# osquery office hours 2022-08-01

YouTube Link: https://youtu.be/wq0vBxzr6OU

## Announcements and Highlights since the last meeting

* 5.9.1 was declared stable. Website not updated, seph was trying to automate it and had CLA issues

## Any Questions / Issues / PRs people want to discuss?

The intent of this section is to provide a clear time for community members to bring up _anything_.

Broad questions? Bugs? Deployment questions? Blocked PRs?

## Agenda down here

## Updating macOS Github Hosted Runner to macOS Monterey (Sharvil)

We currently use the macos-11 (Big Sur + Xcode 13.0) image on the Github hosted runner to build osquery.
We should update it to the macos-12 (Monterey + Xcode 14.0) image. This image is considered by Github as stable and has been available for a while.
This will enable us to use the newer macOS 13 APIs, there is some EndpointSecurity based work-in-progress by me that makes use of these APIs.

Note: we are NOT updating the DEPLOYMENT_TARGET. We can still continue to support the current 10.15 one. Though I think we should try and move to 11.0 as the DEPLOYMENT_TARGET.

This should be a fairly simple change, with no breakages/changes to the backwards compatibility.

In my local testing, osquery pkg built on macos 12 Monterey with the DEPLOYMENT_TARGET=10.15 runs fine on macOS 11, macOS 12, and macOS 13. The newer features will obviously only work on macOS 13.

## seph is closing old issues

It's not that they're wrong... Just that if the issues are 4 years old and untouched, they're probably not helping. Feel free to re-disagree or reopen.

## BPF vs Auditd performance

We have a couple of bpf implementations. What's in core, and then some code in experimental. The latter should be more performant. At some point Alessandro will loop back, but it's not his priority this moment.

## Apple's declarative device management

Two weeks ago, at PSU, JD was talking tio someone from Apple. It sounds like today, there's no local mechanism to see what's being send here. He was pushing Apple to have some visibility here for tools like osquery to have visibilty.

## 5.9.1 release, and automation

We declared 5.9.1 stable, and did some work to release it, but it's not on the website. This is because seph has been experimenting with [automation](https://github.com/osquery/osquery-site/pull/283). Unfortunately, the resultant [PR](https://github.com/osquery/osquery-site/pull/282) was stuck on EasyCLA -- which doesn't support excluding bots.

We discussed whether it was cleaner to simply push straight to `source` and skip the PR.

Then Zach noticed that we don't have checks required, so we can simply merge over EasyCLA.

Good enough for now!

## Look At Open CVS / Security Tickets

[List of Issues tagged with Security](https://github.com/osquery/osquery/issues?q=is%3Aopen+is%3Aissue+label%3Asecurity)

## Look at old PRs

_(If there's time, we've been trying to re-visit old PRs)_

[Reverse Sorted List of PRs](https://github.com/osquery/osquery/pulls?q=is%3Apr+is%3Aopen+sort%3Acreated-asc)

* https://github.com/osquery/osquery/pull/8037 seph says _please_