Daniel Cross
03/16/2023, 5:17 AMrpm --verify
type of capability with OSQuery? I think not but maybe I’m missing a way to do this. Could be a good first contribution task for me 🤔
http://ftp.rpm.org/max-rpm/ch-rpm-verify.htmlseph
03/18/2023, 2:44 AMrpm_package_files
and a rpm_packages
table.
I suspect one could construct SQL to use the sha from rpm_package_files
, the file table, and the hash
table to create that functionality. I have no idea how performant it would be.
As a side note, osquery does not shell out to collect information.Daniel Cross
03/20/2023, 4:34 AM