{"action":"created","comment":{"url":"https://api.github.com/repos/facebook/osquery/pulls/comments/55778117","id":55778117,"diff_hunk":"@@ -66,17 +51,94 @@ void genCertificate(const SecCertificateRef& SecCert, QueryData& results) {\n       (cert->skid) ? genKIDProperty(cert->skid->data, cert->skid->length) : \"\";\n \n   results.push_back(r);\n-  X509_free(cert);\n+}\n+\n+void genKeychainCertificate(const SecCertificateRef& SecCert,\n+                            QueryData& results) {\n+  auto der_encoded_data = SecCertificateCopyData(SecCert);\n+  if (der_encoded_data == nullptr) {\n+    return;\n+  }\n+\n+  const unsigned char* der_bytes = CFDataGetBytePtr(der_encoded_data);\n+  auto length = CFDataGetLength(der_encoded_data);\n+  auto cert = d2i_X509(nullptr, &der_bytes, length);\n+\n+  if (cert != nullptr) {\n+    auto path = getKeychainPath((SecKeychainItemRef)SecCert);\n+    genCertificate(cert, path, results);\n+    X509_free(cert);\n+  }\n+\n   CFRelease(der_encoded_data);\n }\n \n+void genFileCertificate(const std::string& path, QueryData& results) {\n+  std::string content;\n+  auto s = readFile(path, content);\n+  if (s.ok()) {\n+    const unsigned char* bytes = (const unsigned char*)content.c_str();\n+    X509* cert = d2i_X509(nullptr, &bytes, content.size());\n+\n+    // If cert couldn't be read as DER, attempt\n+    // to read it as a PEM.\n+    if (cert == nullptr) {","path":"osquery/tables/system/darwin/certificates.mm","position":74,"original_position":74,"commit_id":"ecf839a9e0e155dba4a0b6acfb67754985612e47","original_commit_id":"ecf839a9e0e155dba4a0b6acfb67754985612e47","user":{"login":"theopolis","id":981645,"avatar_url":"https://avatars.githubusercontent.com/u/981645?v=3","gravatar_id":"","url":"https://api.github.com/users/theopolis","html_url":"https://github.com/theopolis","followers_url":"https://api.github.com/users/theopolis/followers","following_url":"https://api.github.com/users/theopolis/following{/other_user}","gists_url":"https://api.github.com/users/theopolis/gists{/gist_id}","starred_url":"https://api.github.com/users/theopolis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theopolis/subscriptions","organizations_url":"https://api.github.com/users/theopolis/orgs","repos_url":"https://api.github.com/users/theopolis/repos","events_url":"https://api.github.com/users/theopolis/events{/privacy}","received_events_url":"https://api.github.com/users/theopolis/received_events","type":"User","site_admin":false},"body":"What happens if `cert` **could** be read as DER? Do you want to do anything with it? In any case, it should be `X509_free`d, right?","created_at":"2016-03-11T01:25:42Z","updated_at":"2016-03-11T01:25:42Z","html_url":"https://github.com/facebook/osquery/pull/1914#discussion_r55778117","pull_request_url":"https://api.github.com/repos/facebook/osquery/pulls/1914","_links":{"self":{"href":"https://api.github.com/repos/facebook/osquery/pulls/comments/55778117"},"html":{"href":"https://github.com/facebook/osquery/pull/1914#discussion_r55778117"},"pull_request":{"href":"https://api.github.com/repos/facebook/osquery/pulls/1914"}}},"pull_request":{"url":"https://api.github.com/repos/facebook/osquery/pulls/1914","id":62312115,"html_url":"https://github.com/facebook/osquery/pull/1914","diff_url":"https://github.com/facebook/osquery/pull/1914.diff","patch_url":"https://github.com/facebook/osquery/pull/1914.patch","issue_url":"https://api.github.com/repos/facebook/osquery/issues/1914","number":1914,"state":"open","locked":false,"title":"Darwin: Allow certificates table to read DER/PEM files","user":{"login":"russellhancox","id":69123,"avatar_url":"https://avatars.githubusercontent.com/u/69123?v=3","gravatar_id":"","url":"https://api.github.com/users/russellhancox","html_url":"https://github.com/russellhancox","followers_url":"https://api.github.com/users/russellhancox/followers","following_url":"https://api.github.com/users/russellhancox/following{/other_user}","gists_url":"https://api.github.com/users/russellhancox/gists{/gist_id}","starred_url":"https://api.github.com/users/russellhancox/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/russellhancox/subscriptions","organizations_url":"https://api.github.com/users/russellhancox/orgs","repos_url":"https://api.github.com/users/russellhancox/repos","events_url":"https://api.github.com/users/russellhancox/events{/privacy}","received_events_url":"https://api.github.com/users/russellhancox/received_events","type":"User","site_admin":false},"body":"","created_at":"2016-03-09T23:07:23Z","updated_at":"2016-03-11T01:25:42Z","closed_at":null,"merged_at":null,"merge_commit_sha":"3ae414ab36ee543d8323c84a655ac410c0e174ef","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/facebook/osquery/pulls/1914/commits","review_comments_url":"https://api.github.com/repos/facebook/osquery/pulls/1914/comments","review_comment_url":"https://api.github.com/repos/facebook/osquery/pulls/comments{/number}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/1914/comments","statuses_url":"https://api.github.com/repos/facebook/osquery/statuses/ecf839a9e0e155dba4a0b6acfb67754985612e47","head":{"label":"russellhancox:certificate-files","ref":"certificate-files","sha":"ecf839a9e0e155dba4a0b6acfb67754985612e47","user":{"login":"russellhancox","id":69123,"avatar_url":"https://avatars.githubusercontent.com/u/69123?v=3","gravatar_id":"","url":"https://api.github.com/users/russellhancox","html_url":"https://github.com/russellhancox","followers_url":"https://api.github.com/users/russellhancox/followers","following_url":"https://api.github.com/users/russellhancox/following{/other_user}","gists_url":"https://api.github.com/users/russellhancox/gists{/gist_id}","starred_url":"https://api.github.com/users/russellhancox/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/russellhancox/subscriptions","organizations_url":"https://api.github.com/users/russellhancox/orgs","repos_url":"https://api.github.com/users/russellhancox/repos","events_url":"https://api.github.com/users/russellhancox/events{/privacy}","received_events_url":"https://api.github.com/users/russellhancox/received_events","type":"User","site_admin":false},"repo":{"id":52816361,"name":"osquery","full_name":"russellhancox/osquery","owner":{"login":"russellhancox","id":69123,"avatar_url":"https://avatars.githubusercontent.com/u/69123?v=3","gravatar_id":"","url":"https://api.github.com/users/russellhancox","html_url":"https://github.com/russellhancox","followers_url":"https://api.github.com/users/russellhancox/followers","following_url":"https://api.github.com/users/russellhancox/following{/other_user}","gists_url":"https://api.github.com/users/russellhancox/gists{/gist_id}","starred_url":"https://api.github.com/users/russellhancox/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/russellhancox/subscriptions","organizations_url":"https://api.github.com/users/russellhancox/orgs","repos_url":"https://api.github.com/users/russellhancox/repos","events_url":"https://api.github.com/users/russellhancox/events{/privacy}","received_events_url":"https://api.github.com/users/russellhancox/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/russellhancox/osquery","description":"SQL powered operating system instrumentation, monitoring, and analytics.","fork":true,"url":"https://api.github.com/repos/russellhancox/osquery","forks_url":"https://api.github.com/repos/russellhancox/osquery/forks","keys_url":"https://api.github.com/repos/russellhancox/osquery/keys{/key_id}","collaborators_url":"https://api.github.com/repos/russellhancox/osquery/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/russellhancox/osquery/teams","hooks_url":"https://api.github.com/repos/russellhancox/osquery/hooks","issue_events_url":"https://api.github.com/repos/russellhancox/osquery/issues/events{/number}","events_url":"https://api.github.com/repos/russellhancox/osquery/events","assignees_url":"https://api.github.com/repos/russellhancox/osquery/assignees{/user}","branches_url":"https://api.github.com/repos/russellhancox/osquery/branches{/branch}","tags_url":"https://api.github.com/repos/russellhancox/osquery/tags","blobs_url":"https://api.github.com/repos/russellhancox/osquery/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/russellhancox/osquery/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/russellhancox/osquery/git/refs{/sha}","trees_url":"https://api.github.com/repos/russellhancox/osquery/git/trees{/sha}","statuses_url":"https://api.github.com/repos/russellhancox/osquery/statuses/{sha}","languages_url":"https://api.github.com/repos/russellhancox/osquery/languages","stargazers_url":"https://api.github.com/repos/russellhancox/osquery/stargazers","contributors_url":"https://api.github.com/repos/russellhancox/osquery/contributors","subscribers_url":"https://api.github.com/repos/russellhancox/osquery/subscribers","subscription_url":"https://api.github.com/repos/russellhancox/osquery/subscription","commits_url":"https://api.github.com/repos/russellhancox/osquery/commits{/sha}","git_commits_url":"https://api.github.com/repos/russellhancox/osquery/git/commits{/sha}","comments_url":"https://api.github.com/repos/russellhancox/osquery/comments{/number}","issue_comment_url":"https://api.github.com/repos/russellhancox/osquery/issues/comments{/number}","contents_url":"https://api.github.com/repos/russellhancox/osquery/contents/{+path}","compare_url":"https://api.github.com/repos/russellhancox/osquery/compare/{base}...{head}","merges_url":"https://api.github.com/repos/russellhancox/osquery/merges","archive_url":"https://api.github.com/repos/russellhancox/osquery/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/russellhancox/osquery/downloads","issues_url":"https://api.github.com/repos/russellhancox/osquery/issues{/number}","pulls_url":"https://api.github.com/repos/russellhancox/osquery/pulls{/number}","milestones_url":"https://api.github.com/repos/russellhancox/osquery/milestones{/number}","notifications_url":"https://api.github.com/repos/russellhancox/osquery/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/russellhancox/osquery/labels{/name}","releases_url":"https://api.github.com/repos/russellhancox/osquery/releases{/id}","deployments_url":"https://api.github.com/repos/russellhancox/osquery/deployments","created_at":"2016-02-29T19:12:56Z","updated_at":"2016-02-29T19:12:57Z","pushed_at":"2016-03-10T03:04:07Z","git_url":"git://github.com/russellhancox/osquery.git","ssh_url":"git@github.com:russellhancox/osquery.git","clone_url":"https://github.com/russellhancox/osquery.git","svn_url":"https://github.com/russellhancox/osquery","homepage":"https://osquery.io","size":7382,"stargazers_count":0,"watchers_count":0,"language":"C++","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"facebook:master","ref":"master","sha":"57db798a110230910d1ee19c8d1f30273ed4f2e0","user":{"login":"facebook","id":69631,"avatar_url":"https://avatars.githubusercontent.com/u/69631?v=3","gravatar_id":"","url":"https://api.github.com/users/facebook","html_url":"https://github.com/facebook","followers_url":"https://api.github.com/users/facebook/followers","following_url":"https://api.github.com/users/facebook/following{/other_user}","gists_url":"https://api.github.com/users/facebook/gists{/gist_id}","starred_url":"https://api.github.com/users/facebook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/facebook/subscriptions","organizations_url":"https://api.github.com/users/facebook/orgs","repos_url":"https://api.github.com/users/facebook/repos","events_url":"https://api.github.com/users/facebook/events{/privacy}","received_events_url":"https://api.github.com/users/facebook/received_events","type":"Organization","site_admin":false},"repo":{"id":22394357,"name":"osquery","full_name":"facebook/osquery","owner":{"login":"facebook","id":69631,"avatar_url":"https://avatars.githubusercontent.com/u/69631?v=3","gravatar_id":"","url":"https://api.github.com/users/facebook","html_url":"https://github.com/facebook","followers_url":"https://api.github.com/users/facebook/followers","following_url":"https://api.github.com/users/facebook/following{/other_user}","gists_url":"https://api.github.com/users/facebook/gists{/gist_id}","starred_url":"https://api.github.com/users/facebook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/facebook/subscriptions","organizations_url":"https://api.github.com/users/facebook/orgs","repos_url":"https://api.github.com/users/facebook/repos","events_url":"https://api.github.com/users/facebook/events{/privacy}","received_events_url":"https://api.github.com/users/facebook/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/facebook/osquery","description":"SQL powered operating system instrumentation, monitoring, and analytics.","fork":false,"url":"https://api.github.com/repos/facebook/osquery","forks_url":"https://api.github.com/repos/facebook/osquery/forks","keys_url":"https://api.github.com/repos/facebook/osquery/keys{/key_id}","collaborators_url":"https://api.github.com/repos/facebook/osquery/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/facebook/osquery/teams","hooks_url":"https://api.github.com/repos/facebook/osquery/hooks","issue_events_url":"https://api.github.com/repos/facebook/osquery/issues/events{/number}","events_url":"https://api.github.com/repos/facebook/osquery/events","assignees_url":"https://api.github.com/repos/facebook/osquery/assignees{/user}","branches_url":"https://api.github.com/repos/facebook/osquery/branches{/branch}","tags_url":"https://api.github.com/repos/facebook/osquery/tags","blobs_url":"https://api.github.com/repos/facebook/osquery/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/facebook/osquery/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/facebook/osquery/git/refs{/sha}","trees_url":"https://api.github.com/repos/facebook/osquery/git/trees{/sha}","statuses_url":"https://api.github.com/repos/facebook/osquery/statuses/{sha}","languages_url":"https://api.github.com/repos/facebook/osquery/languages","stargazers_url":"https://api.github.com/repos/facebook/osquery/stargazers","contributors_url":"https://api.github.com/repos/facebook/osquery/contributors","subscribers_url":"https://api.github.com/repos/facebook/osquery/subscribers","subscription_url":"https://api.github.com/repos/facebook/osquery/subscription","commits_url":"https://api.github.com/repos/facebook/osquery/commits{/sha}","git_commits_url":"https://api.github.com/repos/facebook/osquery/git/commits{/sha}","comments_url":"https://api.github.com/repos/facebook/osquery/comments{/number}","issue_comment_url":"https://api.github.com/repos/facebook/osquery/issues/comments{/number}","contents_url":"https://api.github.com/repos/facebook/osquery/contents/{+path}","compare_url":"https://api.github.com/repos/facebook/osquery/compare/{base}...{head}","merges_url":"https://api.github.com/repos/facebook/osquery/merges","archive_url":"https://api.github.com/repos/facebook/osquery/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/facebook/osquery/downloads","issues_url":"https://api.github.com/repos/facebook/osquery/issues{/number}","pulls_url":"https://api.github.com/repos/facebook/osquery/pulls{/number}","milestones_url":"https://api.github.com/repos/facebook/osquery/milestones{/number}","notifications_url":"https://api.github.com/repos/facebook/osquery/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/facebook/osquery/labels{/name}","releases_url":"https://api.github.com/repos/facebook/osquery/releases{/id}","deployments_url":"https://api.github.com/repos/facebook/osquery/deployments","created_at":"2014-07-29T20:27:33Z","updated_at":"2016-03-10T09:12:02Z","pushed_at":"2016-03-10T22:13:40Z","git_url":"git://github.com/facebook/osquery.git","ssh_url":"git@github.com:facebook/osquery.git","clone_url":"https://github.com/facebook/osquery.git","svn_url":"https://github.com/facebook/osquery","homepage":"https://osquery.io","size":10638,"stargazers_count":5868,"watchers_count":5868,"language":"C++","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":580,"mirror_url":null,"open_issues_count":27,"forks":580,"open_issues":27,"watchers":5868,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/facebook/osquery/pulls/1914"},"html":{"href":"https://github.com/facebook/osquery/pull/1914"},"issue":{"href":"https://api.github.com/repos/facebook/osquery/issues/1914"},"comments":{"href":"https://api.github.com/repos/facebook/osquery/issues/1914/comments"},"review_comments":{"href":"https://api.github.com/repos/facebook/osquery/pulls/1914/comments"},"review_comment":{"href":"https://api.github.com/repos/facebook/osquery/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/facebook/osquery/pulls/1914/commits"},"statuses":{"href":"https://api.github.com/repos/facebook/osquery/statuses/ecf839a9e0e155dba4a0b6acfb67754985612e47"}}}}