What kext was that??

MacOS sometimes asks you to accept some system extension / kext. Unfortunately it can be difficult to clarify why, which can be scary. Sometimes you will only get notified that the kext signed by XYZ has been updated, and then it's on you to find out how to relate XYZ to a specific file and functionality in your system.

I have found myself in the situation a couple of times, so in case it helps others, here's my notes to connect signers with kexts. BEWARE, just because something is in my list doesn't mean that it's OK in your system; instead, I recommend that (1) you re-confirm my information and then (2) decide if this kext makes sense in your system. If you don't know why you have some kext, maybe you should just remove it.

To find your own installed kexts and other persistent items, KnockKnock is great, and probably will be enough; but unfortunately it doesn't allow you to search, which is what we need. The workaround is: open it, click on "Start Scan", and when it finishes click the Save button. The result is a JSON file that you can search for the name of your mysterious signer, and around it you'll find the name of the kext.

Fun fact: I tried asking various LLMs (Gemini, Claude, ChatGPT, LeChat) to identify a kext by the signer's name. The results came out empty at best; at worst they hallucinated connections to other companies.

On to my list of kexts:

• Kirill Luzanov is the signer for SATSMARTDriver.kext, which can be downloaded from BinaryFruit, the makers of the DriveDX software. The driver enables macOS to read SMART diagnostic info from external USB drives. 
• Confusingly, the download page links to the driver's original GitHub repo, which as of this writing has been untouched for 8 years. They must have their own unpublished fork, and I couldn't find any connection between Luzanov and BinaryFruit. There's a GitHub profile for someone with that name but seems pretty dead.
  

[to be continued]