feat: support syspolicy_check a new feature in Sonoma to determine if the provided macOS application will pass the current running configurations’ system policy.

[sambacha]

Problem to solve

Sonoma introduces a new command line tool, from their release notes:

https://developer.apple.com/documentation/macos-release-notes/macos-14-release-notes#Trusted-Execution

/usr/bin/syspolicy:

check is a new command line tool to help determine if the provided macOS application will pass the current running configurations’ system policy.
This includes the same checks performed by the Apple notary service and other macOS Trusted Execution layers such as codesign, Gatekeeper, XProtect, and more. Please see the main page for additional details. (108737781)

[robertgendler]

This isn't an issue with the project. This seems more useful as a discussion. Moving to that

[robertgendler]

This new check with syspolicy is great from a security perspective but I'm not sure how it could fall into security compliance.

If you're able to give an example of how we'd want to form a rule file. that might be helpful.