Heads up it looks we’re waiting a little longer for 4.4.0 due to wanting for https://github.com/osquery/osquery/pull/6280 to be solid. I fully support taking our time on that.

Hi, I was wondering if this blueprint issue could get some feedback. Thanks! #6484

looking for a huge favor, can someone patch and try out https://github.com/osquery/osquery/pull/6506 on an ec2 instances with

--proxy_hostname=fake

Hey @theopolis do you control the

osquery

Docker Hub organization, or know who does?

I think it’s probably time to cut 4.4.0! Any objections? Anyone want the honors?

More commits snuck in! I’ve updated the changelog at https://github.com/osquery/osquery/pull/6523/ Any thumbs around and then I’ll tag 4.4.0 (I’m happy to tag without any changelog updates. Or with changelog updates. But partial updates feel icky)

Hey Fam. I'm either not a smart person (Like @theopolis ;)), or skipping steps, as here are the signed packages for osquery 4.4.0 on windows! Lemme know how they work or if there are any issues. Cheers. Additionally, I took this opportunity to whip up a Git Gist about how I build these packages in a signed fashion, feel free to take a peruse! https://gist.github.com/muffins/7925e8bf8aed3230e82eb0f67f379389

Oh. I think this is a typing error. <back to hacking>

github actions does have the concept of a self hosted runner. Not sure if that’s the same or not

Yes definitely! In fact this wasn't me trying to steer you off GA, I was mainly thinking of the features the CI itself was giving and if there's anything specific we have to emulate or find a substitute for 🙂

TBH the problem I’m solving is that working in azure makes me cry. I find it intensely unpleasant to figure out how to do anything. I can’t even tell how billing works. So creating a osquery release pipeline there fills me with dread.

I'm having some issues building on aarch64. Anyone get this to build right? When trying to build I'm getting

[  7%] Building C object libs/src/boost/CMakeFiles/thirdparty_boost_context.dir/src/libs/context/src/asm/jump_arm64_aapcs_elf_gas.S.o
/home/ec2-user/osquery/libraries/cmake/source/boost/src/libs/context/src/asm/jump_arm64_aapcs_elf_gas.S:54:1: error: expected identifier or '('
.file "jump_arm64_aapcs_elf_gas.S"
^
/home/ec2-user/osquery/libraries/cmake/source/boost/src/libs/context/src/asm/jump_arm64_aapcs_elf_gas.S:60:7: error: invalid preprocessing directive
    # prepare stack for GP + FPU
      ^
/home/ec2-user/osquery/libraries/cmake/source/boost/src/libs/context/src/asm/jump_arm64_aapcs_elf_gas.S:63:7: error: invalid preprocessing directive
    # save d8 - d15
      ^

I’m on a mission to resolve all PRs older than 1yr.

Hey gang, apologies for being absent, we're in the thralls of planning season and so I missed the last OH unfortunately, do we still need a 4.4.0 release for windows? I got pinged about it on Chocolatey and can get it built and shipped today

turtles all the way down

I’m building my PR for copyright changes. using

make -j7

and I’m encountering a handful of build errors. Re-building fixes them, and I think these are probably fallout from the include reorg. In thread

Hi All, Can I make a specific decorator query be platform-specific? I want to provide the same decorator, but have it supplied through a different query for windoze as opposed to linux / mac

Hey just noticed

socket_events

table seems to be missing on macOS on the released version of

4.4.0

but present on

4.3.0

I am not sure if this is build related

I want to try out the change log generation script this time :D

If someone has time to take another look at the changelog I’d appreciate it. I’d love to go through the manual tag motions on the weekend while I have some time.

Here are the 4.5.0 packages. I will try to upload them to S3 later today. My next step is to create the website PR when I have a few minutes.

Awesome, I’ll upload these to S3 soon.

this is for later on, but I'm curious why the

osqueryd

service looks different than the rest, is there metadata we can fill in to make this look nicer?

I've noticed release build issues have popped up a few times. Is there any reason we don't just have the CI build it upon pushing a

vX.Y.Z

tag?

I created #apple-silicon as somewhere for chatter about that project. And as an FYI the darwin x86 osquery (and launcher) do run on the apple silicon dev kit.

This is related to https://github.com/osquery/osquery/pull/6663 . Would people be against always requiring explicit configuration to enable publishers/subscribers? We had some tables in the past that would auto-activate in one way or the other, causing confusion and sometimes even performance issues (events being gathered by mistake on high load systems with no queries running against those tables, causing new events to be written while mass expiration was occurring)

We desperately need a documentation engineer to go through our read the docs.

I’m hoping some other people did some testing

Changelog up as a draft in https://github.com/osquery/osquery/pull/6692 Feel free to comment, suggest edits or catagory changes. It’s a draft since we might merge more

Is anyone interested in volunteering to submit osquery to Windows' winget? https://github.com/osquery/osquery/issues/6691