snare 1.7.0 — snare update now actually updates

snare update now actually updates.

Some of you saw snare update answer "already up to date" every time while snare version said you were behind. Both were telling the truth about different branches. snare update pulled whatever branch your install was on, and snare version compared against main. If your install was ever left on another branch, it never moved again.

Updates come from main, always

• snare update now moves your install to main, where releases are published, and fast-forwards it.
• If your install is on a branch with work that isn't on main, snare leaves it alone. It prints the one command to switch.
• snare update --check and the "behind" notice measure against main too, so all three agree.

Stuck on an older version? That version still has the bug, so run this once:

cd ~/snare && git checkout main && snare update

Linux: no more re-downloading the malware list on every command

On Linux, snare couldn't read how old its malware list was, so it treated the list as stale and downloaded it again, 2.3 MB at a time, on every agent command (at most once every ten minutes). It now reads the age correctly on Linux and macOS.

snare no longer trips its own gate

The website's "hidden payload" demo carried the campaign's markers verbatim. So anyone cloning or pulling snare under the agent gate got stopped with "fire on the mountain", and the only way through was to approve the block without reading it. Training people to do that is the opposite of what the gate is for.

The demo is now stored reversed and restored when the page loads. It looks the same on the site, but the file carries no live marker. snare still checks its own branches and pulls like anyone else's. A new self-test checks the website file the way a fresh clone would see it.

What only the owner can do (#54)

Some branches were never real work, just a delivery vehicle for the payload. When snare fix <owner/repo> cleans one of these and finds it adds nothing to the default branch, it now says so under What only you can do. That section gives you the exact delete command, links the branches page, and says when forks still hold the old history.

snare still never deletes a repository, an organisation or a remote branch itself. The backup bundle it makes before every fix is your way back.

Update

snare update && snare selftest

130 self-test checks pass.