https://github.com/osquery/osquery logo
Title
r

rokusei

06/02/2020, 9:37 AM
@Anatol Pomazau Thanks for all your work on the Arch Linux package. Do you mind clarifying why
rpmtools
and
dpkg
are necessary for these? When building locally, it seems like
git python3 bison flex make
are the only requirements. (I haven't tried to run it though)
a

Anatol Pomazau

06/02/2020, 6:03 PM
There is not much reason actually. And it done mostly because of historical reason - when I was brining it up at Arch I just enabled all the feature to make sure it compiles fine with Arch' toolchain. I think these deps can be disabled. And we also need pacman/libalpm integration.
r

rokusei

06/02/2020, 10:15 PM
@Anatol Pomazau Awesome, thanks for the response. Is there something I can do to help to accomplish this? When I try to do an install from AUR the installed size is over 500MB. I'd love to get that down to something a little more reasonable and have a minimal set of dependencies.
a

Anatol Pomazau

06/02/2020, 10:44 PM
You don't need to install
osquery
from AUR. The package is available in the standard repo https://www.archlinux.org/packages/community/x86_64/osquery/
r

rokusei

06/02/2020, 10:59 PM
@Anatol Pomazau Sorry, I just woke up and didn't communicate that very well. Both the AUR and the standard community repo end up having an install size of over 500MB which seems very large for an agent. I wouldn't mind helping out trying to help minimize some of the dependencies if you'd like. Not really sure where to start here though.
a

Anatol Pomazau

06/02/2020, 11:02 PM
To remove these large dependencies you can try to rebuild this package manually https://git.archlinux.org/svntogit/community.git/tree/trunk?h=packages/osquery without
rpm-tools
dpkg
dependencies.
Let me know if it works for you
r

rokusei

06/03/2020, 12:35 AM
@Anatol Pomazau Found the culprit.
447.53MiB community/aws-sdk-cpp
a

Anatol Pomazau

06/03/2020, 12:36 AM
Oh yeah, it is a huge beast
r

rokusei

06/03/2020, 12:36 AM
Maybe we can move that to a makedepends instead of a depends? 🤔
a

Anatol Pomazau

06/03/2020, 12:38 AM
This library is a runtime dependency. So it is impossible to move to makedeps.
r

rokusei

06/03/2020, 12:38 AM
The full SDK is a runtime dependency?
a

Anatol Pomazau

06/03/2020, 12:39 AM
From the bright side this dependency is downloaded only once. You won't download it often.
Probably not the full one but only part of it.
r

rokusei

06/03/2020, 1:06 AM
Interesting. I am trying a rebuild with aws-sdk-cpp as a makedepend to see if it's actually runtime or just a compile time dependency.
t

theopolis

06/03/2020, 1:07 AM
If it helps, osquery only uses the
ec2
,
kinesis
,
firehose
and
sts
libraries within
aws-sdk-cpp
.
r

rokusei

06/03/2020, 1:14 AM
That's fair, its just hard to imagine people will install a 500MB dependency for a single application, as nothing else in arch repos requires it. Even electron has a smaller footprint... which says a lot.
a

Anatol Pomazau

06/03/2020, 1:22 AM
I think it would be possible to break this Arch package into multiple smaller ones, like
aws-sdk-cpp-ec2
,
aws-sdk-cpp-firehose
, ... Though it makes sense to release only subset of the project components - for beginning only those 4 used by
osquery
and then add more if needed.
Please file an Arch bug to track this activity
Also note that 447MiB is installed size. The package (download) size is only 40MiB. A large part of the package are header files.
r

rokusei

06/03/2020, 1:37 AM
Will do. I assume you want the bug filed against aws-sdk-cpp?
a

Anatol Pomazau

06/03/2020, 1:39 AM
yes. and share the ticket with me so I assign it to myself.
r

rokusei

06/03/2020, 1:46 AM
I put it under general gripe, since it's my gripe about install size 😛
a

Anatol Pomazau

06/03/2020, 1:49 AM
Thanks a lot @rokusei
r

rokusei

06/03/2020, 1:59 AM
Thank you for all the work you do!
a

Anatol Pomazau

06/03/2020, 10:16 PM
As an intermediate fix I restricted set of components installed by
aws-sdk-cpp
package to only those 4 needed by osquery. The download size of the package is reduced to 3.5 MiB.