So this one really caught me off guard: yara in th...
# macosk
kyle
03/15/2024, 6:14 AMSo this one really caught me off guard: yara in the release package doesn't appear to be building with the hash module in macOS releases. I'm a cmake newb, and I can't tell if the authors of the osquery yara cmakelist intended to build without the hash module or if there was an oversight. Macho module on the other hand works fine
e
Evan Romasco-Kelly
03/15/2024, 9:11 PMSorry - not a .pkg/cmake-knowledgeable user here. Was this in reference to my issue above?
k
kyle
03/15/2024, 9:37 PMNo, sorry
👍 1
s
Stefano Bonicatti
03/18/2024, 6:27 PMHi @kyle, that definitely is not wanted. Could you open an issue with the steps to reproduce?
The CMakeLists.txt here: https://github.com/osquery/osquery/blob/master/libraries/cmake/source/yara/CMakeLists.txt
contains the source code for the hash module and relative defines for all platforms, so that should go through
k
kyle
03/21/2024, 10:11 PMkyle
03/21/2024, 10:14 PMI thought it affected more but seems like it's just hash, dex, console, and dotnet
kyle
03/21/2024, 10:14 PMConsole probably isn't an issue since it would likely need some custom support but the other ones I assume are intended to work
kyle
03/21/2024, 10:16 PMcould this be an OpenSSL (version?) problem at build time?
kyle
03/21/2024, 10:20 PM(Oh, and magic module too, I skipped it when I was typing my test)
4 Views