{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/1642","labels_url":"https://api.github.com/repos/facebook/osquery/issues/1642/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/1642/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/1642/events","html_url":"https://github.com/facebook/osquery/pull/1642","id":116018250,"number":1642,"title":"Add a `macho_signature` table","user":{"login":"andrew-d","id":1079173,"avatar_url":"https://avatars.githubusercontent.com/u/1079173?v=3","gravatar_id":"","url":"https://api.github.com/users/andrew-d","html_url":"https://github.com/andrew-d","followers_url":"https://api.github.com/users/andrew-d/followers","following_url":"https://api.github.com/users/andrew-d/following{/other_user}","gists_url":"https://api.github.com/users/andrew-d/gists{/gist_id}","starred_url":"https://api.github.com/users/andrew-d/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrew-d/subscriptions","organizations_url":"https://api.github.com/users/andrew-d/orgs","repos_url":"https://api.github.com/users/andrew-d/repos","events_url":"https://api.github.com/users/andrew-d/events{/privacy}","received_events_url":"https://api.github.com/users/andrew-d/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/facebook/osquery/labels/CLA%20Signed","name":"CLA Signed","color":"009900"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-11-10T03:31:50Z","updated_at":"2015-11-10T03:48:30Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/facebook/osquery/pulls/1642","html_url":"https://github.com/facebook/osquery/pull/1642","diff_url":"https://github.com/facebook/osquery/pull/1642.diff","patch_url":"https://github.com/facebook/osquery/pull/1642.patch"},"body":"This table allows verifying the signature of files (or bundles) on\r\nDarwin.  It also provides the signing identifier that is a part of the\r\nsignature.\r\n\r\nI've made a couple of possibly-controversial changes here, most important of which is adding a dependency on the Cocoa framework in order to get access to NSAppKitVersionNumber.  If this is something you'd rather not support, let me know and I'd be happy to strip that portion out."},"comment":{"url":"https://api.github.com/repos/facebook/osquery/issues/comments/155275879","html_url":"https://github.com/facebook/osquery/pull/1642#issuecomment-155275879","issue_url":"https://api.github.com/repos/facebook/osquery/issues/1642","id":155275879,"user":{"login":"theopolis","id":981645,"avatar_url":"https://avatars.githubusercontent.com/u/981645?v=3","gravatar_id":"","url":"https://api.github.com/users/theopolis","html_url":"https://github.com/theopolis","followers_url":"https://api.github.com/users/theopolis/followers","following_url":"https://api.github.com/users/theopolis/following{/other_user}","gists_url":"https://api.github.com/users/theopolis/gists{/gist_id}","starred_url":"https://api.github.com/users/theopolis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theopolis/subscriptions","organizations_url":"https://api.github.com/users/theopolis/orgs","repos_url":"https://api.github.com/users/theopolis/repos","events_url":"https://api.github.com/users/theopolis/events{/privacy}","received_events_url":"https://api.github.com/users/theopolis/received_events","type":"User","site_admin":false},"created_at":"2015-11-10T03:48:30Z","updated_at":"2015-11-10T03:48:30Z","body":"This is awesome, you rock! I'm not worried about adding another framework as long as it builds on 10.9. And the day we add something that doesn't build on 10.9 we can talk about how to go forward, hopefully that day is far out and the answer becomes more obvious. \r\n\r\nI am curious about the name of the table. Since this *should* work on Mach-O binaries, app bundles, and installer/pkgs should it be called `signature`? App bundles are used for a ton of things, including plugin bundles and kernel extensions, it's really neat to have 1 table to rule all of signature retrievals. A platform-agnostic signature table will also work well for Linux when reporting on signed kernel modules. "}}