v2024.6

⚠️ Warning ⚠️

Shortly after release we were notified that the serial_num field in Preflight sync requests is being sent as serial_number. If this causes issues for your sync service, you may want to hold off on upgrading to this release and wait for 2024.7, which will be released shortly.

Notes

Changed

↔️ Serializing/deserializing of all sync requests and responses is now handled by the protobuf library. If protobuf transfers aren't enabled, the buffers will be converted to/from JSON just-in-time. This should be a transparent change for sync servers. However, it's possible there could be issues with rarely used keys. Please open an issue if you notice any sync keys not working as expected.
↔️ macOS 11 is no longer supported.
↔️ A dock icon now displays for the blocked execution UI and the window is discoverable via Cmd+Tab.
↔️ A blocked execution dialog is now discoverable via Cmd+Tab and a Dock icon will display while the window is open.

Fixed

❗ Addressed issue where santactl fileinfo could fail to get rule status if too many files were evaluated simultaneously.

Added

➕ The Santa daemon now includes signal protection to prevent being killed, even by root users.
➕ You can now configure Santa to communicate with the sync server via binary protobufs.
➕ 10 new event types have been added to the telemetry stream: Loginwindow login/logout/lock/unlock, OpenSSH login/logout, Screensharing attach/detach, and login(1) login/logout
➕ The --filter-inclusive switch was added to santactl fileinfo to support combining multiple --filter predicates as an AND operation as opposed to the default OR operation.
➕ The MachineID configuration value has been added to the requests of all sync protocol stages.
➕ The "Dismiss" button text in the blocked event dialog is now configurable (previously labeled "Ignore")

What's Changed

• sync: Add a protobuf for the existing sync protocol by @russellhancox in #1359
• Update check-markdown workflow to use Lychee by @pmarkowsky in #1362
• docs: Document new EventDetailURL keys by @russellhancox in #1361
• santad: Add signal auth to tamper resistence. by @russellhancox in #1360
• sync: Add option to sync using binary protos by @russellhancox in #1364
• Modernize docs (Round 1) by @mlw in #1363
• Add a Signing ID Format Helper by @pmarkowsky in #1365
• docs(ISSUE-1325): Add Identifier Conventions by @toastsec in #1366
• Use new Apple docs link for global proxy settings constants by @mlw in #1367
• Fix santd title in docs by @bugos in #1368
• docs: Update references to SNTXPCConnection by @russellhancox in #1372
• santad: Fix metrics for AuthSignal events by @russellhancox in #1373
• Add tests to ensure EventTypeToString handles all subscriptions by @mlw in #1374
• Proto tests min version support by @mlw in #1376
• Drop macos 11 by @mlw in #1377
• Project: Update several bazel modules by @russellhancox in #1378
• Login/logout events by @mlw in #1371
• Add string serialization for new login/logout events by @mlw in #1379
• Add protobuf serialization for new login/logout events by @mlw in #1380
• Use class member access operator for underlying ES message by @mlw in #1381
• fileinfo: cap the number of concurrent operations by @tburgin in #1383
• Adopt namespace naming guidelines - part 1 by @mlw in #1384
• Namespace simplification pt2 by @mlw in #1385
• Namespace simplification pt3 by @mlw in #1386
• Namespace simplification pt4 (final) by @mlw in #1387
• fileinfo: add --filter-inclusive by @tburgin in #1388
• sync: Handle parse errors, make some preflight fields optional by @russellhancox in #1389
• sync: Parse response as proto when SyncEnableProtoTransfer enabled by @russellhancox in #1391
• Add machine_id to facilitate a GRPC version of the sync protocol by @pmarkowsky in #1390
• Handle non-200 HTTP responses in SNTSyncStage performRequest by @bugos in #1392
• common: Remove debug log when signing ID is missing. by @russellhancox in #1393
• Allow empty data for 200 responses by @mlw in #1394
• Improve handling of sync response default values by @mlw in #1395
• GUI: Update activation policy for binary blocks by @russellhancox in #1396
• Fix check for deprecated clean sync key by @mlw in #1397
• GUI: Make dismiss button configurable, change default text back to dismiss by @russellhancox in #1399
• Docs: Add DismissText key to configuration.md by @russellhancox in #1400
• sync: Handle missing error string for abnormal statuses by @russellhancox in #1402

New Contributors

• @toastsec made their first contribution in #1366
• @bugos made their first contribution in #1368

Full Changelog: 2024.5...2024.6