Add dockutil table for macOS

[kitzy]

This PR adds a new table for querying dockutil version information on macOS.

Overview

The dockutil table provides information about the installed dockutil utility, which is commonly used for managing the macOS Dock programmatically.

Table Columns

• version: The installed version of dockutil
• path: The path to the dockutil binary

Implementation Details

• Checks for dockutil at /usr/local/bin/dockutil
• Returns an empty result set if dockutil is not installed
• Follows existing table patterns in the codebase
• Includes comprehensive unit tests

Usage

SELECT * FROM dockutil;

Example output:

version | path
--------|------------------------------
3.1.3   | /usr/local/bin/dockutil

Testing

All unit tests pass:

bazel test //tables/dockutil:dockutil_test

Tests cover:

• Simple version format
• Prefixed version format (dockutil-x.x.x)
• Handling when dockutil is not installed
• Error handling

[kitzy]

Additional Context

The motivation for this table is to enable Fleet policies that can detect the installed dockutil version across a macOS fleet. This allows us to monitor and enforce version requirements to keep dockutil up to date on managed devices.

Example Fleet policy to detect outdated dockutil versions:

SELECT 1 FROM dockutil WHERE version < '3.1.0';

This helps ensure all devices have the latest version of dockutil for Dock management tasks.

[Copilot]

Pull request overview

This PR adds a new macOS table for querying dockutil version information. Dockutil is a third-party utility commonly used for programmatically managing the macOS Dock.

Changes:

• Added new dockutil table with version and path columns
• Implemented version detection with support for both simple ("3.0.2") and prefixed ("dockutil-3.0.2") formats
• Returns empty result set when dockutil is not installed

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tables/dockutil/dockutil.go	Core implementation of dockutil table with version detection
tables/dockutil/dockutil_test.go	Comprehensive test suite covering various scenarios
tables/dockutil/BUILD.bazel	Bazel build configuration for the new table
main.go	Registration of dockutil table in Darwin plugin list
BUILD.bazel	Addition of dockutil dependency to main build target

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The test file imports github.com/pkg/errors (line 7 of dockutil_test.go) but this dependency is not declared in the test's deps list. Add @com_github_pkg_errors//:errors to the deps array to fix the missing dependency.

Suggested change

	"@com_github_stretchr_testify//require",
	"@com_github_stretchr_testify//require",
	"@com_github_pkg_errors//:errors",

[kitzy]

Addressed in 77878f0

[grahamgilbert]

I’ve questions about the general usefulness of this. What happens if you have dockutil installed in a different location (we certainly do at my employer)? Could this be abstracted out to a general “command line versioner” table? Perhaps one configured with a config file since I expect most people run osquery with full disk access enabled.

[kitzy]

@grahamgilbert that's actually a much better idea, because I can already see this being needed for more than just dockutil. I'll take a crack at that and see what I can come up with.