GitHub
10/16/2026, 9:31 PMenroll and verify already worked; these four didn't.
• The environment must be a UUID. osctrl's osctrld endpoints reject anything else with a bare HTTP 400, but osctrld's docs, sample config and default-config said a name works. validateConfiguration now rejects a name with a clear message (exit code 2) before any request is made. The docs, sample config and test fixtures now use a UUID.
• The daemon logged an error on every sync cycle. osctrl doesn't serve osctrld-extensions, so the request always got a 404. That 404 is now read as "no extensions" and skipped quietly. A wrong URL or environment still fails loudly on the flags and cert requests earlier in the same cycle, and extension sync starts working by itself once osctrl adds the endpoint. To support this, genericRetrieve returns a typed HTTP status error; its message text is unchanged.
• The checksum-mismatch error now says where the expected checksum came from. osctrl's osquery_sha256 is one value for the whole server and overrides the node's --osquery-sha256, but each OS and architecture has its own package, so without the source the error was hard to act on.
• install now trims the flags and certificate before writing them, so it writes the same files as the flags and cert commands.
Operational impact: a config that names its environment, such as environment: "dev", now fails validation instead of getting a 400 from the server. Use the environment's UUID.
Validation
• `go test ./cmd/osctrld/ -race`: all 105 tests ran and passed, coverage up from 69.8% to 74.5%
• golangci-lint run ./..., native and `GOOS=windows`: 0 issues
• Ran the real osctrld binary against osctrl's own flags, cert, verify and script handlers. Flags come back with both paths filled in, cert, enroll and verify succeed, and an environment name is rejected before any request is made.
jmpsec/osctrldGitHub
10/16/2026, 9:33 PM