From 8712a90f7c570e712b237f2c64bfe011a7dff8db Mon Sep 17 00:00:00 2001 From: Lucas Manuel Rodriguez Date: Fri, 24 Apr 2026 15:47:22 -0300 Subject: [PATCH] Add utilities to test linux osquery changes on fleetd local TUF (#44131) Quality of life improvements when testing unmerged changes in osquery (bundled in fleetd using local TUF). ## Summary by CodeRabbit * **New Features** * Added a build target that fetches a Linux osqueryd executable for a specified pull request and architecture, validates the downloaded artifact, extracts and verifies the binary, and installs a runnable osqueryd into a user-specified output directory. The target reports clear errors when inputs are missing or when retrieval/validation fails. --- Makefile | 67 ++++++++++++++++++++++++++++++++++++++++ tools/tuf/test/README.md | 21 +++++++++++-- 2 files changed, 85 insertions(+), 3 deletions(-) diff --git a/Makefile b/Makefile index 5419c8c24a..2f7b4ba1bb 100644 --- a/Makefile +++ b/Makefile @@ -766,6 +766,73 @@ else rm -r $(TMP_DIR) endif +# Download the osqueryd Linux executable from a pull request in osquery/osquery +# and extract it into out-path. +# +# Usage: +# make osqueryd-linux pr=8844 arch=amd64 out-path=. +# make osqueryd-linux pr=8844 arch=arm64 out-path=. +osqueryd-linux: +ifndef pr + @echo "Error: pr argument is required (e.g. make osqueryd-linux pr=8844 arch=amd64 out-path=.)" + @exit 1 +endif +ifndef out-path + @echo "Error: out-path argument is required (e.g. make osqueryd-linux pr=8844 arch=amd64 out-path=.)" + @exit 1 +endif +ifeq ($(arch),amd64) + $(eval ARTIFACT_NAME := linux_unsigned_release_tgz) +else ifeq ($(arch),arm64) + $(eval ARTIFACT_NAME := linux_unsigned_release_tgz_aarch64) +else + @echo "Error: arch must be 'amd64' or 'arm64' (got '$(arch)')" + @exit 1 +endif + $(eval TMP_DIR := $(shell mktemp -d)) + @echo "Fetching $(ARTIFACT_NAME) artifact from osquery/osquery PR $(pr)..." + @PR_SHA=$$(gh pr view -R osquery/osquery $(pr) --json headRefOid -q .headRefOid) && \ + echo "PR head SHA: $$PR_SHA" && \ + RUN_IDS=$$(gh api "repos/osquery/osquery/actions/runs?head_sha=$$PR_SHA" \ + -q '[.workflow_runs[] | .id] | .[]') && \ + if [ -z "$$RUN_IDS" ]; then \ + echo "Error: no workflow runs found for PR $(pr)"; \ + rm -rf $(TMP_DIR); \ + exit 1; \ + fi && \ + DOWNLOADED=false && \ + for run_id in $$RUN_IDS; do \ + if gh run download -R osquery/osquery $$run_id -n $(ARTIFACT_NAME) -D $(TMP_DIR)/artifact 2>/dev/null; then \ + DOWNLOADED=true; \ + echo "Downloaded artifact from run $$run_id"; \ + break; \ + fi; \ + done && \ + if [ "$$DOWNLOADED" != "true" ]; then \ + echo "Error: $(ARTIFACT_NAME) artifact not found in any workflow run for PR $(pr)"; \ + rm -rf $(TMP_DIR); \ + exit 1; \ + fi + @INNER_TGZ=$$(find $(TMP_DIR)/artifact -name '*.tar.gz' -o -name '*.tgz' | head -1) && \ + if [ -z "$$INNER_TGZ" ]; then \ + echo "Error: no tarball found inside downloaded artifact"; \ + rm -rf $(TMP_DIR); \ + exit 1; \ + fi && \ + mkdir -p $(TMP_DIR)/extracted && \ + tar xf "$$INNER_TGZ" -C $(TMP_DIR)/extracted + @OSQUERYD=$$(find $(TMP_DIR)/extracted -type f -name 'osqueryd' | head -1) && \ + if [ -z "$$OSQUERYD" ]; then \ + echo "Error: osqueryd not found in extracted artifact. Contents:"; \ + find $(TMP_DIR)/extracted -type f; \ + rm -rf $(TMP_DIR); \ + exit 1; \ + fi && \ + cp "$$OSQUERYD" "$(out-path)/osqueryd" && \ + chmod +x "$(out-path)/osqueryd" && \ + echo "Extracted osqueryd to $(out-path)/osqueryd" + rm -rf $(TMP_DIR) + # Generate nudge.app.tar.gz bundle from nudge repo. # # Usage: diff --git a/tools/tuf/test/README.md b/tools/tuf/test/README.md index ff214d486b..908147d86b 100644 --- a/tools/tuf/test/README.md +++ b/tools/tuf/test/README.md @@ -135,7 +135,7 @@ go run ./orbit/tools/build/build.go ./tools/tuf/test/push_target.sh macos orbit orbit-macos $ORBIT_VERSION ``` -E.g. to add a new version of `osqueryd` for macOS: +E.g. to add a new released version of `osqueryd` for macOS: ```sh # Generate osqueryd app bundle. make osqueryd-app-tar-gz version=5.5.1 out-path=. @@ -145,7 +145,7 @@ make osqueryd-app-tar-gz version=5.5.1 out-path=. ``` NOTE: Contributors on macOS with Apple silicon ran into issues running osqueryd downloaded from GitHub. Until this issue is root caused, the workaround is to download osqueryd from [Fleet's TUF](https://updates.fleetdm.com/). -E.g. to add a custom `osqueryd` version from a osquery PR for macOS: +E.g. to add a custom `osqueryd` version from an osquery PR for macOS: ```sh # Generate osqueryd app bundle from pull request https://github.com/osquery/osquery/pull/8815. make osqueryd-app-tar-gz pr=8815 out-path=. @@ -154,7 +154,7 @@ make osqueryd-app-tar-gz pr=8815 out-path=. ./tools/tuf/test/push_target.sh macos-app osqueryd osqueryd.app.tar.gz 5.23.0 ``` -E.g. to add a custom `osqueryd` version built locally: +E.g. to add a custom `osqueryd` version built locally for macOS: ```sh # Generate osqueryd app bundle from a locally built osqueryd executable. make osqueryd-app-tar-gz osqueryd_path=/path/to/osqueryd out-path=. @@ -163,6 +163,21 @@ make osqueryd-app-tar-gz osqueryd_path=/path/to/osqueryd out-path=. ./tools/tuf/test/push_target.sh macos-app osqueryd osqueryd.app.tar.gz 5.23.0 ``` +E.g. to add a custom `osqueryd` version from an osquery PR for Linux (amd64 and arm64): +```sh +# Grab osqueryd linux amd64 executable from pull request https://github.com/osquery/osquery/pull/8844. +make osqueryd-linux pr=8844 arch=amd64 out-path=. + +# Push the osqueryd amd64 target as a new version. +./tools/tuf/test/push_target.sh linux osqueryd osqueryd 5.23.0 + +# Grab osqueryd linux arm64 executable from pull request https://github.com/osquery/osquery/pull/8844. +make osqueryd-linux pr=8844 arch=arm64 out-path=. + +# Push the osqueryd arm64 target as a new version. +./tools/tuf/test/push_target.sh linux-arm64 osqueryd osqueryd 5.23.0 +``` + E.g. to add a new version of `desktop` for macOS: ```sh source ./tools/tuf/test/load_orbit_version_vars.sh