RedAmon Files

Highlights

Fixed: ./redamon.sh update no longer refuses to pull after a scan, and its error no longer makes the problem permanent (#185). A scan bind-mounts recon/ read-write into the spawned recon container, and two git-tracked data directories are re-downloaded there on a 24h cache miss (the MITRE CVE/CAPEC/CWE database and the Wappalyzer fingerprint cache). That left tracked files modified, so git pull --ff-only refused. The restore meant to prevent this was dead code -- it pointed at a .last_update marker that had since been gitignored -- while the 16 files beside it drifted. It now covers both directories. Worse than the refusal was the advice: the old error told users to git commit -am 'local changes', the one action that turns a self-healing dirty tree into a permanent dead end. That suggestion is gone, and the dirty-tree branch now warns against it explicitly.

Changed: update tells the four failure modes apart instead of blaming local changes for all of them. A diverged branch, a genuinely dirty tree, a checkout with no git remote, and a transport/auth failure each get their own diagnosis and their own runnable recovery command. A checkout diverged only by committed runtime files repairs itself and reports what it discarded, so the update completes instead of stranding the user. That reset is the single destructive step and is gated four ways, with REDAMON_NO_AUTO_RESET=1 to disable it outright.

Fixed: a mixed root/user checkout now fails fast with the one command that fixes it. An earlier sudo ./redamon.sh install leaves root-owned files in a user-owned clone, and the next non-root run failed piecemeal with errors that never pointed at the cause. update now checks up front and stops with the chown, install warns at the point the mistake is made, and a clean-but-root-owned runtime data file is flagged before a release that changes it makes git pull fail.

Note

A checkout that has already diverged still needs one manual recovery, because the fix ships inside redamon.sh -- the very file such a checkout cannot pull:

:::bash
cd ~/redamon
sudo chown -R "$(id -un):$(id -gn)" .   # only if an earlier run used sudo
git fetch origin
git reset --hard origin/master
./redamon.sh update

From this release on it is automatic. See docs/readmes/TROUBLESHOOTING.md (github.com) for the symptom table.

Upgrade

:::bash
./redamon.sh update

Databases, scan results, and reports are preserved (volumes are never deleted). Full details in CHANGELOG.md (github.com).