Micah and I have been working through a bug he found in

master

. https://github.com/osquery/osquery/pull/8037 introduced an issue. I was hoping we’d have a fix up today, but I think not. Worst case, I’ll back that PR out

What would be the issue?

On some volumes the underlying info needs to be inherited from the parent. This isn’t happening in with that PR applied, so you get partial info

But is it

block_devices

fault or? I don't know if I can help in some way.

Micah has a better understand than I do, but I wrote it up in https://github.com/kolide/k2/issues/8862

I don't think that repo is publicly accessible ^^'

hahahahaha. I meant to file that in osquery facepalm

it happens; sometimes the Github UI betrays me (especially when trying to open a PR from my fork of osquery vs tob)

I think we might have some routes to fixing 8037, but I’m not convinced we can do it as quickly as we want a release. So I’m thinking we revert 8037, and we can update disk_encryption to work, but be somewhat less performant. (which is better than today at least)

Makes sense. Perfomance wise, testing wise (and in general) I would also suggest in the future to bring out the logic of the block_devices table to functions that can be reused in other tables vs using the SQL interface

Agreed. I think that’s going to need to happen to succeed with a next version of #8037. But, not feasible for 5.10

yeah totally

<sigh> I don’t understand why clang format doesn’t like the revert PR. But I’ll go fix that

I think the code was not formatted originally

Oh that makes sense.

image.png

I noticed that too!

mmm https://www.githubstatus.com/

Looks like https://github.com/osquery/osquery/pull/8151 has caught up.

ok I see we merged that; so is https://github.com/osquery/osquery/pull/8052 still slated for 5.10? Does it need further work? Basically, what's missing.

Micah is updating it. I’m hoping we merge today