Perfect! Exactly what we needed. I was searching through the telemetry as if it would be reported as /Downloads/$SOME_FILE but eslogger reports it as "destination type" and "file name". This is going to make life a bit harder with what we're trying to do, but thanks Quinn!
For those curious it looks something like this:
{
"event": {
"rename": {
"destination": {
"new_path": {
"dir": {
"path": "\/Users\/brandondalton\/Downloads"
},
"filename": "Visual Studio Code.app"
}
},
"source": {
"path": "\/private\/var\/folders\/8b\/fg_9sj9j2_9c0ghl_knlpp1c0000gp\/T\/com.apple.desktopservices.ArchiveService\/TemporaryItems\/NSIRD_ArchiveService_oK7iOq\/Visual Studio Code.app"
}
}
}
}
Post
Replies
Boosts
Views
Activity
Hey Quinn! That’s correct and the app does not opt into Apple’s sandbox model. Should they be using any special file write API to additionally support File Quarantine?