Zeek errors when using package zeek/hosom/file-extraction combined with its store-files-by-sha256 plugin

Zeek
1

Hi all,

I’m running Zeek-6.0.6 and installed (zkg) the file-extraction package. I want the sha256 (or sha1) in the filename so I enabled the plugin store-files-by-sha256.
However, this results in the following error:
error in /usr/local/zeek/share/zeek/site/packages/file-extraction/././plugins/store-files-by-sha256.zeek, lines 33-35: FileExtraction::cmd is used inside "when" statement but not captured (when (FileExtraction::result = Exec::run((coerce [$cmd=FileExtraction::cmd] to Exec::Command))) )

These lines are:

33      when ( local result = Exec::run([$cmd=cmd]) )
34              {
35              }

Similar message (same code) when using the store-files-by-sha1 code.

Am I doing something wrong or is there a problem in this package?
Thanks in advance.

John

2

Hey John,

I’ve opened a PR to fix this. You might try to apply that locally.

Not sure if the package is still actively maintained though, but hopefully it’ll be picked up.

Hope this helps,
Arne

3

Thanks Arne,

I can certainly patch this locally.

Cheers, John