#1175 Santa: risk engine checks for unknown binaries Issue created by javuto Part of Santa/Workshop parity, building on the Santa sync server from #1142 (

pkg/santa

,

osctrl-tls

sync endpoint, Santa page in the UI). Problem Approvers have no reputation signal. Workshop checks hashes against VirusTotal, ReversingLabs and custom webhooks before allowing. Scope • Pluggable checks: VirusTotal, custom HTTP webhook (ReversingLabs if demand). • Cached verdicts with TTL, per-check timeouts, API keys stored as secrets (never returned by the API). • Verdicts shown in the approval queue and binary view; flagged binaries cannot be approved or voted in without an audited override. • Only hashes are sent to third parties. Acceptance • A flagged hash blocks self-service approval; outages fail closed for self-approval and are visible to approvers. • Depends on: #1169 jmpsec/osctrl