anchor.diff:  #these homebrew hashes need to be current. hashes in osquery git repo are often out of date for the tags we check out and try to build.
   #this is a problem and they are aware of it. let the magic hashes commence:
    && sed -i 's,^\(HOMEBREW_CORE=\).*,\1'941ca36839ea354031846d73ad538e1e44e673f4',' tools/provision.sh \
  - && sed -i 's,^\(LINUXBREW_CORE=\).*,\1'abc5c5782c5850f2deff1f3d463945f90f2feaac',' tools/provision.sh \
  + && sed -i 's,^\(LINUXBREW_CORE=\).*,\1'f54281a496bb7d3dd2f46b2f3067193d05f5013b',' tools/provision.sh \
    && sed -i 's,^\(HOMEBREW_BREW=\).*,\1'ac2cbd2137006ebfe84d8584ccdcb5d78c1130d9',' tools/provision.sh \
    && sed -i 's,^\(LINUXBREW_BREW=\).*,\1'20bcce2c176469cec271b46d523eef1510217436',' tools/provision.sh \
    && make sysprep \
  
positive.code: #osquery should be built first since requirements for other packages can interfere with osquery dependencies
  #to build, osquery scripts want sudo and a user to sudo with.
  #to pin to a different version change the following envirnment variable
  ENV OSQUERY_SRC_VERSION=2.6.0
  ENV OSQUERY_BUILD_USER=osquerybuilder
  ENV OSQUERY_GIT_URL=https://github.com/facebook/osquery.git
  RUN yum -y install git make python ruby sudo which
  
negative.code: 
  FROM centos:7
  
  RUN yum makecache fast && yum -y update
  
  #paths that hubble or hubble parts need in the package
  RUN mkdir -p /etc/osquery /var/log/osquery /etc/hubble/hubble.d /opt/hubble /opt/osquery /var/osquery
  