# Santa macOS Trust Policy

> Deploy Santa trust rules for thoth and thothctl using published Team ID, signing metadata, and release checksums.

Source: https://docs.atensecurity.com/docs/deployments/santa-macos

Use this guide to enforce allow-by-trust policy for `thoth` and `thothctl` on macOS endpoints running Santa.

## Inputs from each release

Download these assets from `atensecurity/thoth` release `v<version>`:

- `santa-metadata.json`
- `signing-metadata.json`
- `checksums.sha256`
- binaries or PKG you deploy

Extract publisher metadata:

```bash
jq -r '.teamId' santa-metadata.json
jq -r '.applicationIdentity' santa-metadata.json
jq -r '.installerIdentity' santa-metadata.json
```

## Recommended Santa rule model

1. Allow by Team ID for signed Thoth binaries.
2. Add hash-based allow rules for explicit release pinning.
3. Keep rules versioned in your config repository and roll out via MDM.

## Team ID trust rules

```bash
TEAM_ID="$(jq -r '.teamId' santa-metadata.json)"
sudo santa-cli rule --add --teamid "$TEAM_ID" --policy ALLOWLIST
```

## Optional hash pinning rules

```bash
THOTH_SHA="$(awk '$2=="thoth-macos-universal" {print $1}' checksums.sha256)"
THOTHCTL_SHA="$(awk '$2=="thothctl-macos-universal" {print $1}' checksums.sha256)"

sudo santa-cli rule --add --sha256 "$THOTH_SHA" --policy ALLOWLIST
sudo santa-cli rule --add --sha256 "$THOTHCTL_SHA" --policy ALLOWLIST
```

## Verify endpoint signing identity

```bash
codesign -dv --verbose=4 /usr/local/bin/thoth 2>&1 | grep -E 'TeamIdentifier|Authority='
codesign -dv --verbose=4 /usr/local/bin/thothctl 2>&1 | grep -E 'TeamIdentifier|Authority='
```

Expected Team ID matches `santa-metadata.json`.

## Rollout pattern

1. Test group (1-5 endpoints)
2. Pilot group (5-15%)
3. Full fleet

For each stage, validate:

```bash
thoth --version
thothctl --version
thoth health --json
```

## Incident handling

- Revoke hash rules for a compromised release.
- Move Team ID rules to monitor mode during incident triage if required.
- Re-pin to new release hashes after remediation.

## Related docs

- [Release Channels + Verification](https://docs.atensecurity.com/docs/deployments/release-channels)
- [Jamf macOS Runbook](https://docs.atensecurity.com/docs/deployments/jamf-macos)
- [Kandji macOS Runbook](https://docs.atensecurity.com/docs/deployments/kandji-macos)
- [Deployment Validation Matrix](https://docs.atensecurity.com/docs/deployments/validation-matrix)