Specifically:

1.

package_data/opt/osquery/osquery.app

(that is the app bundle)

2.

package_data/opt/osquery/bin/osqueryd

I alluded to this on #C08VA3XQU, but to repeat it here. I suspect this is confusing. At least, I think the package-data stuff is mis-structured, and we’re incurring future work. Namely, I think to reduce confusion it should either be very close to the final installed structure, such that the tar.gz distribution matches it. OR it should be something completely arbitary completely unrelated to final

INSTALL_DIR

. This splits the difference, and I think will create confusion for it. Namely, in an actual install, you’re not going to have both of these. You’ll have either the

.app

and a symlink, or you’ll have the binary. I don’t think we need to correct this for 5.0, but I see it as incurring tech debt.