#!/bin/sh
# fakescan: a stand-in for a malware scanner, for the ioc-sweep lab.
# Usage: fakescan --json -- FILE
# Prints a JSON report; a finding when FILE holds the lab's test signature.
# Exit status: 0 report printed, 2 usage error or unreadable file.
if [ "$#" -ne 3 ] || [ "$1" != --json ] || [ "$2" != -- ]; then
  echo "usage: fakescan --json -- FILE" >&2
  exit 2
fi
grep -q -F -e LAB-TEST-SIGNATURE -- "$3"
case $? in
  0) echo '{"findings": [{"rule": "lab-test-signature", "severity": "high"}]}' ;;
  1) echo '{"findings": []}' ;;
  *) exit 2 ;;
esac
