Title
#macos
n

Neil

07/15/2021, 11:51 PM
I’m in the process of upgrading osquery from 3.3.0 to 4.9.0. I have the 4.9.0 code building fine and packaging for 
MacOS
 creating a pkg fine also.  I notice the packaging mechanism has changed since 3.3.0. One thing that I can’t find how to do with 4.9.0 packaging on 
MacOS
 is to ensure a restart of 
osqueryd
 at the end of the install.  With the 3.3.0 code base, there was a flag passed to the now-superseded packaging script. Any tips on how the same type of postinstall unload/load of the daemon can be achieved?
a

allister

07/16/2021, 12:51 AM
things are about to change again as we're around the corner from 5… the packaging.cmake file is no longer in master, but they were using a postinstall.sh on linux, you could do the same for Mac
12:51 AM
(Or require a restart, to be clumsy about it - not sure how you're distributing it)
n

Neil

07/16/2021, 6:01 AM
Thanks for the suggestions. I’d like to avoid requiring a reboot. Where can I read about the packaging changes planned for v5?
a

allister

07/16/2021, 6:38 AM
good question, the signing is definitely changing and I believe a lot is moving into githubs actions/pipelines/CI/CD but I'm otherwise unclear about what or where the 'makefile' textual representation of that artifact of the release process is recorded/would be modifiable
6:41 AM
I would have thought I'd see stuff in the .github dir but nothing sticks out at present
6:41 AM
n

Neil

07/16/2021, 7:05 AM
Thanks. I’ll take a look there next.
Stefano Bonicatti

Stefano Bonicatti

07/16/2021, 8:39 AM
Hey, you might want to have a look here for general guidance: https://osquery.readthedocs.io/en/latest/development/building/#building-packages For your specific problem, you would have to modify the osquery-packaging CMake files to add
CPACK_POSTFLIGHT_<COMP>_SCRIPT
Full path to a file that will be used as the postinstall script for the named <COMP> component's package, where <COMP> is the uppercased component name. No postinstall script is added if this variable is not defined for a given component.
a

allister

07/16/2021, 9:17 AM
(the tooling I use for Mac packaging makes my life so easy, relatively speaking 😅 I know we'd have to rip
make
out of the rest of the world's clammy dead hands, but)
9:18 AM
silly macadmins and their python-based tooling
n

Neil

07/16/2021, 10:05 PM
Thank you @Stefano Bonicatti and @allister