Hi Fleet team, could u tell me how does fleet fetch the version of osquery, i have a osquery pkg built by myself following the standard Debian requirement. and fleet telling that with some weird content as showing below.

Fleet gets that from osquery. It’s being set when osquery is built, based on info pulled from git: https://github.com/osquery/osquery/blob/030e7af09f310101e0ef8da99c8288239ba2e7d9/cmake/options.cmake#L14

thx, but i dont understand the logic in the code from the link, maybe could u help to explain the logic?

When the build process runs,

git describe

is run to get the most recent tag. The

--tags

flag allows for

refs

in

refs/tags

to be detected as tags. The

--always

flag allows for a commit to be used if both of those fail. The

--dirty

flag adds an indicator if there are local changes (which you're seeing in your version). So what you're seeing there is the most recent tag, then the most recent commit after the tag, then the

dirty

suffix to show that there were local changes when the build was run.

@Kathy Satterlee one more question, why the standard building process pkg osquery has different val of this field?

If I understand the question properly, it's because generally the version you're building is a tagged release, so there are no additional commits and only the tag is returned.

ok i got it, but this isnot what i want

Gotcha. Since this isn't directly related to Fleet, the best bet at this point would be to reach out to the wider community over in #general to see if anyone can suggest ways to set a custom version number or change that logic.