firstItem="h6f-PY-cc0" firstAttribute="centerY" secondItem="oFj-ol-xpL" secondAttribute="centerY" id="GXI-pT-FM1"/>
                     <constraint firstItem="4Li-ul-zIi" firstAttribute="top" secondItem="pDa-fA-vnC" secondAttribute="top" id="Gd4-Nr-n5G"/>
-                    <constraint firstItem="xP7-jE-NF8" firstAttribute="top" secondItem="PXc-xv-A28" secondAttribute="bottom" constant="8" id="HUT-MI-jsR"/>
                     <constraint firstItem="qgf-Jf-cJr" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="Ht4-Lg-U5N"/>
-                    <constraint firstItem="LHV-gV-vyf" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="IA0-dy-2be"/>
                     <constraint firstItem="oFj-ol-xpL" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="IwX-ja-ZIs"/>
                     <constraint firstItem="d9e-Wv-Y5H" firstAttribute="top" secondItem="4Li-ul-zIi" secondAttribute="top" priority="500" id="JY4-N1-j8e"/>
                     <constraint firstItem="YNz-ka-cBi" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="KmX-kX-VCN"/>
                     <constraint firstItem="5D8-GP-a4l" firstAttribute="centerX" secondItem="Iwq-Lx-rLv" secondAttribute="centerX" id="LkH-F4-Ncm"/>
-                    <constraint firstItem="pc8-G9-4pJ" firstAttribute="top" secondItem="cD5-Su-lXR" secondAttribute="bottom" priority="950" constant="55" id="Nsl-zf-poH"/>
+                    <constraint firstItem="pc8-G9-4pJ" firstAttribute="top" secondItem="cD5-Su-lXR" secondAttribute="bottom" priority="950" constant="30" id="Nsl-zf-poH"/>
                     <constraint firstItem="YNz-ka-cBi" firstAttribute="centerY" secondItem="bDE-Tl-UHg" secondAttribute="centerY" id="ObQ-RA-S5V"/>
                     <constraint firstItem="pc8-G9-4pJ" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="SCl-Ky-VmT"/>
                     <constraint firstItem="d9e-Wv-Y5H" firstAttribute="centerY" secondItem="pc8-G9-4pJ" secondAttribute="centerY" id="SLv-F7-w5k"/>
                     <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="KEB-eH-x2Y" secondAttribute="trailing" constant="20" id="Seb-c0-MUL"/>
                     <constraint firstAttribute="centerX" secondItem="cD5-Su-lXR" secondAttribute="centerX" id="V0a-Py-iEc"/>
-                    <constraint firstItem="LHV-gV-vyf" firstAttribute="top" secondItem="VyY-Yg-JOe" secondAttribute="bottom" id="Vjr-NX-j8V"/>
-                    <constraint firstItem="MhO-U0-MLR" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="Vly-VE-BwU"/>
                     <constraint firstItem="oFj-ol-xpL" firstAttribute="leading" secondItem="lvJ-Rk-UT5" secondAttribute="leading" priority="999" id="Z6G-l9-G4a"/>
                     <constraint firstItem="C3G-wL-u7w" firstAttribute="top" secondItem="bDE-Tl-UHg" secondAttribute="bottom" constant="8" id="ZoS-xV-2WA"/>
                     <constraint firstItem="lvJ-Rk-UT5" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="aMJ-Wb-vRS"/>
@@ -461,28 +401,22 @@ Gw
                     <constraint firstItem="qgf-Jf-cJr" firstAttribute="top" secondItem="cD5-Su-lXR" secondAttribute="bottom" constant="30" id="esg-lX-BAT"/>
                     <constraint firstItem="f1p-GL-O3o" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="fGd-YS-phP"/>
                     <constraint firstAttribute="centerX" secondItem="t8c-Fx-e5h" secondAttribute="centerX" id="h3d-Kc-q88"/>
-                    <constraint firstItem="f1p-GL-O3o" firstAttribute="top" secondItem="LHV-gV-vyf" secondAttribute="bottom" constant="8" id="h4h-K3-BTd"/>
-                    <constraint firstItem="f1p-GL-O3o" firstAttribute="top" secondItem="PXc-xv-A28" secondAttribute="bottom" priority="700" constant="8" id="hXw-6Z-lb2"/>
                     <constraint firstItem="BbV-3h-mmL" firstAttribute="leading" secondItem="7ua-5a-uSd" secondAttribute="trailing" constant="12" id="ioO-NJ-Jqo"/>
                     <constraint firstItem="bDE-Tl-UHg" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="jdk-ak-soQ"/>
                     <constraint firstItem="C3G-wL-u7w" firstAttribute="centerY" secondItem="lvJ-Rk-UT5" secondAttribute="centerY" id="jfs-YI-7Ae"/>
                     <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="oFj-ol-xpL" secondAttribute="trailing" constant="20" id="kOG-Cj-hFG"/>
-                    <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="MhO-U0-MLR" secondAttribute="trailing" constant="20" id="ke9-wW-5fr"/>
                     <constraint firstItem="pc8-G9-4pJ" firstAttribute="top" secondItem="qgf-Jf-cJr" secondAttribute="bottom" constant="8" id="lWU-tC-vWg"/>
                     <constraint firstItem="5D8-GP-a4l" firstAttribute="top" secondItem="h6f-PY-cc0" secondAttribute="bottom" constant="25" id="lYd-VZ-lBs"/>
-                    <constraint firstItem="VyY-Yg-JOe" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="18" id="lei-uP-T8m"/>
-                    <constraint firstItem="f1p-GL-O3o" firstAttribute="top" secondItem="xP7-jE-NF8" secondAttribute="bottom" priority="701" constant="8" id="oY4-e7-lsz"/>
                     <constraint firstItem="7ua-5a-uSd" firstAttribute="top" secondItem="5D8-GP-a4l" secondAttribute="bottom" priority="900" constant="25" id="pCX-eX-erN"/>
-                    <constraint firstItem="xP7-jE-NF8" firstAttribute="centerY" secondItem="MhO-U0-MLR" secondAttribute="centerY" id="pdC-x8-Nao"/>
-                    <constraint firstAttribute="centerX" secondItem="7ua-5a-uSd" secondAttribute="centerX" constant="60" id="phL-j9-rPq"/>
+                    <constraint firstAttribute="centerX" secondItem="7ua-5a-uSd" secondAttribute="centerX" constant="61" id="phL-j9-rPq"/>
                     <constraint firstItem="bDE-Tl-UHg" firstAttribute="top" secondItem="pc8-G9-4pJ" secondAttribute="bottom" constant="8" id="pis-of-f93"/>
                     <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="lvJ-Rk-UT5" secondAttribute="trailing" constant="20" id="qKi-KT-jzJ"/>
                     <constraint firstItem="C3G-wL-u7w" firstAttribute="bottom" secondItem="PXc-xv-A28" secondAttribute="top" constant="-8" id="snd-8T-LjC"/>
                     <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="d9e-Wv-Y5H" secondAttribute="trailing" constant="20" id="stz-Vm-Kxo"/>
                     <constraint firstItem="PXc-xv-A28" firstAttribute="leading" secondItem="4Li-ul-zIi" secondAttribute="trailing" constant="20" id="tAa-1s-xVZ"/>
                     <constraint firstItem="eQb-0a-76J" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="u1y-6V-moc"/>
+                    <constraint firstItem="d9e-Wv-Y5H" firstAttribute="width" secondItem="eQb-0a-76J" secondAttribute="width" id="u4p-1B-x5B"/>
                     <constraint firstAttribute="bottom" secondItem="BbV-3h-mmL" secondAttribute="bottom" constant="35" id="ukF-FH-DE8"/>
-                    <constraint firstItem="VyY-Yg-JOe" firstAttribute="centerY" secondItem="MhO-U0-MLR" secondAttribute="centerY" id="vB8-c5-pfO"/>
                     <constraint firstItem="4Li-ul-zIi" firstAttribute="leading" secondItem="YNz-ka-cBi" secondAttribute="trailing" constant="20" id="vfq-83-tKI"/>
                     <constraint firstItem="pDa-fA-vnC" firstAttribute="leading" secondItem="Iwq-Lx-rLv" secondAttribute="leading" constant="10" id="z6s-ga-iAk"/>
                 </constraints>
@@ -490,9 +424,8 @@ Gw
             <connections>
                 <outlet property="initialFirstResponder" destination="kiB-jZ-69S" id="I96-dS-lq5"/>
             </connections>
-            <point key="canvasLocation" x="274" y="326.5"/>
+            <point key="canvasLocation" x="302.5" y="304.5"/>
         </window>
-        <userDefaultsController representsSharedInstance="YES" id="iXx-cu-WYe"/>
     </objects>
     <resources>
         <image name="NSInfo" width="32" height="32"/>

Source/SantaGUI/Resources/SantaGUI-Info.plist

@@ -2,30 +2,26 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>CFBundleExecutable</key>
-	<string>Santa</string>
-	<key>CFBundleIconFile</key>
-	<string>AppIcon</string>
-	<key>CFBundleIconName</key>
-	<string>AppIcon</string>
-	<key>CFBundleIdentifier</key>
-	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
 	<key>CFBundleInfoDictionaryVersion</key>
 	<string>6.0</string>
-	<key>CFBundleName</key>
-	<string>Santa</string>
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
-	<key>CFBundleShortVersionString</key>
-	<string>$(MARKETING_VERSION)</string>
+	<key>NSHumanReadableCopyright</key>
+	<string>Google, Inc.</string>
+	<key>CFBundleIdentifier</key>
+	<string>com.google.${PRODUCT_NAME:rfc1034identifier}GUI</string>
+	<key>CFBundleName</key>
+	<string>${PRODUCT_NAME}</string>
+	<key>CFBundleExecutable</key>
+	<string>${EXECUTABLE_NAME}</string>
 	<key>CFBundleVersion</key>
-	<string>$(CURRENT_PROJECT_VERSION)</string>
+	<string>TO.BE.FILLED</string>
+	<key>CFBundleShortVersionString</key>
+	<string>TO.BE.FILLED</string>
 	<key>LSMinimumSystemVersion</key>
-	<string>${MACOSX_VERSION_MIN}</string>
+	<string>${MACOSX_DEPLOYMENT_TARGET}</string>
 	<key>LSUIElement</key>
 	<true/>
-	<key>NSHumanReadableCopyright</key>
-	<string>Google LLC.</string>
 	<key>NSPrincipalClass</key>
 	<string>NSApplication</string>
 </dict>

Source/SantaGUI/SNTAboutWindowController.h

@@ -12,7 +12,12 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#import <Cocoa/Cocoa.h>
+@import Cocoa;
+
+@interface SNTAboutWindowController : NSWindowController
+
+@property IBOutlet NSButton *moreInfoButton;
+
+- (IBAction)openMoreInfoURL:(id)sender;
 
-@interface SNTAboutWindowController : NSWindowController <NSWindowDelegate>
 @end

Source/SantaGUI/SNTAboutWindowController.m

@@ -0,0 +1,37 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTAboutWindowController.h"
+
+#import "SNTConfigurator.h"
+
+@implementation SNTAboutWindowController
+
+- (instancetype)init {
+  return [super initWithWindowNibName:@"AboutWindow"];
+}
+
+- (void)loadWindow {
+  [super loadWindow];
+  if (![[SNTConfigurator configurator] moreInfoURL]) {
+    [self.moreInfoButton removeFromSuperview];
+  }
+}
+
+- (IBAction)openMoreInfoURL:(id)sender {
+  [[NSWorkspace sharedWorkspace] openURL:[[SNTConfigurator configurator] moreInfoURL]];
+  [self close];
+}
+
+@end

Source/SantaGUI/SNTAccessibleTextField.h

@@ -12,7 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#import <Cocoa/Cocoa.h>
+@import Cocoa;
 
 /**
    An NSTextField subclass that provides an accessiblity label equal to:

Source/SantaGUI/SNTAccessibleTextField.m

@@ -12,10 +12,14 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#import "Source/gui/SNTAccessibleTextField.h"
+#import "SNTAccessibleTextField.h"
 
 @implementation SNTAccessibleTextField
 
+- (BOOL)accessibilityIsIgnored {
+  return NO;
+}
+
 - (NSString *)accessibilityLabel {
   if (self.toolTip && self.stringValue) {
     return [NSString stringWithFormat:@"%@: %@", self.toolTip, self.stringValue];

Source/SantaGUI/SNTAppDelegate.h

@@ -12,10 +12,10 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#import <Cocoa/Cocoa.h>
+@import Cocoa;
 
 ///
 /// Initiates and manages the connection to santad
 ///
-@interface SNTAppDelegate : NSObject <NSApplicationDelegate>
+@interface SNTAppDelegate : NSObject<NSApplicationDelegate>
 @end

Source/SantaGUI/SNTAppDelegate.m

@@ -12,21 +12,21 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#import "Source/gui/SNTAppDelegate.h"
+#import "SNTAppDelegate.h"
 
-#import <MOLXPCConnection/MOLXPCConnection.h>
-
-#import "Source/common/SNTConfigurator.h"
-#import "Source/common/SNTLogging.h"
-#import "Source/common/SNTStrengthify.h"
-#import "Source/common/SNTXPCControlInterface.h"
-#import "Source/gui/SNTAboutWindowController.h"
-#import "Source/gui/SNTNotificationManager.h"
+#import "SNTAboutWindowController.h"
+#import "SNTConfigurator.h"
+#import "SNTFileWatcher.h"
+#import "SNTNotificationManager.h"
+#import "SNTStrengthify.h"
+#import "SNTXPCConnection.h"
+#import "SNTXPCControlInterface.h"
 
 @interface SNTAppDelegate ()
 @property SNTAboutWindowController *aboutWindowController;
+@property SNTFileWatcher *configFileWatcher;
 @property SNTNotificationManager *notificationManager;
-@property MOLXPCConnection *daemonListener;
+@property SNTXPCConnection *listener;
 @end
 
 @implementation SNTAppDelegate
@@ -35,6 +35,12 @@
 
 - (void)applicationDidFinishLaunching:(NSNotification *)aNotification {
   [self setupMenu];
+
+  self.configFileWatcher = [[SNTFileWatcher alloc] initWithFilePath:kDefaultConfigFilePath
+                                                            handler:^(unsigned long data) {
+    if (! (data & DISPATCH_VNODE_ATTRIB)) [[SNTConfigurator configurator] reloadConfigData];
+  }];
+
   self.notificationManager = [[SNTNotificationManager alloc] init];
 
   NSNotificationCenter *workspaceNotifications = [[NSWorkspace sharedWorkspace] notificationCenter];
@@ -43,70 +49,60 @@
                                       object:nil
                                        queue:[NSOperationQueue currentQueue]
                                   usingBlock:^(NSNotification *note) {
-                                    self.daemonListener.invalidationHandler = nil;
-                                    [self.daemonListener invalidate];
-                                    self.daemonListener = nil;
-                                  }];
+    self.listener.invalidationHandler = nil;
+    [self.listener invalidate];
+    self.listener = nil;
+  }];
   [workspaceNotifications addObserverForName:NSWorkspaceSessionDidBecomeActiveNotification
                                       object:nil
                                        queue:[NSOperationQueue currentQueue]
                                   usingBlock:^(NSNotification *note) {
-                                    [self attemptDaemonReconnection];
-                                  }];
+    [self attemptReconnection];
+  }];
 
-  [self createDaemonConnection];
+  [self createConnection];
 }
 
 - (BOOL)applicationShouldHandleReopen:(NSApplication *)sender hasVisibleWindows:(BOOL)flag {
-  if (!self.aboutWindowController) {
-    self.aboutWindowController = [[SNTAboutWindowController alloc] init];
-  }
+  self.aboutWindowController = [[SNTAboutWindowController alloc] init];
   [self.aboutWindowController showWindow:self];
   return NO;
 }
 
 #pragma mark Connection handling
 
-- (void)createDaemonConnection {
+- (void)createConnection {
   dispatch_semaphore_t sema = dispatch_semaphore_create(0);
 
   WEAKIFY(self);
 
   // Create listener for return connection from daemon.
   NSXPCListener *listener = [NSXPCListener anonymousListener];
-  self.daemonListener = [[MOLXPCConnection alloc] initServerWithListener:listener];
-  self.daemonListener.privilegedInterface = [SNTXPCNotifierInterface notifierInterface];
-  self.daemonListener.exportedObject = self.notificationManager;
-  self.daemonListener.acceptedHandler = ^{
+  self.listener = [[SNTXPCConnection alloc] initServerWithListener:listener];
+  self.listener.exportedInterface = [SNTXPCNotifierInterface notifierInterface];
+  self.listener.exportedObject = self.notificationManager;
+  self.listener.acceptedHandler = ^{
     dispatch_semaphore_signal(sema);
   };
-  self.daemonListener.invalidationHandler = ^{
+  self.listener.invalidationHandler = ^{
     STRONGIFY(self);
-    [self attemptDaemonReconnection];
+    [self attemptReconnection];
   };
-  [self.daemonListener resume];
-
-  // This listener will also handle bundle service requests to update the GUI.
-  // When initializing connections with santabundleservice, the notification manager
-  // will send along the endpoint so santabundleservice knows where to find us.
-  self.notificationManager.notificationListener = listener.endpoint;
+  [self.listener resume];
 
   // Tell daemon to connect back to the above listener.
-  MOLXPCConnection *daemonConn = [SNTXPCControlInterface configuredConnection];
+  SNTXPCConnection *daemonConn = [SNTXPCControlInterface configuredConnection];
   [daemonConn resume];
   [[daemonConn remoteObjectProxy] setNotificationListener:listener.endpoint];
-  [daemonConn invalidate];
 
   // Now wait for the connection to come in.
   if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC))) {
-    [self attemptDaemonReconnection];
+    [self attemptReconnection];
   }
 }
 
-- (void)attemptDaemonReconnection {
-  self.daemonListener.invalidationHandler = nil;
-  [self.daemonListener invalidate];
-  [self performSelectorInBackground:@selector(createDaemonConnection) withObject:nil];
+- (void)attemptReconnection {
+  [self performSelectorInBackground:@selector(createConnection) withObject:nil];
 }
 
 #pragma mark Menu Management

Source/SantaGUI/SNTMessageWindow.h

@@ -12,7 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#import <Cocoa/Cocoa.h>
+@import Cocoa;
 
 ///
 ///  An NSPanel that can become key/main and can fade in/out.

Source/SantaGUI/SNTMessageWindow.m

@@ -12,7 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#import "Source/gui/SNTMessageWindow.h"
+#import "SNTMessageWindow.h"
 
 @implementation SNTMessageWindow
 

Source/SantaGUI/SNTMessageWindowController.h

@@ -1,4 +1,4 @@
-/// Copyright 2021 Google Inc. All rights reserved.
+/// Copyright 2015 Google Inc. All rights reserved.
 ///
 /// Licensed under the Apache License, Version 2.0 (the "License");
 /// you may not use this file except in compliance with the License.
@@ -11,25 +11,29 @@
 ///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
-#import <Cocoa/Cocoa.h>
 
-#import "Source/common/SNTDeviceEvent.h"
-#import "Source/gui/SNTMessageWindowController.h"
-
-NS_ASSUME_NONNULL_BEGIN
+@import Cocoa;
 
 @class SNTStoredEvent;
 
+@protocol SNTMessageWindowControllerDelegate
+- (void)windowDidCloseSilenceHash:(NSString *)hash;
+@end
+
 ///
 ///  Controller for a single message window.
 ///
-@interface SNTDeviceMessageWindowController : SNTMessageWindowController <NSWindowDelegate>
+@interface SNTMessageWindowController : NSWindowController
 
-// The device event this window is for.
-@property(readonly) SNTDeviceEvent *event;
+- (instancetype)initWithEvent:(SNTStoredEvent *)event andMessage:(NSString *)message;
 
-- (instancetype)initWithEvent:(SNTDeviceEvent *)event message:(nullable NSString *)message;
+- (IBAction)showWindow:(id)sender;
+- (IBAction)closeWindow:(id)sender;
+- (IBAction)showCertInfo:(id)sender;
+
+///
+///  The delegate to inform when the notification is dismissed
+///
+@property(weak) id<SNTMessageWindowControllerDelegate> delegate;
 
 @end
-
-NS_ASSUME_NONNULL_END

Source/SantaGUI/SNTMessageWindowController.m

@@ -0,0 +1,149 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTMessageWindowController.h"
+
+@import SecurityInterface.SFCertificatePanel;
+
+#import "MOLCertificate.h"
+#import "SNTBlockMessage.h"
+#import "SNTConfigurator.h"
+#import "SNTFileInfo.h"
+#import "SNTMessageWindow.h"
+#import "SNTStoredEvent.h"
+
+@interface SNTMessageWindowController ()
+///  The execution event that this window is for
+@property SNTStoredEvent *event;
+
+///  The custom message to display for this event
+@property(copy) NSString *customMessage;
+
+///  A 'friendly' string representing the certificate information
+@property(readonly, nonatomic) NSString *publisherInfo;
+
+///  An optional message to display with this block.
+@property(readonly, nonatomic) NSAttributedString *attributedCustomMessage;
+
+///  Reference to the "Open Event" button in the XIB. Used to either remove the button
+///  if it isn't needed or set its title if it is.
+@property IBOutlet NSButton *openEventButton;
+
+///  Reference to the "Application Name" label in the XIB. Used to remove if application
+///  doesn't have a CFBundleName.
+@property IBOutlet NSTextField *applicationNameLabel;
+
+///  Linked to checkbox in UI to prevent future notifications for this binary.
+@property BOOL silenceFutureNotifications;
+@end
+
+@implementation SNTMessageWindowController
+
+- (instancetype)initWithEvent:(SNTStoredEvent *)event andMessage:(NSString *)message {
+  self = [super initWithWindowNibName:@"MessageWindow"];
+  if (self) {
+    _event = event;
+    _customMessage = message;
+  }
+  return self;
+}
+
+- (void)loadWindow {
+  [super loadWindow];
+  [self.window setLevel:NSPopUpMenuWindowLevel];
+  [self.window setMovableByWindowBackground:YES];
+
+  if (![[SNTConfigurator configurator] eventDetailURL]) {
+    [self.openEventButton removeFromSuperview];
+  } else {
+    NSString *eventDetailText = [[SNTConfigurator configurator] eventDetailText];
+    if (eventDetailText) {
+      [self.openEventButton setTitle:eventDetailText];
+    }
+  }
+
+  if (!self.event.fileBundleName) {
+    [self.applicationNameLabel removeFromSuperview];
+  }
+}
+
+- (IBAction)showWindow:(id)sender {
+  [(SNTMessageWindow *)self.window fadeIn:sender];
+}
+
+- (IBAction)closeWindow:(id)sender {
+  [(SNTMessageWindow *)self.window fadeOut:sender];
+}
+
+- (void)windowWillClose:(NSNotification *)notification {
+  if (!self.delegate) return;
+
+  if (self.silenceFutureNotifications) {
+    [self.delegate windowDidCloseSilenceHash:self.event.fileSHA256];
+  } else {
+    [self.delegate windowDidCloseSilenceHash:nil];
+  }
+}
+
+- (IBAction)showCertInfo:(id)sender {
+  // SFCertificatePanel expects an NSArray of SecCertificateRef's
+  NSMutableArray *certArray = [NSMutableArray arrayWithCapacity:[self.event.signingChain count]];
+  for (MOLCertificate *cert in self.event.signingChain) {
+    [certArray addObject:(id)cert.certRef];
+  }
+
+  [[[SFCertificatePanel alloc] init] beginSheetForWindow:self.window
+                                           modalDelegate:nil
+                                          didEndSelector:nil
+                                             contextInfo:nil
+                                            certificates:certArray
+                                               showGroup:YES];
+}
+
+- (IBAction)openEventDetails:(id)sender {
+  NSURL *url = [SNTBlockMessage eventDetailURLForEvent:self.event];
+  [self closeWindow:sender];
+  [[NSWorkspace sharedWorkspace] openURL:url];
+}
+
+#pragma mark Generated properties
+
++ (NSSet *)keyPathsForValuesAffectingValueForKey:(NSString *)key {
+  if (![key isEqualToString:@"event"]) {
+    return [NSSet setWithObject:@"event"];
+  } else {
+    return [NSSet set];
+  }
+}
+
+- (NSString *)publisherInfo {
+  MOLCertificate *leafCert = [self.event.signingChain firstObject];
+
+  if (leafCert.commonName && leafCert.orgName) {
+    return [NSString stringWithFormat:@"%@ - %@", leafCert.orgName, leafCert.commonName];
+  } else if (leafCert.commonName) {
+    return leafCert.commonName;
+  } else if (leafCert.orgName) {
+    return leafCert.orgName;
+  } else {
+    return nil;
+  }
+}
+
+- (NSAttributedString *)attributedCustomMessage {
+  return [SNTBlockMessage attributedBlockMessageForEvent:self.event
+                                           customMessage:self.customMessage];
+}
+
+@end

Source/SantaGUI/SNTNotificationManager.h

@@ -12,16 +12,14 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#import <Cocoa/Cocoa.h>
+@import Cocoa;
 
-#import "Source/common/SNTXPCNotifierInterface.h"
-#import "Source/gui/SNTMessageWindowController.h"
+#import "SNTMessageWindowController.h"
+#import "SNTXPCNotifierInterface.h"
 
 ///
 ///  Keeps track of pending notifications and ensures only one is presented to the user at a time.
 ///
-@interface SNTNotificationManager : NSObject <SNTMessageWindowControllerDelegate, SNTNotifierXPC>
-
-@property NSXPCListenerEndpoint *notificationListener;
+@interface SNTNotificationManager : NSObject<SNTMessageWindowControllerDelegate, SNTNotifierXPC>
 
 @end

Source/SantaGUI/SNTNotificationManager.m

@@ -0,0 +1,146 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTNotificationManager.h"
+
+#import "SNTBlockMessage.h"
+#import "SNTConfigurator.h"
+#import "SNTLogging.h"
+#import "SNTStoredEvent.h"
+
+@interface SNTNotificationManager ()
+///  The currently displayed notification
+@property SNTMessageWindowController *currentWindowController;
+
+///  The queue of pending notifications
+@property(readonly) NSMutableArray *pendingNotifications;
+@end
+
+@implementation SNTNotificationManager
+
+static NSString * const silencedNotificationsKey = @"SilencedNotifications";
+
+- (instancetype)init {
+  self = [super init];
+  if (self) {
+    _pendingNotifications = [[NSMutableArray alloc] init];
+  }
+  return self;
+}
+
+- (void)windowDidCloseSilenceHash:(NSString *)hash {
+  if (hash) [self updateSilenceDate:[NSDate date] forHash:hash];
+
+  [self.pendingNotifications removeObject:self.currentWindowController];
+  self.currentWindowController = nil;
+
+  if ([self.pendingNotifications count]) {
+    self.currentWindowController = [self.pendingNotifications firstObject];
+    [self.currentWindowController showWindow:self];
+  } else {
+    [NSApp hide:self];
+  }
+}
+
+- (void)updateSilenceDate:(NSDate *)date forHash:(NSString *)hash {
+  NSUserDefaults *ud = [NSUserDefaults standardUserDefaults];
+  NSMutableDictionary *d = [[ud objectForKey:silencedNotificationsKey] mutableCopy];
+  if (!d) d = [NSMutableDictionary dictionary];
+  if (date) {
+    d[hash] = date;
+  } else {
+    [d removeObjectForKey:hash];
+  }
+  [ud setObject:d forKey:silencedNotificationsKey];
+}
+
+#pragma mark SNTNotifierXPC protocol method
+
+- (void)postClientModeNotification:(SNTClientMode)clientmode {
+  NSUserNotification *un = [[NSUserNotification alloc] init];
+  un.title = @"Santa";
+  un.hasActionButton = NO;
+  NSString *customMsg;
+  switch (clientmode) {
+    case SNTClientModeMonitor:
+      un.informativeText = @"Switching into Monitor mode";
+      customMsg = [[SNTConfigurator configurator] modeNotificationMonitor];
+      customMsg = [SNTBlockMessage stringFromHTML:customMsg];
+      if (customMsg.length) un.informativeText = customMsg;
+      break;
+    case SNTClientModeLockdown:
+      un.informativeText = @"Switching into Lockdown mode";
+      customMsg = [[SNTConfigurator configurator] modeNotificationLockdown];
+      customMsg = [SNTBlockMessage stringFromHTML:customMsg];
+      if (customMsg.length) un.informativeText = customMsg;
+      break;
+    default:
+      return;
+  }
+  [[NSUserNotificationCenter defaultUserNotificationCenter] deliverNotification:un];
+}
+
+- (void)postBlockNotification:(SNTStoredEvent *)event withCustomMessage:(NSString *)message {
+  // See if this binary is already in the list of pending notifications.
+  NSPredicate *predicate =
+      [NSPredicate predicateWithFormat:@"event.fileSHA256==%@", event.fileSHA256];
+  if ([[self.pendingNotifications filteredArrayUsingPredicate:predicate] count]) return;
+
+  // See if this binary is silenced.
+  NSUserDefaults *ud = [NSUserDefaults standardUserDefaults];
+  NSDate *silenceDate = [ud objectForKey:silencedNotificationsKey][event.fileSHA256];
+  if ([silenceDate isKindOfClass:[NSDate class]]) {
+    NSDate *oneDayAgo = [NSDate dateWithTimeIntervalSinceNow:-86400];
+    if ([silenceDate compare:[NSDate date]] == NSOrderedDescending) {
+      LOGI(@"Notification silence: date is in the future, ignoring");
+      [self updateSilenceDate:nil forHash:event.fileSHA256];
+    } else if ([silenceDate compare:oneDayAgo] == NSOrderedAscending) {
+      LOGI(@"Notification silence: date is more than one day ago, ignoring");
+      [self updateSilenceDate:nil forHash:event.fileSHA256];
+    } else {
+      LOGI(@"Notification silence: dropping notification for %@", event.fileSHA256);
+      return;
+    }
+  }
+
+  if (!event) {
+    LOGI(@"Error: Missing event object in message received from daemon!");
+    return;
+  }
+
+  // Notifications arrive on a background thread but UI updates must happen on the main thread.
+  // This includes making windows.
+  dispatch_async(dispatch_get_main_queue(), ^{
+    SNTMessageWindowController *pendingMsg =
+        [[SNTMessageWindowController alloc] initWithEvent:event andMessage:message];
+    pendingMsg.delegate = self;
+    [self.pendingNotifications addObject:pendingMsg];
+
+    // If a notification isn't currently being displayed, display the incoming one.
+    if (!self.currentWindowController) {
+      self.currentWindowController = pendingMsg;
+      [pendingMsg showWindow:nil];
+    }
+  });
+}
+
+- (void)postRuleSyncNotificationWithCustomMessage:(NSString *)message {
+  NSUserNotification *un = [[NSUserNotification alloc] init];
+  un.title = @"Santa";
+  un.hasActionButton = NO;
+  un.informativeText = message ?: @"Requested application can now be run";
+  [[NSUserNotificationCenter defaultUserNotificationCenter] deliverNotification:un];
+}
+
+@end

Source/SantaGUI/main.m

@@ -0,0 +1,27 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+@import Cocoa;
+
+#import "SNTAppDelegate.h"
+
+int main(int argc, const char *argv[]) {
+  @autoreleasepool {
+    NSApplication *app = [NSApplication sharedApplication];
+    SNTAppDelegate *delegate = [[SNTAppDelegate alloc] init];
+    [app setDelegate:delegate];
+    [app finishLaunching];
+    [app run];
+  }
+}

Source/common/BUILD

@@ -1,545 +0,0 @@
-load("@rules_cc//cc:defs.bzl", "cc_proto_library")
-load("//:helper.bzl", "santa_unit_test")
-
-package(
-    default_visibility = ["//:santa_package_group"],
-)
-
-licenses(["notice"])
-
-proto_library(
-    name = "santa_proto",
-    srcs = ["santa.proto"],
-    deps = [
-        "//Source/santad/ProcessTree:process_tree_proto",
-        "@com_google_protobuf//:any_proto",
-        "@com_google_protobuf//:timestamp_proto",
-    ],
-)
-
-cc_proto_library(
-    name = "santa_cc_proto",
-    deps = [":santa_proto"],
-)
-
-# Note: Simple wrapper for a `cc_proto_library` target which cannot be directly
-# depended upon by an `objc_library` target.
-cc_library(
-    name = "santa_cc_proto_library_wrapper",
-    hdrs = ["santa_proto_include_wrapper.h"],
-    deps = [
-        ":santa_cc_proto",
-    ],
-)
-
-objc_library(
-    name = "SystemResources",
-    srcs = ["SystemResources.mm"],
-    hdrs = ["SystemResources.h"],
-    deps = [
-        ":SNTLogging",
-    ],
-)
-
-objc_library(
-    name = "SNTDeepCopy",
-    srcs = ["SNTDeepCopy.m"],
-    hdrs = ["SNTDeepCopy.h"],
-)
-
-cc_library(
-    name = "SantaCache",
-    hdrs = ["SantaCache.h"],
-    deps = [":BranchPrediction"],
-)
-
-santa_unit_test(
-    name = "SantaCacheTest",
-    srcs = ["SantaCacheTest.mm"],
-    deps = [
-        ":SantaCache",
-    ],
-)
-
-# This target shouldn't be used directly.
-# Use a more specific scoped type instead.
-objc_library(
-    name = "ScopedTypeRef",
-    hdrs = ["ScopedTypeRef.h"],
-    visibility = ["//Source/common:__pkg__"],
-)
-
-objc_library(
-    name = "ScopedCFTypeRef",
-    hdrs = ["ScopedCFTypeRef.h"],
-    deps = [
-        ":ScopedTypeRef",
-    ],
-)
-
-santa_unit_test(
-    name = "ScopedCFTypeRefTest",
-    srcs = ["ScopedCFTypeRefTest.mm"],
-    sdk_frameworks = [
-        "Security",
-    ],
-    deps = [
-        ":ScopedCFTypeRef",
-    ],
-)
-
-objc_library(
-    name = "ScopedIOObjectRef",
-    hdrs = ["ScopedIOObjectRef.h"],
-    sdk_frameworks = [
-        "IOKit",
-    ],
-    deps = [
-        ":ScopedTypeRef",
-    ],
-)
-
-santa_unit_test(
-    name = "ScopedIOObjectRefTest",
-    srcs = ["ScopedIOObjectRefTest.mm"],
-    sdk_frameworks = [
-        "IOKit",
-    ],
-    deps = [
-        ":ScopedIOObjectRef",
-        "//Source/santad:EndpointSecuritySerializerUtilities",
-    ],
-)
-
-objc_library(
-    name = "BranchPrediction",
-    hdrs = ["BranchPrediction.h"],
-)
-
-objc_library(
-    name = "SantaVnode",
-    hdrs = ["SantaVnode.h"],
-)
-
-objc_library(
-    name = "Platform",
-    hdrs = ["Platform.h"],
-)
-
-objc_library(
-    name = "String",
-    hdrs = ["String.h"],
-)
-
-objc_library(
-    name = "SantaVnodeHash",
-    srcs = ["SantaVnodeHash.mm"],
-    hdrs = ["SantaVnodeHash.h"],
-    deps = [
-        ":SantaCache",
-        ":SantaVnode",
-    ],
-)
-
-objc_library(
-    name = "CertificateHelpers",
-    srcs = ["CertificateHelpers.m"],
-    hdrs = ["CertificateHelpers.h"],
-    deps = [
-        "@MOLCertificate",
-    ],
-)
-
-objc_library(
-    name = "SigningIDHelpers",
-    srcs = ["SigningIDHelpers.m"],
-    hdrs = ["SigningIDHelpers.h"],
-    deps = [
-        ":SNTLogging",
-        "@MOLCodesignChecker",
-    ],
-)
-
-objc_library(
-    name = "SNTBlockMessage",
-    srcs = ["SNTBlockMessage.m"],
-    hdrs = ["SNTBlockMessage.h"],
-    deps = [
-        ":SNTConfigurator",
-        ":SNTFileAccessEvent",
-        ":SNTLogging",
-        ":SNTStoredEvent",
-        ":SNTSystemInfo",
-    ],
-)
-
-objc_library(
-    name = "SNTBlockMessage_SantaGUI",
-    srcs = ["SNTBlockMessage.m"],
-    hdrs = ["SNTBlockMessage.h"],
-    defines = ["SANTAGUI"],
-    deps = [
-        ":SNTConfigurator",
-        ":SNTFileAccessEvent",
-        ":SNTLogging",
-        ":SNTStoredEvent",
-        ":SNTSystemInfo",
-    ],
-)
-
-objc_library(
-    name = "SNTCachedDecision",
-    srcs = ["SNTCachedDecision.mm"],
-    hdrs = ["SNTCachedDecision.h"],
-    deps = [
-        ":SNTCommonEnums",
-        ":SantaVnode",
-    ],
-)
-
-objc_library(
-    name = "SNTDeviceEvent",
-    srcs = ["SNTDeviceEvent.m"],
-    hdrs = ["SNTDeviceEvent.h"],
-    module_name = "santa_common_SNTDeviceEvent",
-    sdk_frameworks = [
-        "Foundation",
-    ],
-    deps = [
-        ":SNTCommonEnums",
-    ],
-)
-
-objc_library(
-    name = "SNTFileAccessEvent",
-    srcs = ["SNTFileAccessEvent.m"],
-    hdrs = ["SNTFileAccessEvent.h"],
-    module_name = "santa_common_SNTFileAccessEvent",
-    sdk_frameworks = [
-        "Foundation",
-    ],
-    deps = [
-        ":CertificateHelpers",
-        ":SNTStoredEvent",
-    ],
-)
-
-objc_library(
-    name = "SNTCommonEnums",
-    textual_hdrs = ["SNTCommonEnums.h"],
-)
-
-objc_library(
-    name = "SNTConfigurator",
-    srcs = ["SNTConfigurator.m"],
-    hdrs = ["SNTConfigurator.h"],
-    module_name = "santa_common_SNTConfigurator",
-    sdk_frameworks = [
-        "Foundation",
-    ],
-    deps = [
-        ":SNTCommonEnums",
-        ":SNTRule",
-        ":SNTStrengthify",
-        ":SNTSystemInfo",
-    ],
-)
-
-objc_library(
-    name = "SNTKVOManager",
-    srcs = ["SNTKVOManager.mm"],
-    hdrs = ["SNTKVOManager.h"],
-    deps = [
-        ":SNTLogging",
-    ],
-)
-
-santa_unit_test(
-    name = "SNTKVOManagerTest",
-    srcs = ["SNTKVOManagerTest.mm"],
-    deps = [
-        ":SNTKVOManager",
-    ],
-)
-
-objc_library(
-    name = "SNTDropRootPrivs",
-    srcs = ["SNTDropRootPrivs.m"],
-    hdrs = ["SNTDropRootPrivs.h"],
-)
-
-objc_library(
-    name = "SNTFileInfo",
-    srcs = ["SNTFileInfo.m"],
-    hdrs = ["SNTFileInfo.h"],
-    deps = [
-        ":SNTLogging",
-        ":SantaVnode",
-        "@FMDB",
-        "@MOLCodesignChecker",
-    ],
-)
-
-objc_library(
-    name = "SNTLogging",
-    srcs = ["SNTLogging.m"],
-    hdrs = ["SNTLogging.h"],
-    deps = [":SNTConfigurator"],
-)
-
-objc_library(
-    name = "PrefixTree",
-    hdrs = ["PrefixTree.h"],
-    deps = [
-        ":SNTLogging",
-        "@com_google_absl//absl/synchronization",
-    ],
-)
-
-objc_library(
-    name = "Unit",
-    hdrs = ["Unit.h"],
-)
-
-objc_library(
-    name = "SNTRule",
-    srcs = ["SNTRule.m"],
-    hdrs = ["SNTRule.h"],
-    sdk_frameworks = [
-        "Foundation",
-    ],
-    deps = [
-        ":SNTCommonEnums",
-        ":SNTSyncConstants",
-    ],
-)
-
-santa_unit_test(
-    name = "SNTRuleTest",
-    srcs = ["SNTRuleTest.m"],
-    deps = [
-        ":SNTCommonEnums",
-        ":SNTRule",
-        ":SNTSyncConstants",
-    ],
-)
-
-objc_library(
-    name = "SNTRuleIdentifiers",
-    srcs = ["SNTRuleIdentifiers.m"],
-    hdrs = ["SNTRuleIdentifiers.h"],
-)
-
-objc_library(
-    name = "SNTStoredEvent",
-    srcs = ["SNTStoredEvent.m"],
-    hdrs = ["SNTStoredEvent.h"],
-    deps = [
-        ":SNTCommonEnums",
-        "@MOLCertificate",
-    ],
-)
-
-cc_library(
-    name = "SNTStrengthify",
-    hdrs = ["SNTStrengthify.h"],
-)
-
-objc_library(
-    name = "SNTSyncConstants",
-    srcs = ["SNTSyncConstants.m"],
-    hdrs = ["SNTSyncConstants.h"],
-    sdk_frameworks = [
-        "Foundation",
-    ],
-)
-
-objc_library(
-    name = "SNTSystemInfo",
-    srcs = ["SNTSystemInfo.m"],
-    hdrs = ["SNTSystemInfo.h"],
-    sdk_frameworks = [
-        "Foundation",
-        "IOKit",
-    ],
-)
-
-objc_library(
-    name = "SNTXPCBundleServiceInterface",
-    srcs = ["SNTXPCBundleServiceInterface.m"],
-    hdrs = ["SNTXPCBundleServiceInterface.h"],
-    deps = [
-        ":SNTStoredEvent",
-        "@MOLXPCConnection",
-    ],
-)
-
-objc_library(
-    name = "SNTXPCMetricServiceInterface",
-    srcs = ["SNTXPCMetricServiceInterface.m"],
-    hdrs = ["SNTXPCMetricServiceInterface.h"],
-    deps = [
-        "@MOLXPCConnection",
-    ],
-)
-
-objc_library(
-    name = "SNTXPCControlInterface",
-    srcs = ["SNTXPCControlInterface.m"],
-    hdrs = ["SNTXPCControlInterface.h"],
-    defines = select({
-        "//:adhoc_build": ["SANTAADHOC"],
-        "//conditions:default": None,
-    }),
-    deps = [
-        ":SNTCommonEnums",
-        ":SNTConfigurator",
-        ":SNTRule",
-        ":SNTRuleIdentifiers",
-        ":SNTStoredEvent",
-        ":SNTXPCUnprivilegedControlInterface",
-        "@MOLCodesignChecker",
-        "@MOLXPCConnection",
-    ],
-)
-
-objc_library(
-    name = "SNTXPCNotifierInterface",
-    srcs = ["SNTXPCNotifierInterface.m"],
-    hdrs = ["SNTXPCNotifierInterface.h"],
-    deps = [
-        ":SNTCommonEnums",
-        ":SNTXPCBundleServiceInterface",
-    ],
-)
-
-objc_library(
-    name = "SNTMetricSet",
-    srcs = ["SNTMetricSet.m"],
-    hdrs = ["SNTMetricSet.h"],
-    deps = [":SNTCommonEnums"],
-)
-
-objc_library(
-    name = "SNTXPCSyncServiceInterface",
-    srcs = ["SNTXPCSyncServiceInterface.m"],
-    hdrs = ["SNTXPCSyncServiceInterface.h"],
-    deps = [
-        ":SNTCommonEnums",
-        ":SNTStoredEvent",
-        "@MOLXPCConnection",
-    ],
-)
-
-objc_library(
-    name = "SNTXPCUnprivilegedControlInterface",
-    srcs = ["SNTXPCUnprivilegedControlInterface.m"],
-    hdrs = ["SNTXPCUnprivilegedControlInterface.h"],
-    deps = [
-        ":SNTCommonEnums",
-        ":SNTRule",
-        ":SNTRuleIdentifiers",
-        ":SNTStoredEvent",
-        ":SNTXPCBundleServiceInterface",
-        ":SantaVnode",
-        "@MOLCertificate",
-        "@MOLXPCConnection",
-    ],
-)
-
-santa_unit_test(
-    name = "SNTFileInfoTest",
-    srcs = ["SNTFileInfoTest.m"],
-    resources = [
-        "testdata/32bitplist",
-        "testdata/bad_pagezero",
-        "testdata/missing_pagezero",
-    ],
-    structured_resources = glob([
-        "testdata/BundleExample.app/**",
-        "testdata/DirectoryBundle/**",
-    ]),
-    deps = [":SNTFileInfo"],
-)
-
-santa_unit_test(
-    name = "PrefixTreeTest",
-    srcs = ["PrefixTreeTest.mm"],
-    deps = [":PrefixTree"],
-)
-
-santa_unit_test(
-    name = "SNTMetricSetTest",
-    srcs = ["SNTMetricSetTest.m"],
-    deps = [":SNTMetricSet"],
-)
-
-santa_unit_test(
-    name = "SNTCachedDecisionTest",
-    srcs = ["SNTCachedDecisionTest.mm"],
-    deps = [
-        "//Source/common:SNTCachedDecision",
-        "//Source/common:TestUtils",
-        "@OCMock",
-    ],
-)
-
-santa_unit_test(
-    name = "SNTBlockMessageTest",
-    srcs = ["SNTBlockMessageTest.m"],
-    sdk_frameworks = [
-        "AppKit",
-    ],
-    deps = [
-        ":SNTBlockMessage_SantaGUI",
-        ":SNTConfigurator",
-        ":SNTFileAccessEvent",
-        ":SNTStoredEvent",
-        ":SNTSystemInfo",
-        "@OCMock",
-    ],
-)
-
-santa_unit_test(
-    name = "SNTConfiguratorTest",
-    srcs = ["SNTConfiguratorTest.m"],
-    deps = [
-        ":SNTCommonEnums",
-        ":SNTConfigurator",
-        "@OCMock",
-    ],
-)
-
-test_suite(
-    name = "unit_tests",
-    tests = [
-        ":PrefixTreeTest",
-        ":SNTBlockMessageTest",
-        ":SNTCachedDecisionTest",
-        ":SNTConfiguratorTest",
-        ":SNTFileInfoTest",
-        ":SNTKVOManagerTest",
-        ":SNTMetricSetTest",
-        ":SNTRuleTest",
-        ":SantaCacheTest",
-        ":ScopedCFTypeRefTest",
-        ":ScopedIOObjectRefTest",
-    ],
-    visibility = ["//:santa_package_group"],
-)
-
-objc_library(
-    name = "TestUtils",
-    testonly = 1,
-    srcs = ["TestUtils.mm"],
-    hdrs = ["TestUtils.h"],
-    sdk_dylibs = [
-        "bsm",
-    ],
-    deps = [
-        ":Platform",
-        ":SystemResources",
-        "@OCMock",
-        "@com_google_googletest//:gtest",
-    ],
-)

Source/common/BranchPrediction.h

@@ -1,22 +0,0 @@
-/// Copyright 2022 Google LLC
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///     https://www.apache.org/licenses/LICENSE-2.0
-///
-/// Unless required by applicable law or agreed to in writing, software
-/// distributed under the License is distributed on an "AS IS" BASIS,
-/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-/// See the License for the specific language governing permissions and
-/// limitations under the License.
-
-#ifndef SANTA__COMMON__BRANCHPREDICTION_H
-#define SANTA__COMMON__BRANCHPREDICTION_H
-
-// Helpful macros to use when the the outcome is largely known
-#define likely(x) __builtin_expect(!!(x), 1)
-#define unlikely(x) __builtin_expect(!!(x), 0)
-
-#endif

Source/common/CertificateHelpers.h

@@ -1,43 +0,0 @@
-/// Copyright 2023 Google LLC
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///     https://www.apache.org/licenses/LICENSE-2.0
-///
-/// Unless required by applicable law or agreed to in writing, software
-/// distributed under the License is distributed on an "AS IS" BASIS,
-/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-/// See the License for the specific language governing permissions and
-/// limitations under the License.
-
-#import <Foundation/Foundation.h>
-#import <MOLCertificate/MOLCertificate.h>
-#include <sys/cdefs.h>
-
-__BEGIN_DECLS
-
-/**
-  Return a string representing publisher info from the provided certs
-
-  @param certs A certificate chain
-  @param teamID A team ID to be displayed for apps from the App Store
-
-  @return A string that tries to be more helpful to users by extracting
-  appropriate information from the certificate chain.
-*/
-NSString *Publisher(NSArray<MOLCertificate *> *certs, NSString *teamID);
-
-/**
-  Return an array of the underlying SecCertificateRef's for the given array
-  of MOLCertificates.
-
-  @param certs An array of MOLCertificates
-
-  @return An array of SecCertificateRefs. WARNING: If the refs need to be used
-  for a long time be careful to properly CFRetain/CFRelease the returned items.
-*/
-NSArray<id> *CertificateChain(NSArray<MOLCertificate *> *certs);
-
-__END_DECLS

Source/common/CertificateHelpers.m

@@ -1,42 +0,0 @@
-/// Copyright 2023 Google LLC
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///     https://www.apache.org/licenses/LICENSE-2.0
-///
-/// Unless required by applicable law or agreed to in writing, software
-/// distributed under the License is distributed on an "AS IS" BASIS,
-/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-/// See the License for the specific language governing permissions and
-/// limitations under the License.
-
-#import "Source/common/CertificateHelpers.h"
-
-#include <Security/SecCertificate.h>
-
-NSString *Publisher(NSArray<MOLCertificate *> *certs, NSString *teamID) {
-  MOLCertificate *leafCert = [certs firstObject];
-
-  if ([leafCert.commonName isEqualToString:@"Apple Mac OS Application Signing"]) {
-    return [NSString stringWithFormat:@"App Store (Team ID: %@)", teamID];
-  } else if (leafCert.commonName && leafCert.orgName) {
-    return [NSString stringWithFormat:@"%@ - %@", leafCert.orgName, leafCert.commonName];
-  } else if (leafCert.commonName) {
-    return leafCert.commonName;
-  } else if (leafCert.orgName) {
-    return leafCert.orgName;
-  } else {
-    return nil;
-  }
-}
-
-NSArray<id> *CertificateChain(NSArray<MOLCertificate *> *certs) {
-  NSMutableArray *certArray = [NSMutableArray arrayWithCapacity:[certs count]];
-  for (MOLCertificate *cert in certs) {
-    [certArray addObject:(id)cert.certRef];
-  }
-
-  return certArray;
-}

Source/common/Platform.h

@@ -1,41 +0,0 @@
-/// Copyright 2022 Google LLC
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///     https://www.apache.org/licenses/LICENSE-2.0
-///
-/// Unless required by applicable law or agreed to in writing, software
-/// distributed under the License is distributed on an "AS IS" BASIS,
-/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-/// See the License for the specific language governing permissions and
-/// limitations under the License.
-
-#ifndef SANTA__COMMON__PLATFORM_H
-#define SANTA__COMMON__PLATFORM_H
-
-#include <Availability.h>
-
-#if defined(MAC_OS_VERSION_13_0) && \
-    MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_13_0
-#define HAVE_MACOS_13 1
-#else
-#define HAVE_MACOS_13 0
-#endif
-
-#if defined(MAC_OS_VERSION_14_0) && \
-    MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_14_0
-#define HAVE_MACOS_14 1
-#else
-#define HAVE_MACOS_14 0
-#endif
-
-#if defined(MAC_OS_VERSION_15_0) && \
-    MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_VERSION_15_0
-#define HAVE_MACOS_15 1
-#else
-#define HAVE_MACOS_15 0
-#endif
-
-#endif

Source/common/PrefixTree.h

@@ -1,305 +0,0 @@
-/// Copyright 2022 Google LLC
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///     https://www.apache.org/licenses/LICENSE-2.0
-///
-/// Unless required by applicable law or agreed to in writing, software
-/// distributed under the License is distributed on an "AS IS" BASIS,
-/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-/// See the License for the specific language governing permissions and
-/// limitations under the License.
-
-#ifndef SANTA__COMMON__PREFIXTREE_H
-#define SANTA__COMMON__PREFIXTREE_H
-
-#include <sys/syslimits.h>
-
-#include <optional>
-
-#import "Source/common/SNTLogging.h"
-#include "absl/synchronization/mutex.h"
-
-#if SANTA_PREFIX_TREE_DEBUG
-#define DEBUG_LOG LOGD
-#else
-#define DEBUG_LOG(format, ...)  // NOP
-#endif
-
-namespace santa {
-
-template <typename ValueT>
-class PrefixTree {
- private:
-  // Forward declaration
-  enum class NodeType;
-  class TreeNode;
-
- public:
-  PrefixTree(uint32_t max_depth = PATH_MAX)
-      : root_(new TreeNode()), max_depth_(max_depth), node_count_(0) {}
-
-  ~PrefixTree() { PruneLocked(root_); }
-
-  bool InsertPrefix(const char *s, ValueT value) {
-    absl::MutexLock lock(&lock_);
-    return InsertLocked(s, value, NodeType::kPrefix);
-  }
-
-  bool InsertLiteral(const char *s, ValueT value) {
-    absl::MutexLock lock(&lock_);
-    return InsertLocked(s, value, NodeType::kLiteral);
-  }
-
-  bool HasPrefix(const char *input) {
-    absl::ReaderMutexLock lock(&lock_);
-    return HasPrefixLocked(input);
-  }
-
-  std::optional<ValueT> LookupLongestMatchingPrefix(const char *input) {
-    if (!input) {
-      return std::nullopt;
-    }
-
-    absl::ReaderMutexLock lock(&lock_);
-    return LookupLongestMatchingPrefixLocked(input);
-  }
-
-  void Reset() {
-    absl::MutexLock lock(&lock_);
-    PruneLocked(root_);
-    root_ = new TreeNode();
-    node_count_ = 0;
-  }
-
-  uint32_t NodeCount() {
-    absl::ReaderMutexLock lock(&lock_);
-    return node_count_;
-  }
-
-#if SANTA_PREFIX_TREE_DEBUG
-  void Print() {
-    char buf[max_depth_ + 1];
-    memset(buf, 0, sizeof(buf));
-
-    absl::ReaderMutexLock lock(&lock_);
-    PrintLocked(root_, buf, 0);
-  }
-#endif
-
- private:
-  ABSL_EXCLUSIVE_LOCKS_REQUIRED(lock_)
-  bool InsertLocked(const char *input, ValueT value, NodeType node_type) {
-    const char *p = input;
-    TreeNode *node = root_;
-
-    while (*p) {
-      uint8_t cur_byte = (uint8_t)*p;
-
-      TreeNode *child_node = node->children_[cur_byte];
-      if (!child_node) {
-        // Current node doesn't exist...
-        // Create the rest of the nodes in the tree for the given string
-
-        // Keep a pointer to where this new branch starts from. If the
-        // input length exceeds max_depth, the new branch will need to
-        // be pruned.
-        TreeNode *branch_start_node = node;
-        uint8_t branch_start_byte = (uint8_t)*p;
-
-        do {
-          TreeNode *new_node = new TreeNode();
-          node->children_[cur_byte] = new_node;
-          node = new_node;
-          node_count_++;
-
-          // Check current depth...
-          if (p - input >= max_depth_) {
-            // Attempted to add a string that exceeded max depth
-            // Prune tree from start of this new branch
-            PruneLocked(branch_start_node->children_[branch_start_byte]);
-            branch_start_node->children_[branch_start_byte] = nullptr;
-
-            return false;
-          }
-
-          // Disabling clang format due to local/remote version differences.
-          // clang-format off
-          cur_byte = (uint8_t)*++p;
-          // clang-format on
-        } while (*p);
-
-        node->node_type_ = node_type;
-        node->value_ = value;
-
-        return true;
-      } else if (*(p + 1) == '\0') {
-        // Current node exists and we're at the end of our input...
-        // Note: The current node's data will be overwritten
-
-        // Only increment node count if the previous node type wasn't already a
-        // prefix or literal type (in which case it was already counted)
-        if (child_node->node_type_ == NodeType::kInner) {
-          node_count_++;
-        }
-
-        child_node->node_type_ = node_type;
-        child_node->value_ = value;
-        return true;
-      }
-
-      node = child_node;
-      p++;
-    }
-
-    // Should only get here when input is an empty string
-    return false;
-  }
-
-  ABSL_SHARED_LOCKS_REQUIRED(lock_)
-  bool HasPrefixLocked(const char *input) {
-    TreeNode *node = root_;
-    const char *p = input;
-
-    while (*p) {
-      node = node->children_[(uint8_t)*p++];
-
-      if (!node) {
-        break;
-      }
-
-      if (node->node_type_ == NodeType::kPrefix ||
-          (*p == '\0' && node->node_type_ == NodeType::kLiteral)) {
-        return true;
-      }
-    }
-
-    return false;
-  }
-
-  ABSL_SHARED_LOCKS_REQUIRED(lock_)
-  std::optional<ValueT> LookupLongestMatchingPrefixLocked(const char *input) {
-    TreeNode *node = root_;
-    TreeNode *match = nullptr;
-    const char *p = input;
-
-    while (*p) {
-      node = node->children_[(uint8_t)*p++];
-
-      if (!node) {
-        break;
-      }
-
-      if (node->node_type_ == NodeType::kPrefix ||
-          (*p == '\0' && node->node_type_ == NodeType::kLiteral)) {
-        match = node;
-      }
-    }
-
-    return match ? std::make_optional<ValueT>(match->value_) : std::nullopt;
-  }
-
-  ABSL_EXCLUSIVE_LOCKS_REQUIRED(lock_)
-  void PruneLocked(TreeNode *target) {
-    if (!target) {
-      return;
-    }
-
-    // For deep trees, a recursive approach will generate too many stack frames.
-    // Since the depth of the tree is configurable, err on the side of caution
-    // and use a "stack" to walk the tree in a non-recursive manner.
-    TreeNode **stack = new TreeNode *[node_count_ + 1];
-    if (!stack) {
-      LOGE(@"Unable to prune tree!");
-      return;
-    }
-
-    uint32_t count = 0;
-
-    // Seed the "stack" with a starting node.
-    stack[count++] = target;
-
-    // Start at the target node and walk the tree to find and delete all the
-    // sub-nodes.
-    while (count) {
-      TreeNode *node = stack[--count];
-
-      for (int i = 0; i < 256; ++i) {
-        if (!node->children_[i]) {
-          continue;
-        }
-        stack[count++] = node->children_[i];
-      }
-
-      delete node;
-      --node_count_;
-    }
-
-    delete[] stack;
-  }
-
-#if SANTA_PREFIX_TREE_DEBUG
-  ABSL_SHARED_LOCKS_REQUIRED(lock_)
-  void PrintLocked(TreeNode *node, char *buf, uint32_t depth) {
-    for (size_t i = 0; i < 256; i++) {
-      TreeNode *cur_node = node->children_[i];
-      if (cur_node) {
-        buf[depth] = i;
-        if (cur_node->node_type_ != NodeType::kInner) {
-          printf("\t%s (type: %s)\n", buf,
-                 cur_node->node_type_ == NodeType::kPrefix ? "prefix" : "literal");
-        }
-        PrintLocked(cur_node, buf, depth + 1);
-        buf[depth] = '\0';
-      }
-    }
-  }
-#endif
-
-  enum class NodeType {
-    kInner = 0,
-    kPrefix,
-    kLiteral,
-  };
-
-  ///
-  ///  TreeNode is a wrapper class that represents one byte.
-  ///  1 node can represent a whole ASCII character.
-  ///  For example a pointer to the 'A' node will be stored at children[0x41].
-  ///  It takes 1-4 nodes to represent a UTF-8 encoded Unicode character.
-  ///
-  ///  The path for "/🤘" would look like this:
-  ///      children[0x2f] -> children[0xf0] -> children[0x9f] -> children[0xa4]
-  ///      -> children[0x98]
-  ///
-  ///  The path for "/dev" is:
-  ///      children[0x2f] -> children[0x64] -> children[0x65] -> children[0x76]
-  ///
-  ///  Lookups of children are O(1).
-  ///
-  ///  Having the nodes represented by a smaller width, such as a nibble (1/2
-  ///  byte), would drastically decrease the memory footprint but would double
-  ///  required dereferences.
-  ///
-  ///  TODO(bur): Potentially convert this into a full on radix tree.
-  ///
-  class TreeNode {
-   public:
-    TreeNode() : children_(), node_type_(NodeType::kInner) {}
-    ~TreeNode() = default;
-    TreeNode *children_[256];
-    PrefixTree::NodeType node_type_;
-    ValueT value_;
-  };
-
-  TreeNode *root_;
-  const uint32_t max_depth_;
-  uint32_t node_count_ ABSL_GUARDED_BY(lock_);
-  absl::Mutex lock_;
-};
-
-}  // namespace santa
-
-#endif

Source/common/PrefixTreeTest.mm

@@ -1,224 +0,0 @@
-/// Copyright 2022 Google LLC
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///     https://www.apache.org/licenses/LICENSE-2.0
-///
-/// Unless required by applicable law or agreed to in writing, software
-/// distributed under the License is distributed on an "AS IS" BASIS,
-/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-/// See the License for the specific language governing permissions and
-/// limitations under the License.
-
-#import <XCTest/XCTest.h>
-
-#define SANTA_PREFIX_TREE_DEBUG 1
-#include "Source/common/PrefixTree.h"
-
-using santa::PrefixTree;
-
-@interface PrefixTreeTest : XCTestCase
-@end
-
-@implementation PrefixTreeTest
-
-- (void)testBasic {
-  PrefixTree<int> tree;
-
-  XCTAssertFalse(tree.HasPrefix("/foo/bar/baz"));
-  XCTAssertFalse(tree.HasPrefix("/foo/bar.txt"));
-  XCTAssertFalse(tree.HasPrefix("/baz"));
-
-  XCTAssertTrue(tree.InsertPrefix("/foo", 12));
-  XCTAssertTrue(tree.InsertPrefix("/bar", 34));
-  XCTAssertTrue(tree.InsertLiteral("/foo/bar", 56));
-
-  // Re-inserting something that exists is allowed
-  XCTAssertTrue(tree.InsertLiteral("/foo", 78));
-  XCTAssertTrue(tree.InsertPrefix("/foo", 56));
-
-  XCTAssertTrue(tree.HasPrefix("/foo/bar/baz"));
-  XCTAssertTrue(tree.HasPrefix("/foo/bar.txt"));
-  XCTAssertFalse(tree.HasPrefix("/baz"));
-
-  // Empty strings are not supported
-  XCTAssertFalse(tree.InsertLiteral("", 0));
-  XCTAssertFalse(tree.InsertPrefix("", 0));
-}
-
-- (void)testHasPrefix {
-  PrefixTree<int> tree;
-
-  XCTAssertTrue(tree.InsertPrefix("/foo", 0));
-  XCTAssertTrue(tree.InsertLiteral("/bar", 0));
-  XCTAssertTrue(tree.InsertLiteral("/baz", 0));
-  XCTAssertTrue(tree.InsertLiteral("/qaz", 0));
-
-  // Check that a tree with a matching prefix is successful
-  XCTAssertTrue(tree.HasPrefix("/foo.txt"));
-
-  // This shouldn't succeed because `/bar` `/baz` and `qaz` are literals
-  XCTAssertFalse(tree.HasPrefix("/bar.txt"));
-  XCTAssertFalse(tree.HasPrefix("/baz.txt"));
-  XCTAssertFalse(tree.HasPrefix("/qaz.txt"));
-
-  // Now change `/bar` to a prefix type and retest HasPrefix
-  // `/bar.txt` should now succeed, but `/baz.txt` should still not pass
-  XCTAssertTrue(tree.InsertPrefix("/bar", 0));
-  XCTAssertTrue(tree.HasPrefix("/bar.txt"));
-  XCTAssertFalse(tree.HasPrefix("/baz.txt"));
-  XCTAssertFalse(tree.HasPrefix("/qaz.txt"));
-
-  // Insert a new prefix string to allow `/baz.txt` to have a valid prefix
-  XCTAssertTrue(tree.InsertPrefix("/b", 0));
-  XCTAssertTrue(tree.HasPrefix("/baz.txt"));
-  XCTAssertFalse(tree.HasPrefix("/qaz.txt"));
-
-  // An exact match on a literal allows HasPrefix to succeed
-  XCTAssertTrue(tree.InsertLiteral("/qaz.txt", 0));
-  XCTAssertTrue(tree.HasPrefix("/qaz.txt"));
-}
-
-- (void)testLookupLongestMatchingPrefix {
-  PrefixTree<int> tree;
-
-  XCTAssertTrue(tree.InsertPrefix("/foo", 12));
-  XCTAssertTrue(tree.InsertPrefix("/bar", 34));
-  XCTAssertTrue(tree.InsertPrefix("/foo/bar.txt", 56));
-
-  std::optional<int> value;
-
-  // Matching exact prefix
-  value = tree.LookupLongestMatchingPrefix("/foo");
-  XCTAssertEqual(value.value_or(0), 12);
-
-  // Ensure changing node type works as expected
-  // Literals must match exactly.
-  value = tree.LookupLongestMatchingPrefix("/foo/bar.txt.tmp");
-  XCTAssertEqual(value.value_or(0), 56);
-  XCTAssertTrue(tree.InsertLiteral("/foo/bar.txt", 90));
-  value = tree.LookupLongestMatchingPrefix("/foo/bar.txt.tmp");
-  XCTAssertEqual(value.value_or(0), 12);
-
-  // Inserting over an exiting node returns the new value
-  XCTAssertTrue(tree.InsertPrefix("/foo", 78));
-  value = tree.LookupLongestMatchingPrefix("/foo");
-  XCTAssertEqual(value.value_or(0), 78);
-
-  // No matching prefix
-  value = tree.LookupLongestMatchingPrefix("/asdf");
-  XCTAssertEqual(value.value_or(0), 0);
-}
-
-- (void)testNodeCounts {
-  const uint32_t maxDepth = 100;
-  PrefixTree<int> tree(100);
-
-  XCTAssertEqual(tree.NodeCount(), 0);
-
-  // Start with a small string
-  XCTAssertTrue(tree.InsertPrefix("asdf", 0));
-  XCTAssertEqual(tree.NodeCount(), 4);
-
-  // Add a couple more characters to the existing string
-  XCTAssertTrue(tree.InsertPrefix("asdfgh", 0));
-  XCTAssertEqual(tree.NodeCount(), 6);
-
-  // Inserting a string that exceeds max depth doesn't increase node count
-  XCTAssertFalse(tree.InsertPrefix(std::string(maxDepth + 10, 'A').c_str(), 0));
-  XCTAssertEqual(tree.NodeCount(), 6);
-
-  // Add a new string that is a prefix of an existing string
-  // This should increment the count by one since a new terminal node exists
-  XCTAssertTrue(tree.InsertPrefix("as", 0));
-  XCTAssertEqual(tree.NodeCount(), 7);
-
-  // Re-inserting onto an existing node shouldn't modify the count
-  tree.InsertLiteral("as", 0);
-  tree.InsertPrefix("as", 0);
-  XCTAssertEqual(tree.NodeCount(), 7);
-}
-
-- (void)testReset {
-  // Ensure resetting a tree removes all content
-  PrefixTree<int> tree;
-
-  tree.Reset();
-  XCTAssertEqual(tree.NodeCount(), 0);
-
-  XCTAssertTrue(tree.InsertPrefix("asdf", 0));
-  XCTAssertTrue(tree.InsertPrefix("qwerty", 0));
-
-  XCTAssertTrue(tree.HasPrefix("asdf"));
-  XCTAssertTrue(tree.HasPrefix("qwerty"));
-  XCTAssertEqual(tree.NodeCount(), 10);
-
-  tree.Reset();
-  XCTAssertFalse(tree.HasPrefix("asdf"));
-  XCTAssertFalse(tree.HasPrefix("qwerty"));
-  XCTAssertEqual(tree.NodeCount(), 0);
-}
-
-- (void)testComplexValues {
-  class Foo {
-   public:
-    Foo(int x) : x_(x) {}
-    int X() { return x_; }
-
-   private:
-    int x_;
-  };
-
-  PrefixTree<std::shared_ptr<Foo>> tree;
-
-  XCTAssertTrue(tree.InsertPrefix("foo", std::make_shared<Foo>(123)));
-  XCTAssertTrue(tree.InsertPrefix("bar", std::make_shared<Foo>(456)));
-
-  std::optional<std::shared_ptr<Foo>> value;
-  value = tree.LookupLongestMatchingPrefix("foo");
-  XCTAssertTrue(value.has_value() && value->get()->X() == 123);
-
-  value = tree.LookupLongestMatchingPrefix("bar");
-  XCTAssertTrue(value.has_value() && value->get()->X() == 456);
-
-  value = tree.LookupLongestMatchingPrefix("asdf");
-  XCTAssertFalse(value.has_value());
-}
-
-- (void)testThreading {
-  uint32_t count = 4096;
-  auto t = new PrefixTree<int>(count * (uint32_t)[NSUUID UUID].UUIDString.length);
-
-  __block NSMutableArray *UUIDs = [NSMutableArray arrayWithCapacity:count];
-  for (int i = 0; i < count; ++i) {
-    [UUIDs addObject:[NSUUID UUID].UUIDString];
-  }
-
-  __block _Atomic BOOL stop = NO;
-
-  // Create a bunch of background noise.
-  dispatch_async(dispatch_get_global_queue(0, 0), ^{
-    for (uint64_t i = 0; i < UINT64_MAX; ++i) {
-      dispatch_async(dispatch_get_global_queue(0, 0), ^{
-        t->HasPrefix([UUIDs[i % count] UTF8String]);
-      });
-      if (stop) return;
-    }
-  });
-
-  // Fill up the tree.
-  dispatch_apply(count, dispatch_get_global_queue(0, 0), ^(size_t i) {
-    XCTAssertEqual(t->InsertPrefix([UUIDs[i] UTF8String], 0), true);
-  });
-
-  // Make sure every leaf byte is found.
-  dispatch_apply(count, dispatch_get_global_queue(0, 0), ^(size_t i) {
-    XCTAssertTrue(t->HasPrefix([UUIDs[i] UTF8String]));
-  });
-
-  stop = YES;
-}
-
-@end

Source/common/SNTBlockMessage.h

@@ -12,14 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#ifdef SANTAGUI
-#import <Cocoa/Cocoa.h>
-#else
-#import <Foundation/Foundation.h>
-#endif
-
-#import "Source/common/SNTFileAccessEvent.h"
-#import "Source/common/SNTStoredEvent.h"
+@import Foundation;
 
 @class SNTStoredEvent;
 
@@ -27,29 +20,20 @@
 
 ///
 ///  Return a message suitable for presenting to the user.
+///  Uses either the configured message depending on the event type or a custom message
+///  if the rule that blocked this file included one.
 ///
 ///  In SantaGUI this will return an NSAttributedString with links and formatting included
 ///  while for santad all HTML will be properly stripped.
 ///
-+ (NSAttributedString *)formatMessage:(NSString *)message;
-
-///
-///  Uses either the configured message depending on the event type or a custom message
-///  if the rule that blocked this file included one, formatted using
-///  +[SNTBlockMessage formatMessage].
-///
 + (NSAttributedString *)attributedBlockMessageForEvent:(SNTStoredEvent *)event
                                          customMessage:(NSString *)customMessage;
 
-+ (NSAttributedString *)attributedBlockMessageForFileAccessEvent:(SNTFileAccessEvent *)event
-                                                   customMessage:(NSString *)customMessage;
-
 ///
 ///  Return a URL generated from the EventDetailURL configuration key
 ///  after replacing templates in the URL with values from the event.
 ///
-+ (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event customURL:(NSString *)url;
-+ (NSURL *)eventDetailURLForFileAccessEvent:(SNTFileAccessEvent *)event customURL:(NSString *)url;
++ (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event;
 
 ///
 ///  Strip HTML from a string, replacing <br /> with newline.

Source/common/SNTBlockMessage.m

@@ -12,66 +12,26 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-#import "Source/common/SNTBlockMessage.h"
+#import "SNTBlockMessage.h"
 
-#import "Source/common/SNTConfigurator.h"
-#import "Source/common/SNTFileAccessEvent.h"
-#import "Source/common/SNTLogging.h"
-#import "Source/common/SNTStoredEvent.h"
-#import "Source/common/SNTSystemInfo.h"
-
-static id ValueOrNull(id value) {
-  return value ?: [NSNull null];
-}
+#import "SNTConfigurator.h"
+#import "SNTLogging.h"
+#import "SNTStoredEvent.h"
 
 @implementation SNTBlockMessage
 
-+ (NSAttributedString *)formatMessage:(NSString *)message {
-  NSString *htmlHeader =
-    @"<html><head><style>"
-    @"body {"
-    @"  font-family: 'Lucida Grande', 'Helvetica', sans-serif;"
-    @"  font-size: 13px;"
-    @"  color: %@;"
-    @"  text-align: center;"
-    @"}"
-
-    // Supported in beta WebKit. Not sure if it is dynamic when used with NSAttributedString.
-    @"@media (prefers-color-scheme: dark) {"
-    @"  body {"
-    @"    color: #ddd;"
-    @"  }"
-    @"}"
-    @"</style></head><body>";
-
-  // Support Dark Mode. Note, the returned NSAttributedString is static and does not update when
-  // the OS switches modes.
-  NSString *mode = [NSUserDefaults.standardUserDefaults stringForKey:@"AppleInterfaceStyle"];
-  BOOL dark = [mode isEqualToString:@"Dark"];
-  htmlHeader = [NSString stringWithFormat:htmlHeader, dark ? @"#ddd" : @"#333"];
-
-  NSString *htmlFooter = @"</body></html>";
-
-  NSString *fullHTML = [NSString stringWithFormat:@"%@%@%@", htmlHeader, message, htmlFooter];
-
-#ifdef SANTAGUI
-  NSData *htmlData = [fullHTML dataUsingEncoding:NSUTF8StringEncoding];
-  NSDictionary *options = @{
-    NSDocumentTypeDocumentAttribute : NSHTMLTextDocumentType,
-    NSCharacterEncodingDocumentAttribute : @(NSUTF8StringEncoding),
-  };
-  return [[NSAttributedString alloc] initWithHTML:htmlData options:options documentAttributes:NULL];
-#else
-  NSString *strippedHTML = [self stringFromHTML:fullHTML];
-  if (!strippedHTML) {
-    return [[NSAttributedString alloc] initWithString:@"This binary has been blocked."];
-  }
-  return [[NSAttributedString alloc] initWithString:strippedHTML];
-#endif
-}
-
 + (NSAttributedString *)attributedBlockMessageForEvent:(SNTStoredEvent *)event
                                          customMessage:(NSString *)customMessage {
+  NSString *htmlHeader = @"<html><head><style>"
+      @"body {"
+      @"  font-family: 'Lucida Grande', 'Helvetica', sans-serif;"
+      @"  font-size: 13px;"
+      @"  color: #666;"
+      @"  text-align: center;"
+      @"}"
+      @"</style></head><body>";
+  NSString *htmlFooter = @"</body></html>";
+
   NSString *message;
   if (customMessage.length) {
     message = customMessage;
@@ -88,19 +48,19 @@ static id ValueOrNull(id value) {
                 @"because it has been deemed malicious.";
     }
   }
-  return [SNTBlockMessage formatMessage:message];
-}
 
-+ (NSAttributedString *)attributedBlockMessageForFileAccessEvent:(SNTFileAccessEvent *)event
-                                                   customMessage:(NSString *)customMessage {
-  NSString *message = customMessage;
-  if (!message.length) {
-    message = [[SNTConfigurator configurator] fileAccessBlockMessage];
-    if (!message.length) {
-      message = @"Access to a file has been denied.";
-    }
+  NSString *fullHTML = [NSString stringWithFormat:@"%@%@%@", htmlHeader, message, htmlFooter];
+
+#ifdef NSAppKitVersionNumber10_0
+  NSData *htmlData = [fullHTML dataUsingEncoding:NSUTF8StringEncoding];
+  return [[NSAttributedString alloc] initWithHTML:htmlData documentAttributes:NULL];
+#else
+  NSString *strippedHTML = [self stringFromHTML:fullHTML];
+  if (!strippedHTML) {
+    return [[NSAttributedString alloc] initWithString:@"This binary has been blocked."];
   }
-  return [SNTBlockMessage formatMessage:message];
+  return [[NSAttributedString alloc] initWithString:strippedHTML];
+#endif
 }
 
 + (NSString *)stringFromHTML:(NSString *)html {
@@ -115,14 +75,13 @@ static id ValueOrNull(id value) {
 
   // Strip any HTML tags out of the message. Also remove any content inside <style> tags and
   // replace <br> elements with a newline.
-  NSString *stripXslt =
-    @"<?xml version='1.0' encoding='utf-8'?>"
-    @"<xsl:stylesheet version='1.0' xmlns:xsl='http://www.w3.org/1999/XSL/Transform'"
-    @"                              xmlns:xhtml='http://www.w3.org/1999/xhtml'>"
-    @"<xsl:output method='text'/>"
-    @"<xsl:template match='br'><xsl:text>\n</xsl:text></xsl:template>"
-    @"<xsl:template match='style'/>"
-    @"</xsl:stylesheet>";
+  NSString *stripXslt = @"<?xml version='1.0' encoding='utf-8'?>"
+      @"<xsl:stylesheet version='1.0' xmlns:xsl='http://www.w3.org/1999/XSL/Transform'"
+      @"                              xmlns:xhtml='http://www.w3.org/1999/xhtml'>"
+      @"<xsl:output method='text'/>"
+      @"<xsl:template match='br'><xsl:text>\n</xsl:text></xsl:template>"
+      @"<xsl:template match='style'/>"
+      @"</xsl:stylesheet>";
   NSData *data = [xml objectByApplyingXSLTString:stripXslt arguments:NULL error:&error];
   if (error || ![data isKindOfClass:[NSData class]]) {
     return html;
@@ -130,113 +89,39 @@ static id ValueOrNull(id value) {
   return [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
 }
 
-+ (NSString *)replaceFormatString:(NSString *)str
-                         withDict:(NSDictionary<NSString *, NSString *> *)replacements {
-  __block NSString *formatStr = str;
-
-  [replacements enumerateKeysAndObjectsUsingBlock:^(NSString *key, NSString *value, BOOL *stop) {
-    if ((id)value != [NSNull null]) {
-      formatStr = [formatStr stringByReplacingOccurrencesOfString:key withString:value];
-    }
-  }];
-
-  return formatStr;
-}
-
-//
-//   The following "format strings" will be replaced in the URL provided by
-//   `+eventDetailURLForEvent:customURL:templateMapping:`.
-//
-//   %file_identifier%           - The SHA-256 of the binary being executed.
-//   %bundle_or_file_identifier% - The hash of the bundle containing this file or the file itself,
-//                                 if no bundle hash is present.
-//   %file_bundle_id%            - The bundle id of the binary, if any.
-//   %team_id%                   - The Team ID if present in the signature information.
-//   %signing_id%                - The Signing ID if present in the signature information.
-//   %cdhash%                    - If signed, the CDHash.
-//   %username%                  - The executing user's name.
-//   %machine_id%                - The configured machine ID for this host.
-//   %hostname%                  - The machine's FQDN.
-//   %uuid%                      - The machine's UUID.
-//   %serial%                    - The machine's serial number.
-//
-+ (NSDictionary *)eventDetailTemplateMappingForEvent:(SNTStoredEvent *)event {
-  SNTConfigurator *config = [SNTConfigurator configurator];
-  return @{
-    @"%file_sha%" : ValueOrNull(event.fileSHA256 ? event.fileBundleHash ?: event.fileSHA256 : nil),
-    @"%file_identifier%" : ValueOrNull(event.fileSHA256),
-    @"%bundle_or_file_identifier%" :
-      ValueOrNull(event.fileSHA256 ? event.fileBundleHash ?: event.fileSHA256 : nil),
-    @"%username%" : ValueOrNull(event.executingUser),
-    @"%file_bundle_id%" : ValueOrNull(event.fileBundleID),
-    @"%team_id%" : ValueOrNull(event.teamID),
-    @"%signing_id%" : ValueOrNull(event.signingID),
-    @"%cdhash%" : ValueOrNull(event.cdhash),
-    @"%machine_id%" : ValueOrNull(config.machineID),
-    @"%hostname%" : ValueOrNull([SNTSystemInfo longHostname]),
-    @"%uuid%" : ValueOrNull([SNTSystemInfo hardwareUUID]),
-    @"%serial%" : ValueOrNull([SNTSystemInfo serialNumber]),
-  };
-}
-
-//
-//   Everything from `+eventDetailTemplateMappingForEvent:` with the following file access
-//   specific templates.
-//
-//   %rule_version%    - The version of the rule that was violated.
-//   %rule_name%       - The name of the rule that was violated.
-//   %accessed_path%   - The path accessed by the binary.
-//
-+ (NSDictionary *)fileAccessEventDetailTemplateMappingForEvent:(SNTFileAccessEvent *)event {
-  NSMutableDictionary *d = [self eventDetailTemplateMappingForEvent:event].mutableCopy;
-  [d addEntriesFromDictionary:@{
-    @"%rule_version%" : ValueOrNull(event.ruleVersion),
-    @"%rule_name%" : ValueOrNull(event.ruleName),
-    @"%accessed_path%" : ValueOrNull(event.accessedPath),
-  }];
-  return d;
-}
-
-// Returns either the generated URL for the passed in event, or an NSURL from the passed in custom
-// URL string. If the custom URL string is the string "null", nil will be returned. If no custom
-// URL is passed and there is no configured EventDetailURL template, nil will be returned.
-// The "format strings" in `templateMapping` will be replaced in the URL, if they are present.
-+ (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event
-                        customURL:(NSString *)url
-                  templateMapping:(NSDictionary *)templateMapping {
++ (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event {
   SNTConfigurator *config = [SNTConfigurator configurator];
 
-  NSString *formatStr = url;
-  if (!formatStr.length) {
+  NSString *formatStr, *versionStr;
+  if (config.eventDetailBundleURL.length && event.fileBundleID) {
+    formatStr = config.eventDetailBundleURL;
+    versionStr = event.fileBundleVersion;
+    if (!versionStr) versionStr = event.fileBundleVersionString;
+
+    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%bundle_id%"
+                                                     withString:event.fileBundleID];
+    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%bundle_ver%"
+                                                     withString:versionStr];
+  } else {
     formatStr = config.eventDetailURL;
-    if (!formatStr.length) {
-      return nil;
-    }
   }
 
-  if ([formatStr isEqualToString:@"null"]) {
-    return nil;
+  if (!formatStr.length) return nil;
+
+  if (event.fileSHA256) {
+    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%file_sha%"
+                                                     withString:event.fileSHA256];
+  }
+  if (event.executingUser) {
+    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%username%"
+                                                     withString:event.executingUser];
+  }
+  if (config.machineID) {
+    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%machine_id%"
+                                                     withString:config.machineID];
   }
 
-  formatStr = [SNTBlockMessage replaceFormatString:formatStr withDict:templateMapping];
-  NSURL *u = [NSURL URLWithString:formatStr];
-  if (!u) {
-    LOGW(@"Unable to generate event detail URL for string '%@'", formatStr);
-  }
-
-  return u;
-}
-
-+ (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event customURL:(NSString *)url {
-  return [self eventDetailURLForEvent:event
-                            customURL:url
-                      templateMapping:[self eventDetailTemplateMappingForEvent:event]];
-}
-
-+ (NSURL *)eventDetailURLForFileAccessEvent:(SNTFileAccessEvent *)event customURL:(NSString *)url {
-  return [self eventDetailURLForEvent:event
-                            customURL:url
-                      templateMapping:[self fileAccessEventDetailTemplateMappingForEvent:event]];
+  return [NSURL URLWithString:formatStr];
 }
 
 @end

Source/common/SNTBlockMessageTest.m

@@ -1,129 +0,0 @@
-/// Copyright 2023 Google LLC
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///     https://www.apache.org/licenses/LICENSE-2.0
-///
-/// Unless required by applicable law or agreed to in writing, software
-/// distributed under the License is distributed on an "AS IS" BASIS,
-/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-/// See the License for the specific language governing permissions and
-/// limitations under the License.
-
-#import <OCMock/OCMock.h>
-#import <XCTest/XCTest.h>
-
-#import "Source/common/SNTBlockMessage.h"
-#import "Source/common/SNTConfigurator.h"
-#include "Source/common/SNTFileAccessEvent.h"
-#include "Source/common/SNTStoredEvent.h"
-#import "Source/common/SNTSystemInfo.h"
-
-@interface SNTBlockMessageTest : XCTestCase
-@property id mockConfigurator;
-@property id mockSystemInfo;
-@end
-
-@implementation SNTBlockMessageTest
-
-- (void)setUp {
-  self.mockConfigurator = OCMClassMock([SNTConfigurator class]);
-  OCMStub([self.mockConfigurator configurator]).andReturn(self.mockConfigurator);
-  OCMStub([self.mockConfigurator machineID]).andReturn(@"my_mid");
-
-  self.mockSystemInfo = OCMClassMock([SNTSystemInfo class]);
-  OCMStub([self.mockSystemInfo longHostname]).andReturn(@"my_hn");
-  OCMStub([self.mockSystemInfo hardwareUUID]).andReturn(@"my_u");
-  OCMStub([self.mockSystemInfo serialNumber]).andReturn(@"my_s");
-}
-
-- (void)testFormatMessage {
-  NSString *input = @"Testing with somé Ünicode çharacters";
-  NSAttributedString *got = [SNTBlockMessage formatMessage:input];
-  XCTAssertEqualObjects([got string], input);
-}
-
-- (void)testEventDetailURLForEvent {
-  SNTStoredEvent *se = [[SNTStoredEvent alloc] init];
-
-  se.fileSHA256 = @"my_fi";
-  se.executingUser = @"my_un";
-  se.fileBundleID = @"s.n.t";
-  se.cdhash = @"abc";
-  se.teamID = @"SNT";
-  se.signingID = @"SNT:s.n.t";
-
-  NSString *url = @"http://"
-                  @"localhost?fs=%file_sha%&fi=%file_identifier%&bfi=%bundle_or_file_identifier%&"
-                  @"fbid=%file_bundle_id%&ti=%team_id%&si=%signing_id%&ch=%cdhash%&"
-                  @"un=%username%&mid=%machine_id%&hn=%hostname%&u=%uuid%&s=%serial%";
-  NSString *wantUrl = @"http://"
-                      @"localhost?fs=my_fi&fi=my_fi&bfi=my_fi&"
-                      @"fbid=s.n.t&ti=SNT&si=SNT:s.n.t&ch=abc&"
-                      @"un=my_un&mid=my_mid&hn=my_hn&u=my_u&s=my_s";
-
-  NSURL *gotUrl = [SNTBlockMessage eventDetailURLForEvent:se customURL:url];
-
-  // Set fileBundleHash and test again for newly expected values
-  se.fileBundleHash = @"my_fbh";
-
-  wantUrl = @"http://"
-            @"localhost?fs=my_fbh&fi=my_fi&bfi=my_fbh&"
-            @"fbid=s.n.t&ti=SNT&si=SNT:s.n.t&ch=abc&"
-            @"un=my_un&mid=my_mid&hn=my_hn&u=my_u&s=my_s";
-
-  gotUrl = [SNTBlockMessage eventDetailURLForEvent:se customURL:url];
-
-  XCTAssertEqualObjects(gotUrl.absoluteString, wantUrl);
-
-  XCTAssertNil([SNTBlockMessage eventDetailURLForEvent:se customURL:nil]);
-  XCTAssertNil([SNTBlockMessage eventDetailURLForEvent:se customURL:@"null"]);
-}
-
-- (void)testEventDetailURLForFileAccessEvent {
-  SNTFileAccessEvent *fae = [[SNTFileAccessEvent alloc] init];
-
-  fae.ruleVersion = @"my_rv";
-  fae.ruleName = @"my_rn";
-  fae.fileSHA256 = @"my_fi";
-  fae.fileBundleID = @"s.n.t";
-  fae.cdhash = @"abc";
-  fae.teamID = @"SNT";
-  fae.signingID = @"SNT:s.n.t";
-  fae.accessedPath = @"my_ap";
-  fae.executingUser = @"my_un";
-
-  NSString *url =
-    @"http://"
-    @"localhost?rv=%rule_version%&rn=%rule_name%&fi=%file_identifier%&"
-    @"fbid=%file_bundle_id%&ti=%team_id%&si=%signing_id%&ch=%cdhash%&"
-    @"ap=%accessed_path%&un=%username%&mid=%machine_id%&hn=%hostname%&u=%uuid%&s=%serial%";
-  NSString *wantUrl = @"http://"
-                      @"localhost?rv=my_rv&rn=my_rn&fi=my_fi&"
-                      @"fbid=s.n.t&ti=SNT&si=SNT:s.n.t&ch=abc&"
-                      @"ap=my_ap&un=my_un&mid=my_mid&hn=my_hn&u=my_u&s=my_s";
-
-  NSURL *gotUrl = [SNTBlockMessage eventDetailURLForFileAccessEvent:fae customURL:url];
-
-  XCTAssertEqualObjects(gotUrl.absoluteString, wantUrl);
-
-  XCTAssertNil([SNTBlockMessage eventDetailURLForFileAccessEvent:fae customURL:nil]);
-  XCTAssertNil([SNTBlockMessage eventDetailURLForFileAccessEvent:fae customURL:@"null"]);
-}
-
-- (void)testEventDetailURLMissingDetails {
-  SNTStoredEvent *se = [[SNTStoredEvent alloc] init];
-
-  se.fileSHA256 = @"my_fi";
-
-  NSString *url = @"http://localhost?fi=%file_identifier%";
-  NSString *wantUrl = @"http://localhost?fi=my_fi";
-
-  NSURL *gotUrl = [SNTBlockMessage eventDetailURLForEvent:se customURL:url];
-
-  XCTAssertEqualObjects(gotUrl.absoluteString, wantUrl);
-}
-
-@end

Source/common/SNTCachedDecision.h

@@ -1,53 +0,0 @@
-/// Copyright 2015-2022 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#import <EndpointSecurity/EndpointSecurity.h>
-#import <Foundation/Foundation.h>
-
-#import "Source/common/SNTCommonEnums.h"
-#import "Source/common/SantaVnode.h"
-
-@class MOLCertificate;
-
-///
-///  Store information about executions from decision making for later logging.
-///
-@interface SNTCachedDecision : NSObject
-
-- (instancetype)init;
-- (instancetype)initWithEndpointSecurityFile:(const es_file_t *)esFile;
-- (instancetype)initWithVnode:(SantaVnode)vnode NS_DESIGNATED_INITIALIZER;
-
-@property SantaVnode vnodeId;
-@property SNTEventState decision;
-@property SNTClientMode decisionClientMode;
-@property NSString *decisionExtra;
-@property NSString *sha256;
-
-@property NSString *certSHA256;
-@property NSString *certCommonName;
-@property NSArray<MOLCertificate *> *certChain;
-@property NSString *teamID;
-@property NSString *signingID;
-@property NSString *cdhash;
-@property NSDictionary *entitlements;
-@property BOOL entitlementsFiltered;
-
-@property NSString *quarantineURL;
-
-@property NSString *customMsg;
-@property NSString *customURL;
-@property BOOL silentBlock;
-
-@end

Source/common/SNTCachedDecision.mm

@@ -1,36 +0,0 @@
-
-/// Copyright 2015-2022 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#import "Source/common/SNTCachedDecision.h"
-
-@implementation SNTCachedDecision
-
-- (instancetype)init {
-  return [self initWithVnode:(SantaVnode){}];
-}
-
-- (instancetype)initWithEndpointSecurityFile:(const es_file_t *)esFile {
-  return [self initWithVnode:SantaVnode::VnodeForFile(esFile)];
-}
-
-- (instancetype)initWithVnode:(SantaVnode)vnode {
-  self = [super init];
-  if (self) {
-    _vnodeId = vnode;
-  }
-  return self;
-}
-
-@end