Where does the package builder get its binaries? Do I need to provide an own server? What kind of server?

If you don’t specify, it pulls them from Kolide’s Notary servers

Does that mean that if I DON'T provide a

hostname

parameter it will take some default? And then I will get

osquery

installed from there?

No.

hostname

has no default (see the link above).

oh, so it is not the server "serving" the binaries

No. That is specified by

notary_url

AAAAAH! That makes things much clearer! Thanks @sundsta

If you don't want a central server (like Fleet) managing the osquery configurations (and receiving the logs), you might just want to build a package with plain

osqueryd

. You then need to figure out how you want to get the logs off the endpoint.

That sounds like what I want to do! So how do I build a packge with plain

osqueryd

?

🙏

You might be able to patch package-builder, but it is oriented to packaging launcher, osquery, and launchers config to talk to a fleet manager.

Thanks @seph, this is very explicit and clear.

I think it's possible, though you'll have to patch the code in Launcher that starts osquery to use different config and logging plugins.

Maybe. But not without work. I feel compelled to suggest you also look at SaaS vendors here. Kolide, for example. But anyhow, Launcher has some built in update functionality. Extracting that into a standalone tool would be hard. You may as well write your own at that point. Launcher only knows how to speak grpc or jsonrpc. You could do some work to have launcher manage osquery. and have osquery connect directly to something. Or not connect anywhere. But you’ll have to figure that out

I see, thank you very much for your support guys