https://github.com/osquery/osquery logo
Powered by
Title
l

Lucas Rodriguez

05/03/2022, 8:09 PM
Hi folks, is it expected that the "Linux (x86_64)" download listed in https://osquery.io/downloads/official/5.2.2 contains debug symbols?
curl -L <https://pkg.osquery.io/linux/osquery-5.2.2_1.linux_x86_64.tar.gz> --output osquery-5.2.2_1.linux_x86_64.tar.gz

tar xf osquery-5.2.2_1.linux_x86_64.tar.gz

du -h opt/osquery/bin/osqueryd
202M    opt/osquery/bin/osqueryd

file opt/osquery/bin/osqueryd
opt/osquery/bin/osqueryd: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 4.7.10, BuildID[sha1]=25085f182ffb0cc02d0c6cad3c06378ab1b1827f, with debug_info, not stripped
m

Mike Myers

05/03/2022, 8:16 PM
@alessandrogario do you know if this is intentional
s

Stefano Bonicatti

05/03/2022, 8:18 PM
There’s an issue about this https://github.com/osquery/osquery/issues/7169
:ty: 2
To be fair I’m not exactly sure there is any problem? If anything now is better, because you get the debug symbols.. that you can also strip away or separate with a command
Would also be interesting to have the .pdb for Windows
💯 1
l

Lucas Rodriguez

05/03/2022, 8:21 PM
+1, maybe the 
"Linux (x86_64)"
(red box in the attached screenshot) should just be moved to 
Debug
? (instead of official?) But I agree it's nbd. Was just checking if this was expected.
a

alessandrogario

05/03/2022, 8:22 PM
it's a release build with debug info
👍 1
(so not a debug build)
s

seph

05/04/2022, 2:36 AM
FWIW I do not find this convenient. But that’s why I opened that issue
a

alessandrogario

05/04/2022, 8:15 AM
I think it's good that we have this binary (and not a stripped one) cause it helps debug issues when something crashes; with deb/rpm we have debug packages
but with a simple .tar.gz there's some fiddling involved when trying to move debug symbols back into a stripped binary
s

seph

05/04/2022, 11:33 AM
I think we should have both.
12 Views
#generalJoin Slack
Powered by