Hi,

At the moment libsinsp/*.h are shipped under /usr/include/falcosecurity/:
$ apt-file search libsinsp
...
libfalcosecurity0-dev:
/usr/include/falcosecurity/libsinsp/async/async_key_value_source.h
...

OTOH the libraries are shipped at the top level lib dir:
libfalcosecurity0-dev: /usr/lib/x86_64-linux-gnu/libsinsp.so
libfalcosecurity0-dev: /usr/lib/x86_64-linux-gnu/pkgconfig/libsinsp.pc
libfalcosecurity0t64: /usr/lib/x86_64-linux-gnu/libsinsp.so.0
libfalcosecurity0t64: /usr/lib/x86_64-linux-gnu/libsinsp.so.0.15.1

I'm preparing the wireshark source package to ship stratoshark, too,
and I need to add -I/usr/include/falcosecurity to the build because
the libsinsp headers are not at the standard location.

Cheers,
Balint

Hi. I'm looking at this now.

I think I would like to leave the headers where they are because:

- This is how upstream does it. This packages does have patches, but
  they're all necessary to make things work; this doesn't feel necessary

- pkg-config files exist, so you don't have to know where the headers
  live. You can gcc -I`pkg-config --cflags libscap` and/or libsinsp. Or
  --cflags-only-I.

Is it a problem for you to use pkg-config?

Thanks