Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Title
m
Michael
11/09/2022, 6:44 AMHello. I'm trying to package osquery for my distribution of choice. I'm running into a lot of trouble getting the build to find system augeas, is there some flag I need to be passing to get the build to find system libraries?
s
Stefano Bonicatti
11/09/2022, 9:22 AMWe don’t support building with system libraries, all the libraries are built from source because we have to target a wide range of distributions and, for consistency and stability, we want to test and work using the same version of third party libraries.
Some third party libraries have also patches to make them work for us properly.
m
Michael
11/09/2022, 4:44 PMhmm, alright I'll kill off my branch then. Kind of frustrating though because it means that osquery is not available to my distribution, are there any alternatives that can do what osquery does that you're aware of?
s
Stefano Bonicatti
11/09/2022, 4:47 PM@Michael What do you mean it’s not available?
Although it might not be available on your distro official package servers, we build and create packages of osquery at every release: https://osquery.io/downloads/official/5.5.1
The fact that we don’t use system libraries is exactly to be able to do so, to provide packages that work on a wide range of distro, with possibly the exact same behavior on all of them.
Is there a specific reason you know that on your distro it doesn’t? (what distro is that?)
But also, exactly as we are building and creating packages, you can too; the osquery project vendors the third party libraries source code. We build it all from source and the libraries are linked as static libraries
so you don’t need system libraries
m
Michael
11/09/2022, 4:51 PMosquery hard links against glibc, which is not available on a musl based system
s
Stefano Bonicatti
11/09/2022, 4:51 PMAh well, that’s entirely a different beast though; you wouldn’t have solved that with using third party libraries from the system, unfortunately
m
Michael
11/09/2022, 4:52 PMalso I can tell you its not available for void because given that it uses bundled libraries, it fails to meet our minimum package quality requirements
an often unpopular decision with upstreams, but as a distro we find it makes our lives a lot easier building for multiple c-libraries and cross compiling to multiple different architectures
thanks for the replies though, you saved me a lot of time trying to make this work when its not a supported use case. Going back through my open tabs it looks like I was on a way old version of the docs that implied I could get cmake to find system headers instead of bundled ones