1 files changed, 97 insertions, 0 deletions
diff --git a/nixpkgs/pkgs/tools/system/osquery/default.nix b/nixpkgs/pkgs/tools/system/osquery/default.nix
new file mode 100644
index 000000000000..5138c5374103
--- /dev/null
+++ b/nixpkgs/pkgs/tools/system/osquery/default.nix
@@ -0,0 +1,97 @@
+{ lib
+, cmake
+, fetchFromGitHub
+, fetchpatch
+, git
+, llvmPackages
+, nixosTests
+, overrideCC
+, perl
+, python3
+, stdenv
+, openssl_1_1
+}:
+
+let
+  buildStdenv = overrideCC stdenv llvmPackages.clangUseLLVM;
+in
+buildStdenv.mkDerivation rec {
+  pname = "osquery";
+  version = "5.5.1";
+
+  src = fetchFromGitHub {
+    owner = "osquery";
+    repo = "osquery";
+    rev = version;
+    fetchSubmodules = true;
+    sha256 = "sha256-Q6PQVnBjAjAlR725fyny+RhQFUNwxWGjLDuS5p9JKlU=";
+  };
+
+  patches = [
+    ./Remove-git-reset.patch
+    ./Use-locale.h-instead-of-removed-xlocale.h-header.patch
+    ./Remove-circular-definition-of-AUDIT_FILTER_EXCLUDE.patch
+    # For current state of compilation against glibc in the clangWithLLVM toolchain, refer to the upstream issue in https://github.com/osquery/osquery/issues/7823.
+    ./Remove-system-controls-table.patch
+
+    # osquery uses a vendored boost library that still relies on old standard types (e.g. `std::unary_function`)
+    # which have been removed as of C++17. The patch is already checked in upstream, but there have been no
+    # releases yet. Can likely be removed with versions > 5.10.2.
+    (fetchpatch {
+      name = "fix-build-on-clang-16.patch";
+      url  = "https://github.com/osquery/osquery/commit/222991a15b4ae0a0fb919e4965603616536e1b0a.patch";
+      hash = "sha256-PdzEoeR1LXVri1Cd+7KMhKmDC8yZhAx3f1+9tjLJKyo=";
+    })
+  ];
+
+
+  buildInputs = [
+    llvmPackages.libunwind
+  ];
+  nativeBuildInputs = [
+    cmake
+    git
+    perl
+    python3
+  ];
+
+  postPatch = ''
+    substituteInPlace cmake/install_directives.cmake --replace "/control" "control"
+    # This is required to build libarchive with our glibc version
+    # which provides the ARC4RANDOM_BUF function
+    substituteInPlace libraries/cmake/source/libarchive/CMakeLists.txt --replace "  target_compile_definitions(thirdparty_libarchive PRIVATE" "  target_compile_definitions(thirdparty_libarchive PRIVATE HAVE_ARC4RANDOM_BUF"
+    # We need to override this hash because we use our own openssl 1.1 version
+    substituteInPlace libraries/cmake/formula/openssl/CMakeLists.txt --replace \
+      "d7939ce614029cdff0b6c20f0e2e5703158a489a72b2507b8bd51bf8c8fd10ca" \
+      "$(sha256sum ${openssl_1_1.src} | cut -f1 '-d ')"
+    cat libraries/cmake/formula/openssl/CMakeLists.txt
+  '';
+
+  # For explanation of these deletions, refer to the ./Use-locale.h-instead-of-removed-xlocale.h-header.patch file.
+  preConfigure = ''
+    find libraries/cmake/source -name 'config.h' -exec sed -i '/#define HAVE_XLOCALE_H 1/d' {} \;
+  '';
+
+  cmakeFlags = [
+    "-DOSQUERY_VERSION=${version}"
+    "-DOSQUERY_OPENSSL_ARCHIVE_PATH=${openssl_1_1.src}"
+  ];
+
+  postFixup = ''
+    patchelf --set-rpath "${llvmPackages.libunwind}/lib:$(patchelf --print-rpath $out/bin/osqueryd)" "$out/bin/osqueryd"
+  '';
+
+  passthru.tests.osquery = nixosTests.osquery;
+
+  meta = with lib; {
+    description = "SQL powered operating system instrumentation, monitoring, and analytics";
+    longDescription = ''
+      The system controls table is not included as it does not presently compile with glibc >= 2.32.
+      For more information, refer to https://github.com/osquery/osquery/issues/7823
+    '';
+    homepage = "https://osquery.io";
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ znewman01 lewo ];
+  };
+}