Add hints for failing conditions

[sourque]

Add hints, like:

Example pseudo config:

52│[[check]]                                                                       
53│message = "Removed john the ripper"                                                    
54│points = 10                                                                     
55│                                                                                
56│    [[check.pass]]                                                              
57│    hint = "Are there any 'hacking' tools on this system?"                      
58│    type = "ProgramInstalledNot"                                                
59│    name = "john"                                                                 
60│                                                                                
61│    [[check.pass]]                                                              
62│    hint = "Removing just the binary is insufficient; use a package manager to remove all of a tool's files"
63│    type = "PathExistsNot"                                                      
64│    path = "/usr/local/share/john"

[safinsingh]

Would it be possible to implement check-wide hints for checks with multiple conditions? This would be useful in the case that you don't want per-condition hints but one for an entire check. Do you think people would run into this/find that feature useful?

[Mobmaker55]

As it was Printf() before, this is just a sanity check, but it is intentional that it is Print() and not Println() yeah?

[sourque]

Yeah sorry had this change lying around for a while, it is supposed to be Print. Printf was kind of like a format string vulnerability lol, not that those exist in go. The newline is added in toPrint via Sprintln.

[Mobmaker55]

Can we have a line or two to explain what checkOr and checkAnd are designed to do? it is a slightly less direct name than previously

[sourque]

I saw that the functions were identical for checkFails/PassOverride because they were both OR/|| behavior, in that on the first true, return. Whereas pass is AND/&& because everything needs to be true otherwise return false. Sure I'll add a comment

[sourque]

Actually good catch I messed that up and forgot to change it to take a list of conds rather than a check

[Mobmaker55]

what does this change do?

[Mobmaker55]

this question also applies to line 215

[sourque]

Yea lol I think that check was broken. After removing something with apt, dpkg just shows the status as deinstall. Does not return nonzero value for -s

[Mobmaker55]

at least by my logic, if a Program is NOT installed (so its no longer in the package manager DB saying it is or is not installed), then "using a package manager to remove the tool's files" would be useless since the package manager has no idea it exists -- if my understanding is right, shouldn't the hint be more like "The binary and its files need removed!"

[sourque]

The example here is a "common" issue where people remove a package but don't purge or autoremove, so there's a hint for that (eg remove john, john-data still exists). I suppose the hint could be "Ensure that you use a package manager to remove ALL of a tool's files"

[Mobmaker55]

so you would end up with two hints to the same check? Which can be confusing when its based on points so
(Points: 5) (hint)
(Points: 5) (another hint on the same thing, but it could be interpreted as solving both hints give you 10 points)

[sourque]

When points are for the same item they're grouped in a list so I don't think that would be confusing. Maybe vice versa if there are two hints for 5 points someone could think they're the same underlying check but I think that's unlikely

[Mobmaker55]

Looks good on paper, if you want me to give it a spin before we push I can do that today.
I should probably also update the docs for my (now 2 weeks old) PR and we push both of these at the same time with a version change?