Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add kolide_softwareupdate table #1123

Merged
merged 1 commit into from
Apr 10, 2023

Conversation

RebeccaMahany
Copy link
Contributor

@RebeccaMahany RebeccaMahany commented Apr 10, 2023

Closes #1122.

Adds a new execparser table to run softwareupdate --list to return recommended updates for macOS.

Sample query and output:

osquery> select * from kolide_softwareupdate;
+---------------+--------+-------------+-----------------------------+-------+
| fullkey       | parent | key         | value                       | query |
+---------------+--------+-------------+-----------------------------+-------+
| 0/Label       | 0      | Label       | macOS Ventura 13.3.1-22E261 | *     |
| 0/Recommended | 0      | Recommended | YES                         | *     |
| 0/Size        | 0      | Size        | 868648KiB                   | *     |
| 0/Title       | 0      | Title       | macOS Ventura 13.3.1        | *     |
| 0/Version     | 0      | Version     | 13.3.1                      | *     |
| 0/Action      | 0      | Action      | restart                     | *     |
+---------------+--------+-------------+-----------------------------+-------+

Copy link
Contributor

@directionless directionless left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would take this.

Error handling is okay -- the thing that calls this will continue on error.

I'm not sure you need to split softwareupdate.go from parse.go. And parseUpdate feels a little weird. But it's simple ebough

Comment on lines +14 to +15
//go:embed test-data/beta-update-available-noscan.txt
var beta_update_available_noscan []byte
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably not worth changing, but given the number of these I'd probably not embed, and instead make something like readTestFile(t, filename) []byte and stick that into the table definition

@directionless directionless merged commit 4cd56b1 into kolide:main Apr 10, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Table request: softwareupdate wrapper
3 participants