Can't upgrade, can't see what is going on

crowdsec
1

This appears to be exceptionally bad design: that if you’re not up-to-date, you can’t see anything at all in cscli. Other threads state “not being up-to-date does not stop crowdsec from working” but not being able to see anything from the cli means I have no idea if it’s working or what is going on. I would argue that the cli not working is … not working.

For a security critical piece of software it is simply unacceptable to lock you out of information just because you can’t update. This is taking design inspiration from Microsoft, which is extremely bad.

New rules:

  • NEVER lock the user out of critical information.
  • If it’s not possible to update, do not let the user know.
cscli collections list
WARN[06-01-2023 05:33:36 AM] Crowdsec is not the latest version. Current version is 'v1.4.3' and the latest stable version is 'v1.4.4'. Please update it! 
WARN[06-01-2023 05:33:36 AM] As a result, you will not be able to use parsers/scenarios/collections added to Crowdsec Hub after CrowdSec v1.4.4 
[[[ Collections list is empty ]]]

apt update && apt upgrade
Hit:4 https://packagecloud.io/crowdsec/crowdsec/debian bullseye InRelease
[[[ SNIP ]]]
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
2

Hey, we release 1.4.4 but the build pipeline got stuck and never made it the packagecloud repository hence why apt update && apt upgrade did not update. This is normally not the case and we have improved notifications on our side to make sure we are proactive when this happens.

The line As a result, you will not be able to use parsers/scenarios/collections added to Crowdsec Hub after CrowdSec v1.4.4 is added to inform you if version specific function have been added that the newest parsers may not function correctly.

3

So is 1.4.4 released?
You should still make your code robust so this can never happen, it’s awful and I’m considering going back to fail2ban. Security needs to be absolutely reliable and foolproof.

4

Yes, 1.4.4 is released and updated in our package repositories