I'd love to get https://github.com/osquery/osquery/pull/8565 and/or https://github.com/osquery/osquery/pull/8564 but they look non-trivial to review