osquery-go
osquery-go copied to clipboard
osquery
Support for column options
WIP
Support column options.
See https://github.com/osquery/osquery/pull/6006
Reworked everything to use functional arguments. I don't love the names, I used IsText(), because TextColumn() is taken by the existing, now deprecated, helper
Not convinced I like where this went. IsFoo reads weird as an argument, vs AsFoo, but since column type is required if feels like a mis-fit
Working with those values, I started testing them using booleans. https://github.com/kolide/osquery-go/pull/78 is a different approach
+1 I like this as an alt. to map[string]interface{} #79 however this is still not granular enough since types in the Database schemas are for ex. limited to INTEGER or BIGINT this doesn't explain if it's an uint64 or int64 one example is the Users schema it has unsigned integers vs. signed integers. This would need to be expressed to be able to handle these type conversions properly.
My main use-case for #79 was using protobuf as a transport for osquery info. this req. granular types. Cur. I template the protobuf schemas from the database schemas however that is also limited since they don't incl. granular type info so you need to handle these exceptions manually osquery-protobuf.
