{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/1032","labels_url":"https://api.github.com/repos/facebook/osquery/issues/1032/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/1032/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/1032/events","html_url":"https://github.com/facebook/osquery/issues/1032","id":70254580,"number":1032,"title":"Querying certificates on OS X seems fairly slow","user":{"login":"alex","id":772,"avatar_url":"https://avatars.githubusercontent.com/u/772?v=3","gravatar_id":"","url":"https://api.github.com/users/alex","html_url":"https://github.com/alex","followers_url":"https://api.github.com/users/alex/followers","following_url":"https://api.github.com/users/alex/following{/other_user}","gists_url":"https://api.github.com/users/alex/gists{/gist_id}","starred_url":"https://api.github.com/users/alex/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alex/subscriptions","organizations_url":"https://api.github.com/users/alex/orgs","repos_url":"https://api.github.com/users/alex/repos","events_url":"https://api.github.com/users/alex/events{/privacy}","received_events_url":"https://api.github.com/users/alex/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/facebook/osquery/labels/forum","name":"forum","color":"cc317c"},{"url":"https://api.github.com/repos/facebook/osquery/labels/os%20x","name":"os x","color":"d4c5f9"},{"url":"https://api.github.com/repos/facebook/osquery/labels/virtual%20tables","name":"virtual tables","color":"bfd4f2"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-04-22T22:48:23Z","updated_at":"2015-04-23T00:21:05Z","closed_at":null,"body":"Consistently takes over 1 seconds to fetch my local certificates:\r\n\r\n```\r\n~ $ time osqueryi \"select count(*) from certificates\"\r\n+----------+\r\n| count(*) |\r\n+----------+\r\n| 425      |\r\n+----------+\r\n        1.28 real         1.19 user         0.03 sys\r\n~ $ time osqueryi \"select count(*) from certificates\"\r\n+----------+\r\n| count(*) |\r\n+----------+\r\n| 425      |\r\n+----------+\r\n        1.26 real         1.18 user         0.03 sys\r\n~ $ time osqueryi \"select count(*) from certificates\"\r\n+----------+\r\n| count(*) |\r\n+----------+\r\n| 425      |\r\n+----------+\r\n        1.44 real         1.25 user         0.05 sys\r\n```\r\n\r\nFor comparison querying `processes`, `listening_ports`, and `homebrew_packages` all take under 50 milliseconds."},"comment":{"url":"https://api.github.com/repos/facebook/osquery/issues/comments/95373813","html_url":"https://github.com/facebook/osquery/issues/1032#issuecomment-95373813","issue_url":"https://api.github.com/repos/facebook/osquery/issues/1032","id":95373813,"user":{"login":"alex","id":772,"avatar_url":"https://avatars.githubusercontent.com/u/772?v=3","gravatar_id":"","url":"https://api.github.com/users/alex","html_url":"https://github.com/alex","followers_url":"https://api.github.com/users/alex/followers","following_url":"https://api.github.com/users/alex/following{/other_user}","gists_url":"https://api.github.com/users/alex/gists{/gist_id}","starred_url":"https://api.github.com/users/alex/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alex/subscriptions","organizations_url":"https://api.github.com/users/alex/orgs","repos_url":"https://api.github.com/users/alex/repos","events_url":"https://api.github.com/users/alex/events{/privacy}","received_events_url":"https://api.github.com/users/alex/received_events","type":"User","site_admin":false},"created_at":"2015-04-23T00:21:05Z","updated_at":"2015-04-23T00:21:05Z","body":"To be clear, the Go example uses Go's included (pure Go) X509 parser.\r\n\r\nFWIW I'm not sure if OpenSSL can parse the `.keychain` files directly, it dosen't look like they're ASN.1 or any other format I'm familiar with; my example uses the `security` tool to conver them to PEM before parsing."}}