has anyone spelunked into how to perhaps mash up m...
# macos
a
has anyone spelunked into how to perhaps mash up mdls for kMDItemExecutableArchitectures to add a "kind" column to the apps table on Darwin?
and the answer is of course you can mashem up
Copy code
osquery> select count(*) from apps join mdls on mdls.path = apps.path where mdls.key = "kMDItemExecutableArchitectures" and mdls.value not like "arm64%"; 
count(*) = 44
👌 1
s
I wonder how cheap the mdls call is. I wonder if this can be parsed out of Info.plist or something
a
good question, it's not in the first info.plist I'm checking. I need to get better at profiling
s
The really quick way is to
.timer on
in osqueryi and see how different they look. You can also get into queryy planning.