search

osquery / osquery-go

Go bindings for osquery
MIT License
386 stars 78 forks source link

Support for column options #77

Open directionless opened 4 years ago

directionless commented 4 years ago

WIP

Support column options.

See https://github.com/osquery/osquery/pull/6006

directionless commented 4 years ago

Reworked everything to use functional arguments. I don't love the names, I used IsText(), because TextColumn() is taken by the existing, now deprecated, helper

directionless commented 4 years ago

Not convinced I like where this went. IsFoo reads weird as an argument, vs AsFoo, but since column type is required if feels like a mis-fit

directionless commented 4 years ago

Working with those values, I started testing them using booleans. https://github.com/kolide/osquery-go/pull/78 is a different approach

ake-persson commented 4 years ago

+1 I like this as an alt. to map[string]interface{} #79 however this is still not granular enough since types in the Database schemas are for ex. limited to INTEGER or BIGINT this doesn't explain if it's an uint64 or int64 one example is the Users schema it has unsigned integers vs. signed integers. This would need to be expressed to be able to handle these type conversions properly.

My main use-case for #79 was using protobuf as a transport for osquery info. this req. granular types. Cur. I template the protobuf schemas from the database schemas however that is also limited since they don't incl. granular type info so you need to handle these exceptions manually osquery-protobuf.