Add a require_developer_id to macos:gatekeeper_item/state

[solind]

Abstract
This security-relevant option for Gatekeeper is not currently accessible via OVAL. We should add an entity to capture the state of this field.

Link to Proposal
PR to come

Additional context
See attachment for sample content.

content.zip

[wmunyan]

Question: What drives the value of this element? Is there something in the output of one of the spctl command options that will reveal whether Developer ID is required?

If there are values in the unlabeled element(s) and enabled is true, am I correct that implies that require_developer_id would be false? However, if enabled is true, but there are no unlabeled applications, that doesnt definitively say that require_developer_id is either true or false. I may be missing something, or our implementation of this collection is wrong to begin with...

[solind]

Hi @wmunyan, the command spctl --status --verbose will tell you whether or not this is enabled. Basically, it is like a global setting that tells you whether Gatekeeper will deny execution of applications not signed with a valid Apple Developer ID. The unlabeled applications are exceptions that have been manually added by a user, and you can see what those are using sudo spctl --list | grep UNLABELED

[wmunyan]

AH! It was the --verbose I didn't see on the man page. Thank you!

No objections to this proposal.

[solind]

a5ae8d7