Skip to content

Unify the vendor field of the Wazuh package for all systems #31044

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 5 commits into
base: 4.13.1
Choose a base branch
from
Open

Unify the vendor field of the Wazuh package for all systems #31044

wants to merge 5 commits into from

Conversation

jotacarma90
Copy link
Member

@jotacarma90 jotacarma90 commented Jul 23, 2025 •
edited
Loading

Description

In this PR we are going to unify the vendor field of the Wazuh package of all systems, as well as modify the way we extract it in some of them. We have also implemented a new vendor-email field, which will not be implemented further yet.

Testing

I used a basic 4.13.1 manager in a Fedora 41 VM. Created 4 packages with this PR branch here:

Connected to manager:

[root@fedora41 wazuh]# agent_control -l

Wazuh agent_control. List of available agents:
   ID: 000, Name: fedora41 (server), IP: 127.0.0.1, Active/Local
   ID: 001, Name: windows11arm, IP: any, Active
   ID: 002, Name: fedora40, IP: any, Active
   ID: 003, Name: ubuntu24, IP: any, Active
   ID: 004, Name: Maquina-virtual-de-test.local, IP: any, Active
  • Windows agent 🟢
[root@fedora41 wazuh]# sqlite3 /var/ossec/queue/db/001.db "SELECT DISTINCT vendor FROM sys_programs;"
Microsoft Corporation
.NET Foundation
Python Software Foundation

VMware, Inc.
Microsoft
The Git Development Community
Microsoft Studios
Wazuh
Google LLC
Microsoft Corporations
  • Fedora agent 🟢
[root@fedora41 wazuh]# sqlite3 /var/ossec/queue/db/002.db "SELECT DISTINCT vendor FROM sys_programs;"
Fedora Project
Wazuh
  • Ubuntu agent 🟢
[root@fedora41 wazuh]# sqlite3 /var/ossec/queue/db/003.db "SELECT DISTINCT vendor FROM sys_programs;"
Ubuntu Developers
Benjamin Drung
Stephen Kitt
Ubuntu Kernel Team
Ubuntu Core developers
Dustin Kirkland
Ubuntu Artwork Team
Ubuntu Core Developers
Michael Vogt

Steve Langasek
Thomas Ward
Scott Moser
Dimitri John Ledkov
Debian Python Team
Didier Roche
Wazuh
Utkarsh Gupta
Colin Watson
Ubuntu X-SWAT
Canonical Kernel Team
Ubuntu MOTU Developers
Chow Loong Jin
Jamie Strandboge
Matthias Klose
  • macOS agent 🟢
[root@fedora41 wazuh]# sqlite3 /var/ossec/queue/db/004.db "SELECT DISTINCT vendor FROM sys_programs;"
Apple

Tinyspeck
Wazuh
Rambo

@jotacarma90 jotacarma90 force-pushed the enhancement/30786-unify-vendor-packages branch 5 times, most recently from a977245 to 88bdb06 Compare July 24, 2025 07:44
@jotacarma90 jotacarma90 linked an issue Jul 24, 2025 that may be closed by this pull request
Unify vendor field across packages for consistent Syscollector output #30786
Open
@jotacarma90 jotacarma90 force-pushed the enhancement/30786-unify-vendor-packages branch from 88bdb06 to d06c0fd Compare July 24, 2025 11:42
@jotacarma90 jotacarma90 self-assigned this Jul 24, 2025
@jotacarma90 jotacarma90 mentioned this pull request Jul 24, 2025
Open
lchico
lchico previously approved these changes Jul 24, 2025
View reviewed changes
Copy link
Member

@lchico lchico left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! I left one minor comment but feel free to ignore it.

src/data_provider/src/packages/packageLinuxRpmParserHelperLegacy.h
@@ -40,7 +42,7 @@ namespace PackageLinuxHelper
std::string groups { fields.at(RPMFields::RPM_FIELDS_GROUPS) };
std::string version { fields.at(RPMFields::RPM_FIELDS_VERSION) };
std::string architecture { fields.at(RPMFields::RPM_FIELDS_ARCHITECTURE) };
std::string vendor { fields.at(RPMFields::RPM_FIELDS_VENDOR) };
std::string publisher { fields.at(RPMFields::RPM_FIELDS_VENDOR) };
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we change the RPM_FIELDS_VENDOR for RPM_FIELDS_PUBLISHER ?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In general both terms refer to the same field in multiple operating systems, modify the variable name only to use vendor exclusively for the name.
On other systems Publisher, Maintainer and Vendor are used for the same field.

mjcr99
mjcr99 previously approved these changes Jul 24, 2025
View reviewed changes
vikman90
vikman90 reviewed Jul 24, 2025
View reviewed changes
packages/rpms/SPECS/wazuh-agent.spec Outdated
@@ -17,7 +17,7 @@ Group: System Environment/Daemons
Source0: %{name}-%{version}.tar.gz
URL: https://www.wazuh.com/
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
Vendor: Wazuh, Inc <[email protected]>
Vendor: Wazuh <[email protected]>
Packager: Wazuh, Inc <[email protected]>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we also remove "Inc" from the Packager field?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changed Packager field to match with vendor.
Check that this change not affect Wazuh-agent package:

[root@fedora41 wazuh]# sqlite3 /var/ossec/queue/db/006.db "SELECT DISTINCT vendor FROM sys_programs;"
Fedora Project
Wazuh

packages/rpms/SPECS/wazuh-manager.spec Outdated
@@ -13,7 +13,7 @@ Group: System Environment/Daemons
Source0: %{name}-%{version}.tar.gz
URL: https://www.wazuh.com/
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
Vendor: Wazuh, Inc <[email protected]>
Vendor: Wazuh <[email protected]>
Packager: Wazuh, Inc <[email protected]>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same question here.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Check

@jotacarma90 jotacarma90 dismissed stale reviews from mjcr99 and lchico via b2026a8 July 24, 2025 15:31
vikman90
vikman90 approved these changes Jul 25, 2025
View reviewed changes
Copy link
Member

@vikman90 vikman90 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The code changes make sense. Evidences are coherent with the changes.

LGTM.

@vikman90 vikman90 added module/syscollector module/install Issue related to the installation process module/data provider Data Provider library type/enhancement New feature or request labels Jul 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vikman90 vikman90 vikman90 approved these changes

@lchico lchico lchico left review comments

@mjcr99 mjcr99 mjcr99 left review comments

Assignees

@jotacarma90 jotacarma90

Labels
module/data provider Data Provider library module/install Issue related to the installation process module/syscollector type/enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Unify vendor field across packages for consistent Syscollector output
4 participants
@jotacarma90 @vikman90 @lchico @mjcr99