Ah! NEFilterDataProvider! As I said, I figured out that it's the level 2 ethernet, not level 1. I get tunnel vision sometimes.

Ah. If it's just struct ether_header {         u_char  ether_dhost[ETHER_ADDR_LEN];         u_char  ether_shost[ETHER_ADDR_LEN];         u_short ether_type; } __packed; then it makes sense.

I meant "copying the signing command." :)

Also, is there a better way of getting the line number from the address than using lldb or objdump to disassemble with lines? ;) It's hit and miss, unfortunately.

I tried thread sanitizer, unfortunately it fails too much on the 3rd party C++ code the project uses. The Swift method in question here has a closer which itself has a closure.

Oh, and the textified version. next-crash.txt

Here's the raw-ish IPS. I'm sure concurrency is the problem. next.ips

None of the arguments is ever modified by something else; the most that happens is that references are added and removed. sigh.

Now, this still leaves me wondering how to combine them into a single bundle. I mean, I know how to script the part where I lipo the various parts together, but I'm not sure how to get the proper signing done, other than copying the output of xcodebuild. We can have separate distributions for now (until and unless Apple lets me use the Endpoint Security Framework for real, we can't be feature-complete, or at least feature-parity with Windows, anyway).

Over, on twitter, Alexander Neumann (@Iluinrandir) gave me the solution. I used env PATH=${HOME}/vcpkg-arm64:${PATH} cmake -G Xcode .. -DVCPKG_HOST_TRIPLET=x64-osx -DVCPKG_TARGET_TRIPLET=arm64-osx -DCMAKE_TOOLCHAIN_FILE=${HOME}/vcpkg/scripts/buildsystems/vcpkg.cmake -DCMAKE_OSX_ARCHITECTURES=arm64 -DMACOS_BUILD_RELEASE=ON to create the xcodeproj, and then time cmake --build . --config Release -- -allowProvisioningUpdates to build. And... I ended up with arm64 executables that work on my M1 MBP. I'm not sure if the -DCMAKE_OSX_ARCHITECTURES=arm64 is necessary or not.

Cmake, not make. And vcpkg. Alas. I am very familiar with using Apple‘s tool, including Xcode and make, to build universal binaries of all sorts. I have been for a while. It’s this third-party stuff I need help with.

Sigh and alas.

FB10025641. Also, I see some suggestions about WKProcessPool -- does that end up being my process, or is it another launchd-created one?

There isn’t a general-purpose responsible process API. If you search DevForums, you’ll find numerous places where I’ve talked about this notion before. Is "responsible process API" a good thing to search for? (I'm not a good searcher.) your product includes an ES client It should, but we still have not gotten it, thus my asking a month or two ago if anyone had gotten it. Nobody responded either way.

As usual, I probably WAY overthought it, and did:         dispatch_async(dispatch_get_main_queue(), ^{             NSRunLoop *myLoop = NSRunLoop.currentRunLoop;             OSStatus kr = SecKeychainAddCallback(MyKeychainEventCallback, kSecEveryEventMask, NULL);             while (1) {                 // Keep running, restarting every 10 minutes. We could make                 // this a lot longer, though.                 [myLoop runUntilDate:[NSDate dateWithTimeIntervalSinceNow:600]];             }         });