You might have to specify

-DCMAKE_OSX_DEPLOYMENT_TARGET=10.14

during the configure step when building..there are more details on how to do this here: https://osquery.readthedocs.io/en/stable/development/building/

And my MacOS is intel and version is Ventura 13.0.1 (22A400) . Is there any more information you need?

cmake -DCMAKE_OSX_DEPLOYMENT_TARGET=10.14 -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DCMAKE_BUILD_TYPE=Release .. -- The C compiler identification is AppleClang 12.0.0.12000026 -- The CXX compiler identification is AppleClang 12.0.0.12000026 -- Detecting C compiler ABI info -- Detecting C compiler ABI info - done -- Check for working C compiler: /usr/bin/clang - skipped -- Detecting C compile features -- Detecting C compile features - done -- Detecting CXX compiler ABI info -- Detecting CXX compiler ABI info - done -- Check for working CXX compiler: /usr/bin/clang++ - skipped -- Detecting CXX compile features -- Detecting CXX compile features - done -- The ASM compiler identification is Clang with GNU-like command-line -- Found assembler: /Library/Developer/CommandLineTools/usr/bin/clang -- The OBJCXX compiler identification is AppleClang 12.0.0.12000026 -- Detecting OBJCXX compiler ABI info -- Detecting OBJCXX compiler ABI info - done -- Check for working OBJCXX compiler: /Library/Developer/CommandLineTools/usr/bin/clang++ - skipped -- Found Git: /usr/bin/git (found version "2.24.3 (Apple Git-128)") -- osquery version: 5.6.0-14-ga5bc1a33f -- Found ccache: /usr/local/bin/ccache -- Found clang-format: /usr/local/bin/clang-format -- Found Python3: /usr/local/Frameworks/Python.framework/Versions/3.10/bin/python3.10 (found suitable version "3.10.8", minimum required is "3.5") found components: Interpreter -- Build type: Release -- Shared libraries: OFF -- Importing: source/augeas/gnulib -- Importing: source/augeas -- Importing: source/boost -- Performing Test CMAKE_HAVE_LIBC_PTHREAD -- Performing Test CMAKE_HAVE_LIBC_PTHREAD - Success -- Found Threads: TRUE -- osquery: boost::context is using the fcontext backend -- Importing: source/bzip2 -- Importing: source/gflags -- Importing: source/glog -- Importing: source/googletest -- Found Python: /usr/local/Frameworks/Python.framework/Versions/3.10/bin/python3.10 (found version "3.10.8") found components: Interpreter -- Importing: source/libarchive -- Importing: source/libmagic -- Importing: source/librdkafka -- Importing: source/libxml2 -- Importing: source/linenoise-ng -- Importing: source/lzma -- Importing: source/popt -- Importing: source/rapidjson -- Importing: source/rocksdb -- Importing: source/sleuthkit -- Importing: source/sqlite -- Disabling the SQLite R*Tree module -- Disabling the SQLite FTS extensions -- Importing: source/thrift -- Importing: source/yara -- Importing: source/zlib -- Importing: source/zstd -- Importing formula: formula/openssl CMake Warning (dev) at /Applications/CMake.app/Contents/share/cmake-3.25/Modules/ExternalProject.cmake:3075 (message): The DOWNLOAD_EXTRACT_TIMESTAMP option was not given and policy CMP0135 is not set. The policy's OLD behavior will be used. When using a URL download, the timestamps of extracted files should preferably be that of the time of extraction, otherwise code that depends on the extracted contents might not be rebuilt if the URL changes. The OLD behavior preserves the timestamps from the archive instead, but this is usually not what you want. Update your project to the NEW behavior or specify the DOWNLOAD_EXTRACT_TIMESTAMP option with a value of true to avoid this robustness issue. Call Stack (most recent call first): /Applications/CMake.app/Contents/share/cmake-3.25/Modules/ExternalProject.cmake:4185 (_ep_add_download_command) libraries/cmake/formula/openssl/CMakeLists.txt:194 (ExternalProject_Add) libraries/cmake/formula/openssl/CMakeLists.txt:225 (opensslMain) This warning is for project developers. Use -Wno-dev to suppress it. -- Importing: source/aws-sdk-cpp -- Found cppcheck: /usr/local/bin/cppcheck (found version "2.9") -- cppcheck: Enabled with /usr/local/bin/cppcheck -- Configuring done -- Generating done

configure have already set but have error when build. But the error still the same.

Hi, @sharvil! I have just tested in a MacOS with M1. And the same steps that M1 MacOS can build succeed, and the intel MacOS can not and have the problem above.

Do you require more information about this?