i watched the osquery office hours on tuesday and it was mentioned/discussed about merging external extension(s)/features into osquery core
one of the examples mentioned was the extension mentioned at
https://osquery.slack.com/archives/CBMR0L7SM/p1613094873095400
just to follow up on that point in office hours:
I think it would be cool include this extension functionality into core by adding LIEF as a dependency
But I'm not sure if osquery has specific requirements for dependencies?
For context on LIEF:
Its primarily maintained by a single person (though a company does sponsor it)
It doesn't really have a set release schedule (ex: over a year between version 10 and 11)
But the library is pretty much stable/complete I think? (macho and pe formats r not really going to go through major formatting changes so having a bunch of releases may not make sense?)
If there is still a desire to add this to core I can try looking to see how to get it included though I'm not a cmakelist expert🤔