Channels
doorman
infrastructure
random
zercurity
community-feeds
fleet-dev
code-review
queryhub
apple-silicon
carving
tls
fim
goquery
zentral
aws
querycon
golang
zeek
file-carving
fuzzing
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
darkbytes
process-auditing
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
general
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
windows
Title
m
Mystery Incorporated
09/16/2021, 1:44 PMHi thanks for updating osquery.io to show v5.0.1 for download. Unfortunately the url https://pkg.osquery.io/windows/osquery.msi is still serving the older v4.9.0
s
seph
09/16/2021, 4:13 PMOh. I have no idea if we intentionally support that kind of link
Is it documented somewhere? As far as I know, it’s not part of any of the release scripts
m
Mike Myers
09/16/2021, 5:50 PMWho did we used to rely on for updating the site, was it Teddy?
s
seph
09/16/2021, 5:51 PMWebsite updates for the last long-time have been a mix of Teddy and me, and they’re pretty scripted.
pkgGlancing at obvious looking common names, like
osquery.pkgosquery.msiIf there are docs, or we think it’s a good idea, we can add it to the release generation tooling pretty easily.
m
Mystery Incorporated
09/17/2021, 6:58 AMwell how else can we automatically grab the lates release without putting a version number in the path?
There is no /latest endpoint or anything. so I just been using that url as it until now guaranteed to serve the newest .msi
Like there needs to be a way for script do just hit the same URL and receive the current version of the msi. If you have osquery-x.y.z.msi in the url then someone needs to change the script every time to alter x,y and z to download the latest msi. vendors typically have a /latest endpoint or something where you can be sure to fetch the latest msi from your script.
s
seph
09/17/2021, 3:23 PMas it until now guaranteed to serve the newest .msiCan you find a documented claim of that guarantee? I understand why you might want this, but I don’t think we’ve made that promise.
m
Mystery Incorporated
09/21/2021, 12:56 PM@seph it wasn't a promise, it just happened to be delivering the latest msi so I used it. But now it no longer gives the latest msi. So what options do we have to get the latest msi now? Or do we need to manually edit the path in our script any time there is an update? It would be nice if there was a /latest endpoint or something.
And anyone who uses it in their script now has a broken script that wont update. Seems like a bit of an "f you" to say "we never guaranteed it". If you make that URL available you should maintain it, explicit guarantee not necessary as the URL didn't make itself and therefore it obviously exists to be used. And now for whatever reason you don't want to use it anymore?
And if it no longer exists or is deprecated then 301 it to somewhere that does exist
m
Mike Myers
09/21/2021, 9:04 PM@seph you have access to that S3 bucket? You were looking at file timestamps; does it look like those files got littered there by chance, maybe during a manual upload process that we have since automated?
@Mystery Incorporated I think it's a valid suggestion and I'll create a GitHub issue to either (a) disable that URL or (b) point it to 'current'. But I think there's a bigger problem we have which is automatic and frequent re-downloading of this installer, causing some massive bandwidth bills to the project. Encouraging automatic retrieval is probably not in our self-interest and I don't know how sustainable it is already
s
seph
09/21/2021, 9:09 PM@Mike Myers No idea. I observe inconsistency, but cannot guess about causality.
m
Mike Myers
09/21/2021, 9:09 PMok issue here to track https://github.com/osquery/osquery-site/issues/227
s
seph
09/21/2021, 9:10 PM@Mystery Incorporated I think it’s a find feature request, and if you’d like to make it, I think we can do it. But if you show up ranting about how it’s broken you’re not going to get a good response.
m
Mystery Incorporated
09/22/2021, 1:06 AMI guess I could just make my own endpoint and update it when osquery releases a new update if it's causing bandwidth bill problems then I can do it to assist with stopping that
m
Mike Myers
09/22/2021, 11:29 PMHow about this
curl -s <https://api.github.com/repos/osquery/osquery/releases/latest> | grep "browser_download_url.*msi" | cut -d ":" -f 2,3 | tr -d \"