err-first-miss broken: no longer exits after miss

[tstromberg]

We should add a test for this. It doesn't seem to exit properly for non-detected files in scan or analyze mode:

go run ./cmd/mal --err-first-miss scan /bin/*
🔎 Scanning "/bin/["
🔎 Scanning "/bin/ab"
🔎 Scanning "/bin/aconnect"
🔎 Scanning "/bin/activate-global-python-argcomplete"
🔎 Scanning "/bin/addr2line"
🔎 Scanning "/bin/adwaita-1-demo"
├─ 🟠 /usr/bin/adwaita-1-demo
│     • c2/addr/ip — hardcoded IP address:
│     137.634.24.969, 17.29.371.563, 29.371.563.593, 306.137.634.24, 336.298.674.582, 445.228.872.406
🔎 Scanning "/bin/airscan-discover"
🔎 Scanning "/bin/alias"

[tstromberg]

I suspected --err-first-hit is similarly broken, but it's broken differently:

% go run ./cmd/mal --min-risk=medium --err-first-hit analyze ../malcontent-samples/python/
🔎 Scanning "../malcontent-samples/python/"
time=2024-11-04T07:56:01.384-05:00 level=ERROR source=/var/home/t/src/malcontent/pkg/action/scan.go:338 msg="error with processing 16 matching capabilities in ../malcontent-samples/python/2021.DiscordSafety/DiscordSafety-0.1.tar.gz archive: anti-static/obfuscation/python/rename_imports anti-static/unmarshal/marshal c2/addr/php collect/databases/leveldb exec/program exec/remote_commands/code_eval exfil/stealer/browser fs/path/users impact/remote_access/py_setuptools net/url/request\n"

I don't quite understand the error, but the hit result was never shown. If I specify a subdir, it just exits quietly:

% go run ./cmd/mal --min-risk=medium --err-first-hit analyze ../malcontent-samples/python/2024.yocolor/
🔎 Scanning "../malcontent-samples/python/2024.yocolor/"