Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 18 Packages Projects Releases Wiki Activity

Add utilities to test linux osquery changes on fleetd local TUF (#44131)

Browse Source 
Quality of life improvements when testing unmerged changes in osquery
(bundled in fleetd using local TUF).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a build target that fetches a Linux osqueryd executable for a
specified pull request and architecture, validates the downloaded
artifact, extracts and verifies the binary, and installs a runnable
osqueryd into a user-specified output directory. The target reports
clear errors when inputs are missing or when retrieval/validation fails.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This commit is contained in:
Lucas Manuel Rodriguez
2026-04-24 15:47:22 -03:00
committed by GitHub
parent 5b8253173e
commit 8712a90f7c
2 changed files with 85 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+67
View File
@@ -766,6 +766,73 @@ else
rm -r $(TMP_DIR)
endif
# Download the osqueryd Linux executable from a pull request in osquery/osquery
# and extract it into out-path.
#
# Usage:
# make osqueryd-linux pr=8844 arch=amd64 out-path=.
# make osqueryd-linux pr=8844 arch=arm64 out-path=.
osqueryd-linux:
ifndef pr
@echo "Error: pr argument is required (e.g. make osqueryd-linux pr=8844 arch=amd64 out-path=.)"
@exit 1
endif
ifndef out-path
@echo "Error: out-path argument is required (e.g. make osqueryd-linux pr=8844 arch=amd64 out-path=.)"
@exit 1
endif
ifeq ($(arch),amd64)
$(eval ARTIFACT_NAME := linux_unsigned_release_tgz)
else ifeq ($(arch),arm64)
$(eval ARTIFACT_NAME := linux_unsigned_release_tgz_aarch64)
else
@echo "Error: arch must be 'amd64' or 'arm64' (got '$(arch)')"
@exit 1
endif
$(eval TMP_DIR := $(shell mktemp -d))
@echo "Fetching $(ARTIFACT_NAME) artifact from osquery/osquery PR $(pr)..."
@PR_SHA=$$(gh pr view -R osquery/osquery $(pr) --json headRefOid -q .headRefOid) && \
echo "PR head SHA: $$PR_SHA" && \
RUN_IDS=$$(gh api "repos/osquery/osquery/actions/runs?head_sha=$$PR_SHA" \
-q '[.workflow_runs[] | .id] | .[]') && \
if [ -z "$$RUN_IDS" ]; then \
echo "Error: no workflow runs found for PR $(pr)"; \
rm -rf $(TMP_DIR); \
exit 1; \
fi && \
DOWNLOADED=false && \
for run_id in $$RUN_IDS; do \
if gh run download -R osquery/osquery $$run_id -n $(ARTIFACT_NAME) -D $(TMP_DIR)/artifact 2>/dev/null; then \
DOWNLOADED=true; \
echo "Downloaded artifact from run $$run_id"; \
break; \
fi; \
done && \
if [ "$$DOWNLOADED" != "true" ]; then \
echo "Error: $(ARTIFACT_NAME) artifact not found in any workflow run for PR $(pr)"; \
rm -rf $(TMP_DIR); \
exit 1; \
fi
@INNER_TGZ=$$(find $(TMP_DIR)/artifact -name '*.tar.gz' -o -name '*.tgz' | head -1) && \
if [ -z "$$INNER_TGZ" ]; then \
echo "Error: no tarball found inside downloaded artifact"; \
rm -rf $(TMP_DIR); \
exit 1; \
fi && \
mkdir -p $(TMP_DIR)/extracted && \
tar xf "$$INNER_TGZ" -C $(TMP_DIR)/extracted
@OSQUERYD=$$(find $(TMP_DIR)/extracted -type f -name 'osqueryd' | head -1) && \
if [ -z "$$OSQUERYD" ]; then \
echo "Error: osqueryd not found in extracted artifact. Contents:"; \
find $(TMP_DIR)/extracted -type f; \
rm -rf $(TMP_DIR); \
exit 1; \
fi && \
cp "$$OSQUERYD" "$(out-path)/osqueryd" && \
chmod +x "$(out-path)/osqueryd" && \
echo "Extracted osqueryd to $(out-path)/osqueryd"
rm -rf $(TMP_DIR)
# Generate nudge.app.tar.gz bundle from nudge repo.
#
# Usage:
tools/tuf/test/README.md
+18 -3
View File
@@ -135,7 +135,7 @@ go run ./orbit/tools/build/build.go
./tools/tuf/test/push_target.sh macos orbit orbit-macos $ORBIT_VERSION
```
E.g. to add a new version of `osqueryd` for macOS:
E.g. to add a new released version of `osqueryd` for macOS:
```sh
# Generate osqueryd app bundle.
make osqueryd-app-tar-gz version=5.5.1 out-path=.
@@ -145,7 +145,7 @@ make osqueryd-app-tar-gz version=5.5.1 out-path=.
```
NOTE: Contributors on macOS with Apple silicon ran into issues running osqueryd downloaded from GitHub. Until this issue is root caused, the workaround is to download osqueryd from [Fleet's TUF](https://updates.fleetdm.com/).
E.g. to add a custom `osqueryd` version from a osquery PR for macOS:
E.g. to add a custom `osqueryd` version from an osquery PR for macOS:
```sh
# Generate osqueryd app bundle from pull request https://github.com/osquery/osquery/pull/8815.
make osqueryd-app-tar-gz pr=8815 out-path=.
@@ -154,7 +154,7 @@ make osqueryd-app-tar-gz pr=8815 out-path=.
./tools/tuf/test/push_target.sh macos-app osqueryd osqueryd.app.tar.gz 5.23.0
```
E.g. to add a custom `osqueryd` version built locally:
E.g. to add a custom `osqueryd` version built locally for macOS:
```sh
# Generate osqueryd app bundle from a locally built osqueryd executable.
make osqueryd-app-tar-gz osqueryd_path=/path/to/osqueryd out-path=.
@@ -163,6 +163,21 @@ make osqueryd-app-tar-gz osqueryd_path=/path/to/osqueryd out-path=.
./tools/tuf/test/push_target.sh macos-app osqueryd osqueryd.app.tar.gz 5.23.0
```
E.g. to add a custom `osqueryd` version from an osquery PR for Linux (amd64 and arm64):
```sh
# Grab osqueryd linux amd64 executable from pull request https://github.com/osquery/osquery/pull/8844.
make osqueryd-linux pr=8844 arch=amd64 out-path=.
# Push the osqueryd amd64 target as a new version.
./tools/tuf/test/push_target.sh linux osqueryd osqueryd 5.23.0
# Grab osqueryd linux arm64 executable from pull request https://github.com/osquery/osquery/pull/8844.
make osqueryd-linux pr=8844 arch=arm64 out-path=.
# Push the osqueryd arm64 target as a new version.
./tools/tuf/test/push_target.sh linux-arm64 osqueryd osqueryd 5.23.0
```
E.g. to add a new version of `desktop` for macOS:
```sh
source ./tools/tuf/test/load_orbit_version_vars.sh