- Trivy: Official coverage tables list only Linux distributions (Alpine/Wolfi, Debian/Ubuntu, RHEL family, SUSE, Photon, Amazon, Bottlerocket). No analyzer exists for Homebrew, Mac App Store receipts, or
.app bundles. - Grype: Mirrors Syft catalogers that target Linux package managers; no matchers for Homebrew formulae, pkgutil receipts, or macOS frameworks.
- Snyk CLI: Container and open-source scans are routed through the SaaS backend; macOS host package analysis is not advertised or documented.
See also: ../../modules/scanner/design/macos-analyzer.md for the in-depth design brief.
- Homebrew cellar collector
- Parse
/usr/local/Cellar and /opt/homebrew/Cellar manifest files plus taps metadata to enumerate installed formulae/casks. - Normalize tap origin, version, revision, and bottle source; map to
pkg:brew/{tap}/{name}@{version} PURLs.
- System receipt inventory
- Use
pkgutil --pkgs --pkg-info-plist style parsing against /var/db/receipts/*.bom to capture Apple installer packages and third-party pkg receipts. - Record CFBundleIdentifier, install timestamps, and BOM file hashes to feed deterministic provenance.
- Application bundle inspection
- Scan
/Applications, /System/Applications, and /Users/*/Applications for .app bundles. - Extract Info.plist data (bundle id/version), embedded frameworks, entitlements, and code signing certificates.
- Policy alignment
- Emit capability hints (network, TCC categories) for Policy Engine gating.
- Provide allow lists for signed Apple system components versus third-party apps.
- Offline parity
- Mirror Homebrew tap metadata snapshots and entitlements schema inside Offline Kit.
- Package notarization certificate bundles and CRL/OCSP cache guidance for air-gapped verification.
| Technique | Artifacts | Merge strategy | Notes |
|---|
| Homebrew cellar parsing | Cellar manifests, INSTALL_RECEIPT.json, tap metadata | Produce per-formula component records keyed by tap + version; merge duplicates by canonical tap origin; attach bottle SHA256 for provenance. | Requires tap snapshot to ensure deterministic version resolution. |
| pkgutil receipt parsing | /var/db/receipts/*.plist + .bom files | Build component entries for Apple/third-party installer packages; merge with bundle evidence when matching CFBundleIdentifier. | Provides authoritative install-time metadata including install source. |
.app bundle inspection | Info.plist, CodeResources, entitlements, embedded frameworks | Emit capability records (e.g., tcc.camera, network.client); merge with receipts when bundle id matches. | Must preserve signing chain and team identifier; store hash of CodeDirectory. |
| Launch daemon/service mapping | /Library/LaunchDaemons, /Library/LaunchAgents, launchctl print exports | (Planned) Attach runtime usage hints for Policy Engine and EntryTrace cross-module alignment. | Helps differentiate dormant apps from active services. |
| Competitor baseline | — | No competitor evidence to merge; Trivy/Grype/Snyk lack macOS analyzers. | Presents differentiation opportunity once demand justifies investment. |
- Keep demand capture in
docs/benchmarks/scanner/windows-macos-demand.md up to date; once thresholds are met, open:SCANNER-ENG-00xx (macOS cellar/receipt analyzer design spike).DOCS-SCANNER-BENCH-62-002 (this doc’s parent task) — exit criteria: demand summary + design scope recommendation.- Policy task to define macOS capability predicates (entitlements, notarization state).
- Align with Offline Kit guild on notarization/CRL packaging and tap mirroring strategy.
| Topic | Question | Owner |
|---|
| Notarization verification | Should scanner verify Apple notarization tickets or delegate to Policy Engine? | Security Guild |
| Entitlement taxonomy | How granular should capability predicates be (per entitlement vs grouped categories)? | Policy Guild |
| User-space scope | Do we scan per-user Homebrew installs and sandboxed app containers? | Scanner Guild |
| Performance | Do we cache receipts/bundle metadata between scans given large .app trees? | Scanner + Surface Guilds |
