GitHub
05/23/2026, 8:08 AMservice command) — long-running sync loop with configurable interval and jitter, graceful shutdown on SIGINT/SIGTERM
• Osquery lifecycle management — automatically restarts osquery via OS service manager when synced flags or certificate change on disk
• Extension deployment — fetches extension manifests from osctrl, downloads and deploys binaries, restarts osquery only on changes
• YAML configuration — config defaults to YAML format while keeping full JSON backward compatibility via Viper auto-detection
Additional improvements
• Migrated logging from log/slog to <http://github.com/rs/zerolog|github.com/rs/zerolog> with configurable format (text or json)
• Fixed force flag binding bug (was bound to Verbose instead of Force)
• Fixed typo and removed dead code
• Added comprehensive test suite (51 tests) with CI pipeline (golangci-lint + race-enabled tests)
• Updated README, sample configs, and service files (systemd/launchd) for v2.0.0
Stats
• 32 files changed, 1,425 insertions, 352 deletions
• 51 tests all passing
• CI green (lint + tests)
Test plan
• All 51 unit tests pass (go test -race -v ./cmd/osctrld/)
• golangci-lint passes with zero warnings
• CI pipeline green on push
• Release builds successfully for all 6 platforms (darwin/linux/windows × amd64/arm64)
• YAML and JSON config loading verified via tests
• Daemon mode jitter calculation verified via tests
• Osquery restart command generation verified per OS via tests
• Extension manifest parsing and deployment verified via tests
jmpsec/osctrldGitHub
05/24/2026, 9:38 AM