I just watched the osquery office hours yesterday
Just to follow up on this thread
I think it would be cool include this extension functionality into core by adding LIEF as a dependency
But I'm not sure if osquery has specific requirements for dependencies?
For context on LIEF:
Its primarily maintained by a single person (though a company does sponsor it)
It doesn't really have a set release schedule (ex: over a year between version 10 and 11)
But the library is pretty much stable/complete I think (macho and pe formats r not really going to go through major formatting changes so having a bunch of releases may not make sense?)
If there is still a desire to add this core I can try looking to see how to get it included though I'm not a cmakelist expert