endpoint-sec-sys 0.1.0

Raw Rust wrappers around the Endpoint Security Framework
Documentation

Raw manual bindings for the Endpoint Security Framework for Apple targets (macOS) (referred to as ES in the following documentation).

Everything that was not present in the original release is feature gated to the macOS version that saw it released, so you can ensure you don't use any newer functions and types. Additional checks are done at runtime to return None or an Err when using something not yet available, in the [endpoint-sec][esc] crate. This crate does not perform the checks since it contains the raw types and extern "C" declaration. This is done because 1) the performance hit of a version check is negligible in my experience and 2) even if compiled for a newer version where information A is available, your program will still be able to handle older versions since A will be returned in an Option.

Debug implementations (and PartialEq, Eq, Hash)

Several types do not have a [Debug] implementation because it depends on the [es_message_t] version field. In this case, use the endpoint-sec crate, which bundle the version with the data (for example with [es_event_exec_t]), allowing to implement Debug, [PartialEq], [Eq] and [Hash] correctly.

For lots of other types, it's because the implementation would be useless because they contain pointers like [es_string_token_t]: implementing Debug for it in a useful way needs unsafe code that we don't want to hide in a Debug impl. See the [endpoint-sec][esc] crate, with its higher level types for useful Debug impls (and PartialEq, Eq, Hash).