https://github.com/osquery/osquery logo
Title
m

Martin Pöhlmann

04/28/2021, 7:06 PM
Upgraded to 3.11 with feature flag. Looking good for Ubuntu packages. It's cool to see this feature live now. I'm still at the beginning of the Fleet rollout, but I know that most Linux users in my company are using Arch Linux (including me). The osquery package that is available in the default Arch Linux repo contains a patch to also report packages installed on Arch as proposed in https://github.com/osquery/osquery/issues/6477 - what would be the best way to get Arch software reporting in fleet as well? PR to adjust the query or would you prefer to get this in a official osquery release 1st?
1
r

Rachel Perkins

04/28/2021, 9:38 PM
Hi Martin! First off, thanks for your swift upgrade. Just for clarity, Arch Linux software is not supported with the current software inventory, correct? If you think you can write a quick PR to get Arch software reporting, we would love to check it out.
🎂 2
m

Martin Pöhlmann

04/29/2021, 5:54 AM
That's right. The Arch Linux package table is only available in osquery when installed on Arch Linux. Fleet does not query this table.
t

terracatta

04/29/2021, 5:26 PM
Hey @Martin Pöhlmann, I'm not on the Fleet team but do you know the contributor who made that patch for Arch Linux? If so, you should encourage them to submit a full patch. I will definitely be a supporter of that getting merged into Osquery core!
m

Martin Pöhlmann

04/29/2021, 5:55 PM
I don't know him in person, but it's the same one who created the issue in osquery (https://github.com/osquery/osquery/issues/6477). He also maintains the official archlinux osquery package. I think he's also here on slack, @Anatol Pomazau
I'm also interested in getting this further (independently of fleet integration) and might also get some time to work on this if needed.
t

terracatta

04/29/2021, 6:31 PM
Ok cool, if you get a PR up flag me down and I'll definitely help test it and do my best to raise it to the core team. I think it would be a great addition.
1
💜 1
r

Rachel Perkins

04/29/2021, 9:41 PM
Awesome to hear @Martin Pöhlmann and @terracatta 🙌🏽
😊 1
m

Martin Pöhlmann

04/29/2021, 9:55 PM
Sounds good. As soon I find a few hours I'll continue. If in the meantime @Anatol Pomazau chimes in, it's also okay for me 😉
:ty: 1