EndpointSecurity is not a framework

HarfangLab / endpoint-sec

Rust Bindings for Endpoint Security

https://docs.rs/endpoint-sec/

Apache License 2.0

21 stars 6 forks source link

EndpointSecurity is not a framework #35

Open jangoolie opened 8 months ago

jangoolie commented 8 months ago

Endpoint Security (abbreviated ES here) is a framework provided by Apple

Should read

Endpoint Security (abbreviated ES here) is a library provided by Apple

EndpointSecurity is distributed as a dylib and separate headers in the SDK. It is not a framework. It's linked via -lEndpointSecurity not -framework EndpointSecurity

poliorcetics commented 8 months ago

Never expected an issue about this to be honest 😄

Anyway, "Framework" is the first word used by Apple here: https://developer.apple.com/documentation/endpointsecurity

I think it's okay to call it a framework, but I don't have any strong opinions on this

jangoolie commented 8 months ago

That's a (very confusing) limitation of the doc website. All libraries are frameworks according to https://developer.apple.com.

The distinction is subtle but matters for a few reasons:

Headers are distributed separately for libraries so you need to make sure they are covered by the header search path.
libraries and frameworks use different clang flags
it's possible for both a library and a framework with exactly the same name to exist in the SDK

PaulDance commented 4 months ago

I think there are two sides to this:

At runtime, the client registers itself with the kernel's API in order for it to tap into the client for event responses: this inversion of control effectively constitutes a framework.
At compile-time, the developer uses a library in order to obtain the symbols necessary to call said API: mostly plumbing you could say.

I therefore feel like the quoted sentence is fine as-is, but a comment can indeed be added later on in the document to clarify what exactly the crate ships and links against.