Channels
doorman
infrastructure
random
zercurity
community-feeds
fleet-dev
code-review
queryhub
apple-silicon
carving
tls
fim
goquery
zentral
aws
querycon
golang
zeek
file-carving
fuzzing
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
darkbytes
process-auditing
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
general
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
windows
Title
t
theopolis
05/24/2021, 7:56 PMThis sounds like a bug
t
timb
05/24/2021, 9:36 PMwhich part?
if you think we should be using an older version of glibc for aarch64 i'd be happy to test it out and submit a PR! i already have the toolchain building, etc
t
theopolis
05/24/2021, 9:49 PMI think we should use 2.17 for the toolchain instead of 2.23
👍 1
t
timb
05/24/2021, 9:54 PMi'd be happy to follow up on that!
i also wanna highlight that the automatic dependencies may be a problem to consider for osquery build? apparently cpack by default leaves the rpm auto dependency feature enabled: http://ftp.rpm.org/max-rpm/s1-rpm-depend-auto-depend.html
and there's two issues i see:
• the environment the package is built in determines the automatic dependencies, so this may cause some concern for
osquery-packaginghere's the requirements list for the 4.7.0 aarch64 package, so you can see what i mean about the second point:
rpm -qp --requires osquery-4.7.0-1.linux.aarch64.rpm
/bin/sh
/bin/sh
/bin/sh
/bin/sh
/bin/sh
/usr/bin/env
config(osquery) = 4.7.0-1.linux
glibc >= 2.12
ld-linux-aarch64.so.1()(64bit)
ld-linux-aarch64.so.1(GLIBC_2.17)(64bit)
libc.so.6()(64bit)
libc.so.6(GLIBC_2.17)(64bit)
libc.so.6(GLIBC_2.18)(64bit)
libdl.so.2()(64bit)
libdl.so.2(GLIBC_2.17)(64bit)
libm.so.6()(64bit)
libm.so.6(GLIBC_2.17)(64bit)
libpthread.so.0()(64bit)
libpthread.so.0(GLIBC_2.17)(64bit)
libresolv.so.2()(64bit)
libresolv.so.2(GLIBC_2.17)(64bit)
librt.so.1()(64bit)
libz.so.1()(64bit)
libz.so.1(ZLIB_1.2.0)(64bit)
libz.so.1(ZLIB_1.2.2)(64bit)
rpmlib(CompressedFileNames) <= 3.0.4-1
rpmlib(FileDigests) <= 4.6.0-1
rpmlib(PayloadFilesHavePrefix) <= 4.0-1
zlibs
Stefano Bonicatti
05/24/2021, 10:11 PMah good catch! I guess
CPACK_RPM_PACKAGE_AUTOREQt
timb
05/24/2021, 10:12 PMyeah! i think cpack has one that also disabled AUTODEP? i'm not sure what the difference is, but i do recall seeing two flags
s
Stefano Bonicatti
05/24/2021, 10:12 PMautoreq is
May be used to enable (1, yes) or disable (0, no) automatic shared libraries dependency detection. Dependencies are added to requires list.👍 1
t
timb
05/24/2021, 10:12 PMbut i wasn't sure if we wanted to disable autoreq entirely and simply update the aarch64 static requirements. i've never used it, and it seems kinda horrifying
s
Stefano Bonicatti
05/24/2021, 10:16 PMI mean, even for x86_64 I think we want only the bare minimum at the minimum version we use.
t
timb
05/24/2021, 10:17 PMyeah that's what i was thinking. and it makes it much easier if we don't need to use the toolchain in
osquery-packagings
Stefano Bonicatti
05/24/2021, 10:19 PMyeah definitely, osquery-packaging shouldn't depend on it since it acts on already compiled binaries. At least we weren't planning to.
👍 1
t
timb
05/24/2021, 10:20 PMi'm already pretty deep into this, so i'd be happy to get 2 PRs together this week, one to disable autoreq and one to downgrade the aarch64 toolchain to 2.17; let me know if you find anything else out!
❤️ 2