guest-agent VS omi

GCE's counterpart doesn't seem to have a public endpoint and its functionality seems make sense: https://github.com/GoogleCloudPlatform/guest-agent/tree/main...

I have to say the problem is not oss, not agents, but Microsoft.

Maybe Microsoft will end up doing the latter: given their other moves with trying to shoehorn their ideas into Linux, I wouldn't be surprised if they go that way. But as it stands now, this particular tool does nothing but add automation-hostile patterns (having to accept a EULA for install, yay!), unnecessary kernel modules, and obnoxious log data to a given box.

But you should be able to update it using latest OMI release, without waiting for a SCOM agent update : https://github.com/microsoft/omi/releases/tag/v1.6.8-1

I read all of this: https://github.com/microsoft/omi/blob/master/README.md

still don't understand what it does

Ironically, the OMI 'open source' package is Microsoft's. The only recent commit was for "Enhanced security" a month ago:

https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb9...

It's used there: https://github.com/microsoft/omi/blob/e4d72481fa2f805148c9c8...

Also note that neither EncryptData nor DecryptData have any way of passing a key in their API. So it's very unlikely that these implementations could be conditionally compiled in place of a real implementation (but they're the only definition of these functions in the repository anyway).

It used to have actual Windows specific crypto code[1] which has been removed in the linked commit.

I assume this has been ported from Windows and later never implemented the ripped out components. That said, I don't know the windows API so apart from confirming that they exist in Windows docs[2] I can't assess how valid their usage was.

[1] - https://github.com/microsoft/omi/commit/edbe231042173018c529...

[2] - https://docs.microsoft.com/en-us/windows/win32/api/dpapi/nf-...

Specifically- it appears to be mostly C99, lots of macros, lots of ugly buffer manipulation. But it's tooled for PREFast so you know it's secure! (https://github.com/microsoft/omi/blob/4ce2cf1cb0aa656b8eb934...) (j/k... I haven't seen that in ages). Guessing a port of MS's internal WMI codebase?

This codebase just smells of rot all over.