Replace use of forked https://github.com/elastic/fsevents with upstream https://github.com/fsnotify/fsevents

[cmacknz]

It appears that the main changes from https://github.com/elastic/fsevents have been upstreamed to https://github.com/fsnotify/fsevents, and that https://github.com/elastic/fsevents is missing a fix for a deprecated MacOS function in newer commits from upstream.

Upstreamed

• fsnotify/fsevents@ed9a50f matches the fix in elastic/fsevents@92f4352
• fsnotify/fsevents@972ac2c matches the fix in fsnotify/fsevents@972ac2c

Missing from upstream

fsnotify/fsevents#38 was merged into https://github.com/elastic/fsevents but is unmerged upstream, see #47637 (comment).

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[cmacknz]

Removing https://github.com/elastic/fsnotify

I think we can probably get rid of the fsnotify fork too which just has elastic/fsnotify#2

Edit: we can't remove the fsnotify fork yet, the recursive watch functionality has pieces implemented but is disabled by default.

Upstreamed

• Add recursive watcher for Windows backend fsnotify/fsnotify#540 looks to match adriansr/fsnotify@c9bbe1f
• fsnotify/fsnotify@712fe1d looks to match adriansr/fsnotify@093a909

Missing from upstream

To remove this we need a replacement for this SetRecursive() call:

beats/auditbeat/module/file_integrity/monitor/monitor.go

Line 49 in bac5589

if recursive && watcher.SetRecursive() != nil {

It looks like upstream did their own version of recursive watch but has left it disabled with no exported way to turn it on, see https://github.com/fsnotify/fsnotify/blob/b87713c3e2b45bcb2799332d2ea04146ae3bcd1d/fsnotify.go#L475 (

[cmacknz]

These two replace directives in Elastic Agent can both be removed once this is fixed:

• https://github.com/elastic/elastic-agent/blob/372dc467f672b34eac8fb4ce001bf4fc69d21849/go.mod#L811-L812
• https://github.com/elastic/elastic-agent/blob/372dc467f672b34eac8fb4ce001bf4fc69d21849/internal/edot/go.mod#L720-L721

[cmacknz]

@kruskall has found there is an additional change in our fsevents fork missing from upstream:

our fork also contains fsnotify/fsevents#38 which has not been upstreamed/merged
upstream doesn't check es.Device > 0 before calling es.uuid = GetDeviceUUID(es.Device)

[elasticmachine]

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

[andrewkroh]

The upstream also hopefully fixes this warning we get in beats:

cgo-gcc-prolog:454:2: warning: 'FSEventStreamScheduleWithRunLoop' is deprecated: first deprecated in macOS 13.0 - Use FSEventStreamSetDispatchQueue instead. [-Wdeprecated-declarations]
/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/CoreServices.framework/Frameworks/FSEvents.framework/Headers/FSEvents.h:1159:1: note: 'FSEventStreamScheduleWithRunLoop' has been explicitly marked deprecated here

[pierrehilbert]

@cmacknz are you still working on that one?

[cmacknz]

No, removed myself as an assignee.