Title
#linux
defensivedepth

defensivedepth

08/18/2022, 1:51 AM
Trying to dig back into the history of when the linux osqueryd binary increased in size.... Anyone recall why it increased so dramatically from
4.9
44mb ------>
5.0
196mb ?
s

sharvil

08/18/2022, 1:57 AM
5.0 was a major effort to redo packaging and releasing, and get us closer to reproduce-able builds, perhaps we now include debug symbols by default..? Or forgot to strip them
1:57 AM
I will have to check this later when I am at a computer
1:57 AM
And @Stefano Bonicatti might also have a clue
s

seph

08/18/2022, 2:05 AM
That's the tarball? It's not stripped. IMO it's a packaging bug. You can strip it, or extract from the rpm or Deb
Stefano Bonicatti

Stefano Bonicatti

08/18/2022, 9:34 AM
https://github.com/osquery/osquery/issues/7169 This was the issue you’ve opened. I wouldn’t call it a bug? Providing the debug symbols so that one can split them and keep them it’s useful. That been said we can do that job, creating 2 archives, one with the stripped binary, and the other just with the debug symbols. They also can be merged back with a tool called
eu-unstrip
.
defensivedepth

defensivedepth

08/18/2022, 11:41 AM
Ok so the osqueryd binary in the tarball is being generated with debug symbols but the one in the rpm isnt? 200mb in the tarball vs. 49mb in the rpm
11:43 AM
This came up because there is a group I am working with that is deploying osquery and their deployment package is massive. Looks like they are using the tarball as the source.
Stefano Bonicatti

Stefano Bonicatti

08/18/2022, 1:10 PM
yeah the rpm isn’t because it splits the debug symbols in a different package.
s

seph

08/18/2022, 1:18 PM
I consider this a bug, because I think most use cases do not want the debug symbols. So the easy paths should be the stripped versions.
Mike Myers

Mike Myers

08/18/2022, 5:11 PM
Well this requires a change in
osquery-codesign
and things tend to get bottlenecked there
s

seph

08/18/2022, 5:44 PM
Does it? I think it’s mostly something in the cpack code. Which is in osquery repo
Stefano Bonicatti

Stefano Bonicatti

08/18/2022, 6:21 PM
There should be no problem on the codesign side, since Linux binaries are not signed
6:22 PM
there’s should also be minimal logic to upload the debug symbols separately in the codesign repo, but again that should be straightforward
Mike Myers

Mike Myers

08/18/2022, 6:31 PM
ah, okay, then anyone who has time to make the PR to
osquery/osquery
can help, sounds like it can be done in a GitHub Actions workflow