mandiant / mandiant/capa

bug: inconsistent missing resource handling

Open Beginner friendly
#3,010 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

### Description

There is a slight inconsistency in how `capa` handles missing default resources. When default rules are missing, the tool provides a clean error message and exits gracefully. However, when default signatures are missing, it identifies the issue but then raises an unhandled `OSError` resulting in a crash/traceback.

### Steps to Reproduce

1. Install `capa` as a library (`pip install .`).
2. Run `capa` against a sample providing only the rules path: `capa -r rules`

**Expected behavior:**

`capa` should log a clean error for missing signatures and exit gracefully, similar to the "default embedded rules not found" error. Something like what happens when you run `capa` without a rules folder:

```text
ERROR capa: default embedded rules not found! (maybe you installed capa as a library?) main.py:495
ERROR capa: provide your own rule set via the `-r` option. main.py:496
```

Exits with code `E_MISSING_RULES` (10), and no `OSError`.

**Actual behavior:**

The tool logs a signature error but crashes with an unhandled `OSError`.

```
ERROR capa: Using default signature path, but it doesn't exist. Please install the signatures first:
https://github.com/mandiant/capa/blob/master/doc/installation.md#method-2-using-capa-as-a-python-library.
Traceback (most recent call last):
File "/opt/homebrew/bin/capa", line 6, in
sys.exit(main())
.
.
.
File "/opt/homebrew/lib/python3.14/site-packages/capa/main.py", line 842, in get_signatures_from_cli
raise IOError(f"signatures path {args.signatures} does not exist or cannot be accessed")
OSError: signatures path /opt/homebrew/lib/python3.14/site-packages/sigs does not exist or cannot be accessed
```

Exits with the generic code 1

### Versions

- capa 9.4.0
- Standalone tool (installed via `pip install .`) with rules and sigs as git submodules
- Python 3.14
- macOS (Darwin)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in capa/main.py at get_signatures_from_cli and compare its missing-signatures handling with the missing-rules handling around the reported main.py lines 495-496. Reproduce the command using only the rules path, then verify that missing signatures produce a clean error, exit with E_MISSING_RULES (10), and do not raise an OSError traceback.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.