By the way, about the BPF PR that have some tests ...
# core
s
By the way, about the BPF PR that have some tests crashing, this happens when trying to query one of the flag values (logger_min_status or similar) and specifically:
Copy code
// osquery/core/flags.cpp
long int Flag::getInt32Value(const std::string& name) 
{
  return tryTo<long int>(Flag::getValue(name), 10).takeOr(0l);
}
The tryTo function returns an Expected instance which is constructed on return, starting from an int. On a Debug build it seems that the Expected destructor is called before calling the takeOr function, which means that the value inside the Expected instance is not inspected and since there's an assert about it, it triggers it.