pyrox.dev
1{ lib
2, cmake
3, fetchFromGitHub
4, fetchpatch
5, git
6, llvmPackages
7, nixosTests
8, overrideCC
9, perl
10, python3
11, stdenv
12, openssl_1_1
13}:
14
15let
16 buildStdenv = overrideCC stdenv llvmPackages.clangUseLLVM;
17in
18buildStdenv.mkDerivation rec {
19 pname = "osquery";
20 version = "5.5.1";
21
22 src = fetchFromGitHub {
23 owner = "osquery";
24 repo = "osquery";
25 rev = version;
26 fetchSubmodules = true;
27 sha256 = "sha256-Q6PQVnBjAjAlR725fyny+RhQFUNwxWGjLDuS5p9JKlU=";
28 };
29
30 patches = [
31 ./Remove-git-reset.patch
32 ./Use-locale.h-instead-of-removed-xlocale.h-header.patch
33 ./Remove-circular-definition-of-AUDIT_FILTER_EXCLUDE.patch
34 # For current state of compilation against glibc in the clangWithLLVM toolchain, refer to the upstream issue in https://github.com/osquery/osquery/issues/7823.
35 ./Remove-system-controls-table.patch
36
37 # osquery uses a vendored boost library that still relies on old standard types (e.g. `std::unary_function`)
38 # which have been removed as of C++17. The patch is already checked in upstream, but there have been no
39 # releases yet. Can likely be removed with versions > 5.10.2.
40 (fetchpatch {
41 name = "fix-build-on-clang-16.patch";
42 url = "https://github.com/osquery/osquery/commit/222991a15b4ae0a0fb919e4965603616536e1b0a.patch";
43 hash = "sha256-PdzEoeR1LXVri1Cd+7KMhKmDC8yZhAx3f1+9tjLJKyo=";
44 })
45 ];
46
47
48 buildInputs = [
49 llvmPackages.libunwind
50 ];
51 nativeBuildInputs = [
52 cmake
53 git
54 perl
55 python3
56 ];
57
58 postPatch = ''
59 substituteInPlace cmake/install_directives.cmake --replace "/control" "control"
60 # This is required to build libarchive with our glibc version
61 # which provides the ARC4RANDOM_BUF function
62 substituteInPlace libraries/cmake/source/libarchive/CMakeLists.txt --replace " target_compile_definitions(thirdparty_libarchive PRIVATE" " target_compile_definitions(thirdparty_libarchive PRIVATE HAVE_ARC4RANDOM_BUF"
63 # We need to override this hash because we use our own openssl 1.1 version
64 substituteInPlace libraries/cmake/formula/openssl/CMakeLists.txt --replace \
65 "d7939ce614029cdff0b6c20f0e2e5703158a489a72b2507b8bd51bf8c8fd10ca" \
66 "$(sha256sum ${openssl_1_1.src} | cut -f1 '-d ')"
67 cat libraries/cmake/formula/openssl/CMakeLists.txt
68 '';
69
70 # For explanation of these deletions, refer to the ./Use-locale.h-instead-of-removed-xlocale.h-header.patch file.
71 preConfigure = ''
72 find libraries/cmake/source -name 'config.h' -exec sed -i '/#define HAVE_XLOCALE_H 1/d' {} \;
73 '';
74
75 cmakeFlags = [
76 "-DOSQUERY_VERSION=${version}"
77 "-DOSQUERY_OPENSSL_ARCHIVE_PATH=${openssl_1_1.src}"
78 ];
79
80 postFixup = ''
81 patchelf --set-rpath "${llvmPackages.libunwind}/lib:$(patchelf --print-rpath $out/bin/osqueryd)" "$out/bin/osqueryd"
82 '';
83
84 passthru.tests.osquery = nixosTests.osquery;
85
86 meta = with lib; {
87 description = "SQL powered operating system instrumentation, monitoring, and analytics";
88 longDescription = ''
89 The system controls table is not included as it does not presently compile with glibc >= 2.32.
90 For more information, refer to https://github.com/osquery/osquery/issues/7823
91 '';
92 homepage = "https://osquery.io";
93 license = licenses.bsd3;
94 platforms = platforms.linux;
95 maintainers = with maintainers; [ znewman01 lewo ];
96 };
97}