osquery / osquery/osquery

macOS app bundle is not correctly relocatable

Open
#7,900 3 comments 5 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug macOS packaging
Dominant language
C++
Stars
23.6k
Forks
2.6k
Avg merge
6d 7h
Merged PRs (30d)
14

Description

Bug report

I've installed osquery freshly on my mac. But the symlinks point to non existent file. If it helps, there was Kolide installed before, but its already have been uninstalled.

What operating system and version are you using?

macOS 13.1

What version of osquery are you using?

5.6.0

What steps did you take to reproduce the issue?

Installed from commandline for verbosity, followed uninstall instructions many times.

$  Downloads sudo installer -pkg osquery-5.6.0.pkg -target / -verboseR
installer: Package name is osquery-5.6.0
installer: Installing at base path /
installer:PHASE:Preparing for installation…
installer:PHASE:Preparing the disk…
installer:PHASE:Preparing osquery-5.6.0…
installer:PHASE:Waiting for other installations to complete…
installer:PHASE:Configuring the installation…
installer:STATUS:
installer:%25.974779
installer:PHASE:Writing files…
installer:PHASE:Validating packages…
installer:%97.750000
installer:STATUS:
installer:PHASE:Finishing the Installation…
installer:STATUS:
installer:%100.000000
installer:PHASE:The software was successfully installed.
installer: The install was successful.
What did you expect to see?

A valid osquery installation

What did you see instead?

Non existent osquery.app, therefore symlinks not valid.

$  Downloads ls -alh /opt/osquery/lib
total 0
drwxr-xr-x  2 root  wheel    64B Dec 28 23:09 .
drwxr-xr-x  3 root  wheel    96B Dec 28 23:09 ..

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by inspecting the osquery-5.6.0.pkg installation layout and the /opt/osquery/lib directory shown in the report, then trace how the macOS app bundle and its symlinks are created. Reproduce the command-line installation on macOS 13.1 and verify that osquery.app exists and all installed symlinks resolve to valid files.

Written by the indexing model from the issue text.

Assessment

Tech stack
macos
Domain
operating-systems, release
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.