Installer script fixes

[ChrisThibodeaux]

Couple minor fixes to cape2.sh and yara_installer.sh:

• Fix Suricata text replacement for file-store not correctly setting enabled: yes
• Fix yara installer script issue from --directory /opt/CAPEv2 usage.

@doomedraven Do we even need to have this run in the installer script?

    # Run yara installer script
    sudo -u ${USER} /etc/poetry/bin/poetry --directory /opt/CAPEv2 run extra/yara_installer.sh

    if [ -d yara-python ]; then
        sudo rm -rf yara-python
    fi

Running poetry install should install yara-python. Fixing the script in the PR is going to cause the install of the latest yara-python, 4.5.2. I can update the pyproject.toml to reflect this and add it to this PR if this is the right place to do it.

[gemini-code-assist]

Hello @ChrisThibodeaux, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

Summary of Changes

This pull request addresses a couple of minor fixes in the cape2.sh and yara_installer.sh scripts. Specifically, it corrects an issue where the Suricata configuration wasn't properly enabling the file-store option, and it resolves a problem in the yara installer script related to the --directory /opt/CAPEv2 usage. The PR author also raises a question about whether the yara installer script is even necessary, given that poetry install should handle the yara-python installation. They propose updating pyproject.toml to reflect the latest yara-python version (4.5.2) if keeping the script is the right approach.

Highlights

• Suricata Configuration Fix: The Suricata configuration is now correctly setting enabled: yes for the file-store option.
• Yara Installer Script Fix: The yara installer script issue related to the --directory /opt/CAPEv2 usage has been resolved.
• Yara Installation Discussion: The PR raises a question about the necessity of the yara installer script, suggesting that poetry install might be sufficient.

Changelog

• extra/yara_installer.sh
  • Replaced the original yara-python installation steps with commands that execute the build and pip install within a bash shell, ensuring the correct directory context.
  • Changed the directory after installation to /tmp instead of ..
• installer/cape2.sh
  • Corrected the Suricata text replacement for file-store to properly set enabled: yes by adjusting the byte string to match the expected format in the config file (line 747).
  • Modified the yara installer script execution to remove the redundant /opt/CAPEv2/ prefix (line 800).
  • Modified the capa installer script execution to install from /tmp/capa instead of '.' (line 947).

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

---

A script's small fix,
Enables features, no tricks,
Code works as planned.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

The pull request includes fixes for Suricata text replacement and an issue with the yara installer script. The changes seem reasonable, but I have a few observations and suggestions for improvement.

Summary of Findings

• Yara Installer Script Redundancy: The pull request description mentions a potential redundancy in running the yara installer script within the installer script itself. It would be beneficial to evaluate if this step is necessary and remove it if poetry install is sufficient.
• Clarity of Suricata Configuration Changes: The Suricata configuration changes involve replacing text within the suricata.yaml file. While the fix addresses an issue, it would be helpful to understand the specific problem and the rationale behind enabling file-store.
• Inconsistent use of absolute vs. relative paths: There are some changes that switch from absolute to relative paths, and vice versa. It would be helpful to understand the reasoning behind this, and to ensure that there is consistency in the codebase.

Merge Readiness

The pull request addresses specific issues in the installer scripts and seems to improve the overall functionality. However, it's important to address the identified concerns regarding the Yara installer script redundancy and the clarity of Suricata configuration changes. I am unable to directly approve the pull request, and users should have others review and approve this code before merging. I recommend addressing the medium and high severity issues before merging.

[doomedraven]

hey, thank you, sorry for long update i still not fully back. the issue with installing it from pypi vs source is that from source we compile with dotnet, as from pypi at least in past it wasn't installing that module, and i got tired going back and forth with it, anyway yara now is just in maintainece mode and we should move towards yara-x

[ChrisThibodeaux]

@doomedraven Makes sense to me. I can remove those changes and just keep in the Suricata config fixes if we want. No problem either way.

[doomedraven]

i will do proper review once im back ,but till July i don't have much time

[doomedraven]

hey sorry for long delay on this one, is summer and no much time to handle all. i was checking suricata yesterday and i guess we gonna move custom mods to include file so it will overwrite the defaults, which is easier to maintain, but i will have to test it, idk when

[ChrisThibodeaux]

Sounds good, thanks for circling back to this!

[doomedraven]

FYI im reworking completely how we deal with suricata, it now will have include side config with all requires mods, so it simplify everything and no more need to care about spaces/tags etc, as described here https://forum.suricata.io/t/overide-suricata-configuation-file/3216/2

[doomedraven]

So, sorry for long delay i finally got to this.

1. i have rewrote suricata integration config to proper way.
2. they removed socket mode in v8 sadly, that has negative performance impact as it requires to init engine each time when processing pcap, i tried to research solution but went to nowhere
3. yara install i guess will become soon yara-x, as yara itself is in maintainance mode only