mandiant / mandiant/macos-UnifiedLogs
Sort order in `FileProvider`
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 376
- Forks
- 43
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 8
Description
Moving discussion here from the closed pull request #121
I did some looking into this as well and I think the issue is here:
https://github.com/mandiant/macos-UnifiedLogs/blob/27ff665128590827cc5e7d25b1e98f7b4dce0845/src/parser.rs#L193-L203
The first TimesyncBoot structure parsed is determined by the ordering of the timesync files, so they might have the same boot UUID but different boot_time values. So sorting is the correct fix, but do we want to reverse the sort order?
It currently does a lexicographical sort so 0000000000000040.timesync would be parsed first, followed by 0000000000000041.timesync (which is the newer of the two files). I think if we want the most up-to-date version, we should reverse that.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read src/parser.rs around lines 193-203 and trace how the timesync files are ordered before the first TimesyncBoot structure is parsed. Confirm which ordering selects the most up-to-date boot_time when files share a boot UUID, then verify the parser uses that ordering consistently.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- operating-systems, reverse-engineering
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100