{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/1032","labels_url":"https://api.github.com/repos/facebook/osquery/issues/1032/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/1032/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/1032/events","html_url":"https://github.com/facebook/osquery/issues/1032","id":70254580,"number":1032,"title":"Querying certificates on OS X seems fairly slow","user":{"login":"alex","id":772,"avatar_url":"https://avatars.githubusercontent.com/u/772?v=3","gravatar_id":"","url":"https://api.github.com/users/alex","html_url":"https://github.com/alex","followers_url":"https://api.github.com/users/alex/followers","following_url":"https://api.github.com/users/alex/following{/other_user}","gists_url":"https://api.github.com/users/alex/gists{/gist_id}","starred_url":"https://api.github.com/users/alex/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alex/subscriptions","organizations_url":"https://api.github.com/users/alex/orgs","repos_url":"https://api.github.com/users/alex/repos","events_url":"https://api.github.com/users/alex/events{/privacy}","received_events_url":"https://api.github.com/users/alex/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/facebook/osquery/labels/backlog","name":"backlog","color":"f7c6c7"},{"url":"https://api.github.com/repos/facebook/osquery/labels/forum","name":"forum","color":"cc317c"},{"url":"https://api.github.com/repos/facebook/osquery/labels/os%20x","name":"os x","color":"d4c5f9"},{"url":"https://api.github.com/repos/facebook/osquery/labels/virtual%20tables","name":"virtual tables","color":"bfd4f2"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2015-04-22T22:48:23Z","updated_at":"2015-06-22T16:08:20Z","closed_at":"2015-06-21T15:28:57Z","body":"Consistently takes over 1 seconds to fetch my local certificates:\r\n\r\n```\r\n~ $ time osqueryi \"select count(*) from certificates\"\r\n+----------+\r\n| count(*) |\r\n+----------+\r\n| 425      |\r\n+----------+\r\n        1.28 real         1.19 user         0.03 sys\r\n~ $ time osqueryi \"select count(*) from certificates\"\r\n+----------+\r\n| count(*) |\r\n+----------+\r\n| 425      |\r\n+----------+\r\n        1.26 real         1.18 user         0.03 sys\r\n~ $ time osqueryi \"select count(*) from certificates\"\r\n+----------+\r\n| count(*) |\r\n+----------+\r\n| 425      |\r\n+----------+\r\n        1.44 real         1.25 user         0.05 sys\r\n```\r\n\r\nFor comparison querying `processes`, `listening_ports`, and `homebrew_packages` all take under 50 milliseconds."},"comment":{"url":"https://api.github.com/repos/facebook/osquery/issues/comments/114166051","html_url":"https://github.com/facebook/osquery/issues/1032#issuecomment-114166051","issue_url":"https://api.github.com/repos/facebook/osquery/issues/1032","id":114166051,"user":{"login":"theopolis","id":981645,"avatar_url":"https://avatars.githubusercontent.com/u/981645?v=3","gravatar_id":"","url":"https://api.github.com/users/theopolis","html_url":"https://github.com/theopolis","followers_url":"https://api.github.com/users/theopolis/followers","following_url":"https://api.github.com/users/theopolis/following{/other_user}","gists_url":"https://api.github.com/users/theopolis/gists{/gist_id}","starred_url":"https://api.github.com/users/theopolis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theopolis/subscriptions","organizations_url":"https://api.github.com/users/theopolis/orgs","repos_url":"https://api.github.com/users/theopolis/repos","events_url":"https://api.github.com/users/theopolis/events{/privacy}","received_events_url":"https://api.github.com/users/theopolis/received_events","type":"User","site_admin":false},"created_at":"2015-06-22T16:08:20Z","updated_at":"2015-06-22T16:08:20Z","body":"This does need some attention soon. \r\n\r\n- [ ] Confirm latency is introduced by x509 parsing\r\n- [ ] Confirm removal of SecurityFoundation-induced memory leak in parsing ASN1 by using a non-Apple ASN1/x509 parser (essentially revisit and confirm `SecCertificateCopyValues` is the offending call).\r\n- [ ] Identify c/c++ x509 parser, perhaps openssl since we already use/link.\r\n- [ ] Profit "}}