search

chainguard-dev / malcontent

detect malicious program behaviors
Apache License 2.0
407 stars 26 forks source link

Use new samples repo for tests; keep data separate and update path references #431

Closed egibs closed 1 month ago

egibs commented 1 month ago

This PR migrates to the new repo-based sample pattern. The main changes are the cloning of the bincapz-samples repository and separating the non-sample content in a new test_data directory.

The contents of said directory are copied to the samples directory after the repository has been cloned and then the usual test can be run. Aside from that, the only changes involved path fixes for the tests and the sample data refresh script.

This can merge after https://github.com/chainguard-dev/bincapz-samples/pull/2 since I have the updated bincapz archive name in the Makefile already.

egibs commented 1 month ago

The tests are working, but https://github.com/chainguard-dev/bincapz-samples/pull/3 will need to merge:

  --- FAIL: TestSimple/python/2024.yocolor/__init__.py (0.00s)
        samples_test.go:156: scan failed: find files: lstat python/2024.yocolor/__init__.py: no such file or directory
tstromberg commented 1 month ago 
   --- FAIL: TestSimple/linux/2023.Kinsing/install.sh (0.02s)
        samples_test.go:165: Simple output mismatch: (-want +got):
              (
                """
                ... // 5 identical lines
                3P/threat_hunting/xmrig
                admin/logs/syslog
            -   admin/pip_install
            +   admin/package/install
                combo/backdoor/iptables
                combo/backdoor/kill_rm
                ... // 65 identical lines
                """
              )

This just means the testdata needs a refresh after the yocolor PR.