Do not end the whole androidqf run on an encrypted backup.ab (#891)

from_ab() raises InvalidAndroidBackup instead of exiting when it runs as a
sub-command, which check-androidqf catches to skip the backup modules. The
two password branches still called sys.exit(1) unconditionally, and since
run_backup_cmd() runs inside finish(), that ended the parent run before the
intrusion-logs command and before the timeline, alerts, urls, info and run
manifest were stored — leaving an output directory that looks complete but
has no alerts.json.

Also drop "as backup.ab is malformed" from the skip warning: it covers a
missing or wrong password too.
This commit is contained in:
va@resident
2026-08-25 20:18:36 +02:00
committed by GitHub
parent dac4acb180
commit 3c8a581fd0
4 changed files with 45 additions and 4 deletions
+1 -1
View File
@@ -155,7 +155,7 @@ class TestCheckAndroidqfCommand:
result = runner.invoke(check_androidqf, [str(path)])
assert result.exit_code == 0
assert "Skipping backup modules as backup.ab is malformed" in caplog.text
assert "Skipping backup modules: Invalid backup format" in caplog.text
assert not any(
record.levelname in {"CRITICAL", "FATAL"} for record in caplog.records
)