https://github.com/osquery/osquery logo
Join Slack
Powered by
I cut osquery 5.22.0: <https://github.com/osquery/...
# core
z
I cut osquery 5.22.0: https://github.com/osquery/osquery/releases/tag/5.22.0 Once CI finishes, someone will need to run the workflow in the codesign repo to make the signed artifacts available.
Okay so I have run the codesign workflow and the artifacts are now on the release. But I'm noticing something weird with the macos artifacts: I'm getting the gatekeeper "this may be malware" messages on the .pkg and on the plain binary, even though both show that they are codesigned and notarized.
Copy code
zwass@Zachs-MacBook-Pro-2 Downloads % pkgutil --check-signature osquery-5.22.0.pkg
Package "osquery-5.22.0.pkg":
   Status: signed by a developer certificate issued by Apple for distribution
   Notarization: trusted by the Apple notary service
   Signed with a trusted timestamp on: 2026-02-25 15:54:25 +0000
   Certificate Chain:
    1. Developer ID Installer: OSQUERY A Series of LF Projects, LLC (3522FA9PXF)
       Expires: 2027-02-01 22:12:15 +0000
       SHA256 Fingerprint:
           45 97 57 E4 B1 65 A9 A7 7A BF A6 DD 2F C0 AD C0 C7 96 B3 64 C2 E0
           48 08 09 D6 68 71 B4 A7 C3 60
       ------------------------------------------------------------------------
    2. Developer ID Certification Authority
       Expires: 2027-02-01 22:12:15 +0000
       SHA256 Fingerprint:
           7A FC 9D 01 A6 2F 03 A2 DE 96 37 93 6D 4A FE 68 09 0D 2D E1 8D 03
           F2 9C 88 CF B0 B1 BA 63 58 7F
       ------------------------------------------------------------------------
    3. Apple Root CA
       Expires: 2035-02-09 21:40:36 +0000
       SHA256 Fingerprint:
           B0 B1 73 0E CB C7 FF 45 05 14 2C 49 F1 29 5E 6E DA 6B CA ED 7E 2C
           68 C5 BE 91 B5 A1 10 01 F0 24

zwass@Zachs-MacBook-Pro-2 Downloads % spctl -a -vv -t install osquery-5.22.0.pkg
osquery-5.22.0.pkg: accepted
source=Notarized Developer ID
origin=Developer ID Installer: OSQUERY A Series of LF Projects, LLC (3522FA9PXF)
Hmm, so now I am able to install the package but I'm still not able to run the osqueryd binary:
Copy code
% /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd -S
zsh: killed     /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd -S
Maybe Apple is just being slow today?
In the console I see messages like
Copy code
mac_vnode_check_signature: /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd: code signature validation failed fatally: When validating /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd:
Code has restricted entitlements, but the validation of its code signature failed.
Unsatisfied Entitlements: com.apple.developer.endpoint-security.client
@seph it seems like maybe you recently renewed the dev certificate? Did we perhaps miss out on renewing the entitlements?
Ah okay I think it's an issue with the provisioning profile
Screenshot 2026-02-25 at 8.56.39 AM.png,Screenshot 2026-02-25 at 8.56.31 AM.png
s
I renewed the cert, but I did not do anytthing with the profiles, so it's entirely possible we need to renew/update something in that.
I think you can nose around the apple web site? I'm buried this week
z
is this -84 phone number yours? I can't login without it
s
that's me. I think if you click another way you'll eventually find your phone number
That hit me. Do you want the code?
z
ah I see I had to keep clicking things to get it to use my number!
I think I'm good, thank you!
s
np
7 Views
Open in Slack
PreviousNext
Powered by