macOS 15 `alf` support by lucasmrod · Pull Request #8428 · osquery/osquery

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The better alternative is to export the common logic needed from the tables in utility functions, instead of using SQL and the tables.
In some cases it's a matter of performance, in other it's a matter of unnecessary (or even problematic) dependencies among tables or other parts of codes.

The worse offender is the core depending on tables. It's a dependency loop and affects that necessity we have to include all symbols from archive files when linking, even if actually unused, which in turn causes test binaries to be unnecessarily big, slowing down compilation and hitting disk limits.