update min-version required

[inashivb]

Jason, who are the consumers of min-version keys? https://github.com/OISF/suricata-intel-index/blob/master/index.yaml#L59
Do we always know that these external sources do support the said min-versions even now?

[jasonish]

Jason, who are the consumers of min-version keys? https://github.com/OISF/suricata-intel-index/blob/master/index.yaml#L59

Suricata-Update, and if its not looking at it, that was the idea. So if a ruleset had a min-version of 7, but you were running 6 it wouldn't be presented as an option to enable.

[jasonish]

Do we always know that these external sources do support the said min-versions even now?

We have no idea.

[jasonish]

Found this ticket https://redmine.openinfosecfoundation.org/issues/4930, I wonder if we should do that at some point as well?

[inashivb]

Found this ticket https://redmine.openinfosecfoundation.org/issues/4930, I wonder if we should do that at some point as well?

Indeed.
Q: Would you rather see this ticket done than this patch?
Request: Could you please comment on the ticket what should be the default version? For example, in https://github.com/OISF/suricata-intel-index/blob/master/index.yaml#L232, recommended or 6.0?

[jasonish]

Found this ticket https://redmine.openinfosecfoundation.org/issues/4930, I wonder if we should do that at some point as well?

Indeed. Q: Would you rather see this ticket done than this patch? Request: Could you please comment on the ticket what should be the default version? For example, in https://github.com/OISF/suricata-intel-index/blob/master/index.yaml#L232, recommended or 6.0?

No. We're talking about a change every few years, I think its fine in code.

I'm just trying to decide whether we drop this in 1.3.x, or a new 1.4. I'm thinking of dropping it in 1.3.x.

[victorjulien]

Are there risks to existing users?

[jasonish]

Are there risks to existing users?

Only to users who are running Suricata-Update unbundled from Suricata, on a system with no Suricata in their PATH and are expecting to get 4.0.0 rules. So potentially.

[victorjulien]

Are there risks to existing users?

Only to users who are running Suricata-Update unbundled from Suricata, on a system with no Suricata in their PATH and are expecting to get 4.0.0 rules. So potentially.

Seems low enough risk to me, so lets merge this.

[jasonish]

Merged via #339. Thanks!