I think https://github.com/osquery/osquery/pull/7821#discussion_r1095282267 is ready to merge now, though I can't approve or merge it because of how I opened the PR (though didn't write any of the code)