[leogr]

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

/kind release

If this PR prepares a chart release, uncomment:

/kind chart-release

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area build

/area engine

/area tests

/area proposals

/area automation

/area chart

Falco was emitting LOAD_NO_EVTTYPE ("Rule matches too many evt.type values...") for rules whose condition is statically unsatisfiable - notably the documented never_true idiom (evt.num=0) - which is the opposite of what's actually happening: those rules match nothing.

Since falcosecurity/libs#3009, the event-code analyzer resolves such conditions to the empty set. This PR bumps libs to latest master and changes the warning gate to fire only on genuinely broad conditions (size() > 100), instead of conflating "matches nothing" with "matches too much".

Which issue(s) this PR fixes:

Fixes #3883

Special notes for your reviewer:

• The libs bump and the gate change must ship together: with the new libs only, the common ... and never_true tuning pattern would start producing empty sets and trigger the old warning.
• Explicit contradictions (e.g. evt.type=open and evt.type=close) now load silently too. This is intentional: a dead-rule diagnostic is a separate UX design (with its own suppressibility), out of scope here.
• Minor side effects of the more precise analysis: falco -V reports "Ok" instead of "Ok, with warnings" for placeholder-only rules, and their falco -L events list is no longer the full set.

/milestone 0.45.0

Does this PR introduce a user-facing change?:

fix(engine): do not emit the `LOAD_NO_EVTTYPE` warning for rules with statically unsatisfiable conditions (e.g. the `never_true` placeholder idiom)

[github-actions]

This PR may bring feature or behavior changes in the Falco engine and may require the engine version to be bumped.

Please double check userspace/engine/falco_engine_version.h file. See versioning for FALCO_ENGINE_VERSION.

/hold

[ekoops]

/approve

[sgaist]

Just wondering: is the semantic version number being dropped or is it just for this change to be functioning ?

[leogr]

This updates the current libs version, bringing in the libs implementation this PR depends on.
The temporary bump is equivalent to #3923

Later, FALCOSECURITY_LIBS_VERSION will be bumped with the correct version once a stable libs release is out.

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops, leogr, sgaist

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [ekoops,leogr,sgaist]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[leogr]

/hold cancel