All Apps and Add-ons

Need clarifications on binary file checks done by check_for_binary_files_without_source_code

turbobobi
Explorer

Our addon app has several binary files in its bin/ directory.
The check_for_binary_files_without_source_code check fails for them, but I discovered 2 things:
1. When packaging the addon using the Addon Builder app, the README.txt file gets modified with extra content like the following:


# Binary File Declaration
/opt/splunk/var/data/tabuilder/package/TA-luminar-iocs-and-leaked-credentials/bin/ta_luminar_iocs_and_leaked_credentials/aob_py3/pvectorc.cpython-37m-x86_64-linux-gnu.so: this file does not require any source code

Having these segments in the README.txt file causes the check to omit the given binary file.

2. I tried looking for details about this README.txt behavior, but the only thing I was able to find was an old fork of what appears to be the code of the AppInspectchecks:
https://github.com/splunkdevabhi/appinspect/blob/master/splunk_appinspect/checks/check_cloud_simple_...

In particular the conditional logic related to this behavior is in lines 1827-1852.

Is this use case for binary file descriptions in a README.txt file described in the official documentation?
If not, can someone please add it?

Labels (2)
Tags (1)
0 Karma

turbobobi
Explorer

It's interesting to note that I reached this use case by 2 different approaches:

  1. Calling the AppInspect CLI on my app's source code dir
  2. Calling the AppInspect CLI on a package I produced using slim (from the Packaging Toolkit)

I see that the README.txt file gets updated automatically with these binary file exclusions in 2 separate use cases:

  • When I call the splunk package app command
  • When I package my app using the AddOn Builder app
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...