Build 2195 for main with status FAILURE - npcap_test.go - Operation did not complete successfully because the file contains a virus or potentially unwanted software.

[elasticmachine]

💔 Tests Failed

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2024-01-07T19:51:52.928+0000

• Duration: 136 min 9 sec

Test stats 🧪

Test	Results
Failed	2
Passed	28178
Skipped	1972
Total	30152

Test errors

Expand to view the tests failures

Build&Test / packetbeat-windows-2016-windows-2016 / TestNpcap/Install – github.com/elastic/beats/v7/packetbeat/npcap

Expand to view the error details

 Failed 

Expand to view the stacktrace

 === RUN   TestNpcap/Install
    npcap_test.go:61: unexpected error running installer to default location with compat=false: npcap: failed to start Npcap installer: fork/exec C:\Users\jenkins\AppData\Local\Temp\TestNpcap1332116326\001\installer.exe: Operation did not complete successfully because the file contains a virus or potentially unwanted software.
    npcap_test.go:63: installing Npcap DLL
    npcap_test.go:63: replace existing version: WinPcap version 4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b (20091008)
    npcap_test.go:61: unexpected error running installer to C:\some\other\location with compat=false: npcap: failed to start Npcap installer: fork/exec C:\Users\jenkins\AppData\Local\Temp\TestNpcap1332116326\001\installer.exe: Operation did not complete successfully because the file contains a virus or potentially unwanted software.
    npcap_test.go:63: installing Npcap DLL
    npcap_test.go:63: replace existing version: WinPcap version 4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b (20091008)
    npcap_test.go:61: unexpected error running installer to default location with compat=true: npcap: failed to start Npcap installer: fork/exec C:\Users\jenkins\AppData\Local\Temp\TestNpcap1332116326\001\installer.exe: Operation did not complete successfully because the file contains a virus or potentially unwanted software.
    npcap_test.go:63: installing Npcap DLL
    npcap_test.go:63: replace existing version: WinPcap version 4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b (20091008)
    npcap_test.go:61: unexpected error running installer to C:\some\other\location with compat=true: npcap: failed to start Npcap installer: fork/exec C:\Users\jenkins\AppData\Local\Temp\TestNpcap1332116326\001\installer.exe: Operation did not complete successfully because the file contains a virus or potentially unwanted software.
    npcap_test.go:63: installing Npcap DLL
    npcap_test.go:63: replace existing version: WinPcap version 4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b (20091008)
--- FAIL: TestNpcap/Install (1.60s)
 

Build&Test / packetbeat-windows-2016-windows-2016 / TestNpcap – github.com/elastic/beats/v7/packetbeat/npcap

Expand to view the error details

 Failed 

Expand to view the stacktrace

 === RUN   TestNpcap
--- FAIL: TestNpcap (3.81s)
 

Steps errors

Expand to view the steps failures

packetbeat-windows-2016-windows-2016 - mage build unitTest

• Took 3 min 14 sec . View more details here
• Description: mage build unitTest

packetbeat-windows-2016-windows-2016 - mage build unitTest

• Took 1 min 46 sec . View more details here
• Description: mage build unitTest

packetbeat-windows-2016-windows-2016 - mage build unitTest

• Took 1 min 30 sec . View more details here
• Description: mage build unitTest

Error signal

• Took 0 min 0 sec . View more details here
• Description: Error "hudson.AbortException: script returned exit code 1"

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[pierrehilbert]

@narph / @ebeahan could we have someone to have a look here please?

[efd6]

@pierrehilbert This is https://go.dev/doc/faq#virus. We do need to have these tests and they necessarily involve shelling out to another executable in order to mimic the process involved in installing the Npcap DLL during Packetbeat execution startup. This issue should be reported to MS to get them to improve their handling of Go executables (see FAQ entry above). We could rewrite the mocks in something else, since any executable that performs the checks that the mocks do will suffice (src ref: https://github.com/elastic/beats/tree/main/packetbeat/npcap/testdata). If someone can provide either PS or bat equivalents, I can help integrate them into the tests.

[elasticmachine]

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

[jlind23]

Closing as outdated.