Hi Fleet team, could u tell me how does fleet fetch the version of osquery, i have a osquery pkg built by myself following the standard Debian requirement. and fleet telling that with some weird content as showing below. Thread in Slack Conversation

It looks like you are building custom packages..you can customize that by setting the

OSQUERY_VERSION

env variable when building it locally as described here https://osquery.readthedocs.io/en/latest/development/building/#identifying-the-osquery-version

I’m not sure about that but you can choose the version that osquery has to use when you build it, if you want to do a custom build. In that thread Kathy has pointed you to the CMake option that can be overridden while configuring (OSQUERY_VERSION). So when you do

cmake […]

add

-DOSQUERY_VERSION="<your version>"

but the weird thing is this is the pkg i built by debian flow, and you can see the package info. FVFHP07CQ05Q:Downloads bytedance$ dpkg --info osquery_5.4.0_amd64.deb new Debian package, version 2.0. size 12923020 bytes: control archive=6988 bytes. 43 bytes, 2 lines conffiles 221 bytes, 10 lines control 19298 bytes, 241 lines md5sums 583 bytes, 23 lines * postinst #!/bin/sh Package: osquery Version: 5.4.0 Architecture: amd64 Maintainer: wennan.he Installed-Size: 51166 Depends: sudo, wget Section: admin Priority: extra Homepage:XXX Description: osquery agent you can see the version is 5.4.0. but the present one is another val in fleet.

Yeah I think the wiki has to be updated, there are 2 versions involved, one is for the binary itself and it’s hardcoded into it. That one is provided via cmake and can be seen either via

osqueryd --version

or querying the

osquery_info

table

so you mean if i run cmake -DOSQUERY_PACKAGE_VERSION=${OSQUERY_VERSION} is also working? and i will see OSQUERY_VERSION i setup in fleet page?

That is for the package version itself, Fleet will ignore that because at that point osquery is already installed. What Fleet is picking up is the version hardcoded in the osquery binary, that has to be passed via

OSQUERY_VERSION

but as a CMake flag in the osquery binary configuration process and build

OK, thank you for explain, and is there any way i can setup that osquery_version?

Yes, as I was mentioning here https://osquery.slack.com/archives/C08V7KTJB/p1666896117837239?thread_ts=1666895723.863199&cid=C08V7KTJB you have to pass that as a CMake flag when you are configuring and building osquery

ok gotta, thx.

How have you provided the version to the build?

you have changes not staged for commit in your working dir what does it mean?

That’s not how it works. The tag is on the top commit (the last), so

git describe […]

it’s correctly taking 5.4.0; but you don’t have to look there. You have to look at

git status

. When you make a change to a file and not do

git add

to it or fully commit it, that in git parlance is a

change not staged for commit

, or another way to say it is that you have your working tree dirty/not clean

i don't add any change when building osquery but i would generate some temp folders to store all the generated files by build itself. So you mean that is the not staged change?

Have you checked what

git status

gives?

i will check it

build

directory will not cause an issue because that's part of

.gitignore

so it gets ignored

And could anyone help to explain where did the middle part of the name come from?

do you mean the

gcede[..]

part? that always comes from

git describe --always --tags --dirty

, but more specifically is the short form of the SHA of the commit the binary has been built from

thx, i am trying to figure out that how to make it align with pervious name like 5.4.0