Skip to content

Commit e1506ef

Browse files
authored
chore: bump yara-x to 1.13.0; match upstream config; run Make targets consistently (#1389)
* chore: bump yara-x to 1.13.0; match upstream config; run Make targets consistently Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * revert to Make targets for tests Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * consolidate go + yara-x version definitions Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> * one more tweak Signed-off-by: egibs <20933572+egibs@users.noreply.github.com> --------- Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
1 parent 60ac9c1 commit e1506ef

9 files changed

Lines changed: 95 additions & 39 deletions

File tree

.github/workflows/codeql.yaml

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ on:
1212

1313
env:
1414
CODEQL_EXTRACTOR_GO_BUILD_TRACING: "on"
15+
YARA_X_RELEASE: "1.13.0"
1516

1617
permissions: {}
1718

@@ -34,7 +35,7 @@ jobs:
3435
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
3536
with:
3637
path: yara-x-install
37-
key: yara-x-capi-v1.12.0-${{ runner.os }}
38+
key: yara-x-capi-v${{ env.YARA_X_RELEASE }}-${{ runner.os }}
3839
- name: Checkout virusTotal/yara-x
3940
if: steps.yara-x-capi.outputs.cache-hit != 'true'
4041
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -43,7 +44,7 @@ jobs:
4344
fetch-tags: true
4445
repository: virusTotal/yara-x
4546
path: yara-x
46-
ref: refs/tags/v1.12.0
47+
ref: refs/tags/v${{ env.YARA_X_RELEASE }}
4748
- name: Install Rust for yara-x-capi
4849
if: steps.yara-x-capi.outputs.cache-hit != 'true'
4950
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
@@ -56,14 +57,19 @@ jobs:
5657
path: |
5758
~/.cargo/registry/
5859
~/.cargo/git/
59-
key: rust-cargo-v1.12.0-${{ runner.os }}
60+
key: rust-cargo-v${{ env.YARA_X_RELEASE }}-${{ runner.os }}
6061
restore-keys: rust-cargo-
6162
- name: Build yara-x-capi
6263
if: steps.yara-x-capi.outputs.cache-hit != 'true'
6364
run: |
6465
command -v cargo-cinstall || cargo install cargo-c --locked
6566
cd ${{ github.workspace }}/yara-x
66-
cargo cinstall -p yara-x-capi --features=native-code-serialization --release --pkgconfigdir=${{ github.workspace }}/yara-x-install --includedir=${{ github.workspace }}/yara-x-install --libdir=${{ github.workspace }}/yara-x-install
67+
RUSTFLAGS="-C target-feature=+crt-static" cargo cinstall -p yara-x-capi --features=native-code-serialization \
68+
--profile release-lto \
69+
--pkgconfigdir=${{ github.workspace }}/yara-x-install \
70+
--includedir=${{ github.workspace }}/yara-x-install \
71+
--libdir=${{ github.workspace }}/yara-x-install \
72+
--crt-static --library-type="staticlib"
6773
rm -rf ${{ github.workspace }}/yara-x
6874
- name: Set up Go
6975
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0

.github/workflows/fuzz.yaml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,10 @@ on:
2929
- "60m"
3030
- "180m"
3131

32+
env:
33+
GO_RELEASE: "go-1.26"
34+
YARA_X_RELEASE: "1.13.0"
35+
3236
permissions: {}
3337

3438
jobs:
@@ -117,7 +121,7 @@ jobs:
117121
- name: Install dependencies
118122
run: |
119123
apk update
120-
apk add curl findutils git gnutar go nodejs upx xz yara-x~1.12.0
124+
apk add curl findutils git gnutar ${{ env.GO_RELEASE }} nodejs upx xz yara-x~${{ env.YARA_X_RELEASE }}
121125
122126
- name: Checkout code
123127
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/go-tests.yaml

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@ on:
1111
branches:
1212
- "main"
1313

14+
env:
15+
GO_RELEASE: "go-1.26"
16+
YARA_X_RELEASE: "1.13.0"
17+
1418
permissions: {}
1519

1620
jobs:
@@ -37,7 +41,7 @@ jobs:
3741
- name: Install dependencies
3842
run: |
3943
apk update
40-
apk add curl findutils git gnutar go nodejs upx xz yara-x~1.12.0
44+
apk add curl findutils git gnutar ${{ env.GO_RELEASE }} nodejs upx xz yara-x~${{ env.YARA_X_RELEASE }}
4145
4246
- name: Checkout code
4347
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -63,8 +67,7 @@ jobs:
6367
restore-keys: go-
6468

6569
- name: Unit tests
66-
run: |
67-
make test
70+
run: make test
6871

6972
integration:
7073
if: ${{ github.repository == 'chainguard-dev/malcontent' }}
@@ -89,7 +92,7 @@ jobs:
8992
- name: Install dependencies
9093
run: |
9194
apk update
92-
apk add curl findutils git gnutar go nodejs upx xz yara-x~1.12.0
95+
apk add curl findutils git gnutar ${{ env.GO_RELEASE }} nodejs upx xz yara-x~${{ env.YARA_X_RELEASE }}
9396
9497
- name: Checkout code
9598
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -128,5 +131,4 @@ jobs:
128131
run: make samples
129132

130133
- name: Integration tests
131-
run: |
132-
make integration
134+
run: make integration

.github/workflows/release.yaml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,7 @@ name: Cut Release
66
on:
77
workflow_dispatch:
88

9-
permissions:
10-
contents: read
9+
permissions: {}
1110

1211
env:
1312
VERSION_FILE: pkg/version/version.go

.github/workflows/style.yaml

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@
33

44
name: Code Style
55

6+
env:
7+
GO_RELEASE: "go-1.26"
8+
YARA_X_RELEASE: "1.13.0"
9+
610
permissions: {}
711

812
on:
@@ -57,7 +61,7 @@ jobs:
5761

5862
- name: Install yara-x
5963
run: |
60-
wget https://github.com/VirusTotal/yara-x/releases/download/v1.10.0/yara-x-v1.10.0-x86_64-unknown-linux-gnu.gz -O yara-x.gz
64+
wget https://github.com/VirusTotal/yara-x/releases/download/v${{ env.YARA_X_RELEASE }}/yara-x-v${{ env.YARA_X_RELEASE }}-x86_64-unknown-linux-gnu.gz -O yara-x.gz
6165
gunzip yara-x.gz && tar -xvf yara-x && chmod +x yr && mv yr /usr/local/bin/ && rm yara-x
6266
- name: Verify yr installation
6367
run: |
@@ -143,7 +147,7 @@ jobs:
143147
- name: Install dependencies
144148
run: |
145149
apk update
146-
apk add curl findutils git go nodejs yara-x~1.10.0
150+
apk add curl findutils git ${{ env.GO_RELEASE }} nodejs yara-x~${{ env.YARA_X_RELEASE }}
147151
148152
- name: Checkout code
149153
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/third-party.yaml

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,11 @@ on:
88
schedule:
99
- cron: "0 */12 * * *"
1010

11-
permissions:
12-
contents: read
11+
env:
12+
GO_RELEASE: "go-1.26"
13+
YARA_X_RELEASE: "1.13.0"
14+
15+
permissions: {}
1316

1417
jobs:
1518
update:
@@ -37,7 +40,7 @@ jobs:
3740
- name: Install dependencies
3841
run: |
3942
apk update
40-
apk add bash curl findutils gh git gnutar go nodejs perl upx xz yara-x~1.12.0
43+
apk add bash curl findutils gh git gnutar ${{ env.GO_RELEASE }} nodejs perl upx xz yara-x~${{ env.YARA_X_RELEASE }}
4144
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4245
- name: Trust repository
4346
run: git config --global --add safe.directory "${GITHUB_WORKSPACE}"

Makefile

Lines changed: 55 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,16 @@ LINT_OS := $(shell uname)
1515
LINT_OS_LOWER := $(shell echo $(LINT_OS) | tr '[:upper:]' '[:lower:]')
1616
LINT_ROOT := $(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
1717

18+
# flags required to successfully build malcontent with yara-x's C API
19+
CPPFLAGS ?= "-I$(LINT_ROOT)/out/include"
20+
LDFLAGS :=
21+
PKGCONF_PATH ?= "$(LINT_ROOT)/out/lib/pkgconfig"
22+
ifeq ($(LINT_OS),Darwin)
23+
LDFLAGS="-L$(LINT_ROOT)/out/lib -Wl,-no_warn_duplicate_libraries,-rpath,$(LINT_ROOT)/out/lib,-lyara_x_capi"
24+
else ifeq ($(LINT_OS),Linux)
25+
LDFLAGS="-L$(LINT_ROOT)/out/lib -Wl,-rpath,$(LINT_ROOT)/out/lib,-lyara_x_capi,-no-pie"
26+
endif
27+
1828
# yara-x adds an additional string for the platform (apple, unknown)
1929
LINT_PLATFORM :=
2030
ifeq ($(LINT_OS),Darwin)
@@ -41,22 +51,22 @@ $(GOLANGCI_LINT_BIN):
4151
mv $(LINT_ROOT)/out/linters/golangci-lint $@
4252

4353
YARA_X_REPO ?= virusTotal/yara-x
44-
YARA_X_VERSION ?= v1.12.0
45-
YARA_X_COMMIT ?= 466a624e381beefde7665433494887d80932a662
54+
YARA_X_VERSION ?= v1.13.0
55+
YARA_X_COMMIT ?= d397e8c3feee79e91f4b389288ba244264da2813
4656
YARA_X_SHA :=
4757
ifeq ($(LINT_OS),Darwin)
4858
ifeq ($(shell uname -m),arm64)
4959
LINT_ARCH = aarch64
50-
YARA_X_SHA = 63100b4d6505c366d3c6af5145a26b961d2bf1646a4442716d81bb6f6a4dbee2
60+
YARA_X_SHA = 0931697b9cfe74cade4a7136610a5cd254ae3bed95831b413c6b54f5760d554f
5161
else
52-
YARA_X_SHA = 29a50a3cf442206b9c116f3a322debc367215d4667cf99512550cbdca7c88fc0
62+
YARA_X_SHA = 226dce240b8d674db3c83b5c0b6d336268a46f1fbd6718fa9bdeb3735857f6c4
5363
endif
5464
else ifeq ($(LINT_OS),Linux)
5565
ifeq ($(shell uname -m),arm64)
5666
LINT_ARCH = aarch64
57-
YARA_X_SHA = 614cb7b5a738e1e6e3fe6b98bca207c2dfd012ad95d4a85d5e62a0eac985c554
67+
YARA_X_SHA = a50e9b593c5a6039c227f665b8ade1ea1c4bee3be5789add3e33f033cbf427ae
5868
else
59-
YARA_X_SHA = f460a20b78b66b08b6d323f1d1ed00ab94328ae98a3f755f29692e49caa48cb7
69+
YARA_X_SHA = b93fb0b87016c60498c26b8a17d2617bbc49f5d5b1a291cde5b09658ce93bb69
6070
endif
6171
endif
6272
YARA_X_BIN := $(LINT_ROOT)/out/linters/yr-$(YARA_X_VERSION)-$(LINT_ARCH)
@@ -70,14 +80,20 @@ $(YARA_X_BIN):
7080

7181
LINTERS += golangci-lint-lint
7282
golangci-lint-lint: $(GOLANGCI_LINT_BIN)
73-
find . -maxdepth 1 -name go.mod -print0 | xargs -0 -L1 -I{} /bin/sh -c '"$(GOLANGCI_LINT_BIN)" run -c "$(GOLANGCI_LINT_CONFIG)"' \;
83+
find . -maxdepth 1 -name go.mod -print0 | xargs -0 -L1 -I{} /bin/sh -c 'CGO_LDFLAGS=$(LDFLAGS) CGO_CPPFLAGS=$(CPPFLAGS) PKG_CONFIG_PATH=$(PKGCONF_PATH) "$(GOLANGCI_LINT_BIN)" run -c "$(GOLANGCI_LINT_CONFIG)"' \;
7484

7585
FIXERS += golangci-lint-fix
7686
golangci-lint-fix: $(GOLANGCI_LINT_BIN)
87+
CGO_LDFLAGS=$(LDFLAGS) \
88+
CGO_CPPFLAGS=$(CPPFLAGS) \
89+
PKG_CONFIG_PATH=$(PKGCONF_PATH) \
7790
find . -maxdepth 1 -name go.mod -execdir "$(GOLANGCI_LINT_BIN)" run -c "$(GOLANGCI_LINT_CONFIG)" --fix \;
7891

7992
FIXERS += modernize
8093
modernize:
94+
CGO_LDFLAGS=$(LDFLAGS) \
95+
CGO_CPPFLAGS=$(CPPFLAGS) \
96+
PKG_CONFIG_PATH=$(PKGCONF_PATH) \
8197
go run golang.org/x/tools/gopls/internal/analysis/modernize/cmd/modernize@latest -fix -test ./...
8298

8399
LINTERS += yara-x-fmt
@@ -115,7 +131,7 @@ out/$(SAMPLES_REPO)/.decompressed-$(SAMPLES_COMMIT): out/${SAMPLES_REPO}/.git/co
115131

116132
out/$(YARA_X_REPO)/.git/commit-$(YARA_X_COMMIT):
117133
mkdir -p out/$(YARA_X_REPO)
118-
test -d out/$(YARA_X_REPO)/.git ||git clone https://github.com/$(YARA_X_REPO).git out/$(YARA_X_REPO)
134+
test -d out/$(YARA_X_REPO)/.git || git clone https://github.com/$(YARA_X_REPO).git out/$(YARA_X_REPO)
119135
rm out/$(YARA_X_REPO)/.git/commit-* 2>/dev/null || true
120136
git -C out/$(YARA_X_REPO) switch - || true
121137
git -C out/$(YARA_X_REPO) pull --rebase --autostash
@@ -130,7 +146,7 @@ install-yara-x: out/$(YARA_X_REPO)/.git/commit-$(YARA_X_COMMIT)
130146
mkdir -p out/include
131147
cd out/$(YARA_X_REPO) && \
132148
cargo install cargo-c --locked && \
133-
cargo cinstall -p yara-x-capi --features=native-code-serialization --release --prefix="$(LINT_ROOT)/out" --libdir="$(LINT_ROOT)/out/lib"
149+
RUSTFLAGS="-C target-feature=+crt-static" cargo cinstall -p yara-x-capi --features=native-code-serialization --profile release-lto --prefix="$(LINT_ROOT)/out" --libdir="$(LINT_ROOT)/out/lib" --crt-static --library-type="staticlib"
134150

135151
.PHONY: update-deps
136152
update-deps:
@@ -140,6 +156,9 @@ update-deps:
140156
# unit tests only
141157
.PHONY: test
142158
test:
159+
CGO_LDFLAGS=$(LDFLAGS) \
160+
CGO_CPPFLAGS=$(CPPFLAGS) \
161+
PKG_CONFIG_PATH=$(PKGCONF_PATH) \
143162
go test -race ./pkg/...
144163

145164
FUZZ_TIME ?= 10s
@@ -149,9 +168,9 @@ fuzz:
149168
awk -F'[:(]' '{gsub(/func /, "", $$2); dir=$$1; sub(/\/[^/]+$$/, "/", dir); print $$2, "./" dir}' | \
150169
while read -r func dir; do \
151170
echo "--- $$func ($$dir) ---"; \
152-
CGO_LDFLAGS="-L$(LINT_ROOT)/out/lib -Wl,-rpath,$(LINT_ROOT)/out/lib" \
153-
CGO_CPPFLAGS="-I$(LINT_ROOT)/out/include" \
154-
PKG_CONFIG_PATH="$(LINT_ROOT)/out/lib/pkgconfig" \
171+
CGO_LDFLAGS=$(LDFLAGS) \
172+
CGO_CPPFLAGS=$(CPPFLAGS) \
173+
PKG_CONFIG_PATH=$(PKGCONF_PATH) \
155174
go test -timeout 0 -fuzz="^$$func$$" -fuzztime=$(FUZZ_TIME) "$$dir" || exit 1; \
156175
done
157176

@@ -161,6 +180,9 @@ FUZZ_TARGET ?= FuzzExtractArchive
161180
FUZZ_PKG ?= ./pkg/archive/
162181
.PHONY: fuzz-continuous
163182
fuzz-continuous:
183+
CGO_LDFLAGS=$(LDFLAGS) \
184+
CGO_CPPFLAGS=$(CPPFLAGS) \
185+
PKG_CONFIG_PATH=$(PKGCONF_PATH) \
164186
go test -fuzz=$(FUZZ_TARGET) $(FUZZ_PKG)
165187

166188
# unit tests only
@@ -174,28 +196,44 @@ coverage-html: out/coverage.html
174196
# pop open the html page in a browser directly
175197
.PHONY: coverage-browser
176198
coverage-browser: out/mal.coverage
199+
CGO_LDFLAGS=$(LDFLAGS) \
200+
CGO_CPPFLAGS=$(CPPFLAGS) \
201+
PKG_CONFIG_PATH=$(PKGCONF_PATH) \
177202
go tool cover -html=$<
178203

179204
# generate the html report
180205
out/coverage.html: out/mal.coverage
206+
CGO_LDFLAGS=$(LDFLAGS) \
207+
CGO_CPPFLAGS=$(CPPFLAGS) \
208+
PKG_CONFIG_PATH=$(PKGCONF_PATH) \
181209
go tool cover -html=$< -o $@
182210

183211
# we always want to regen the coverage data file
184212
.PHONY: out/mal.coverage
185213
out/mal.coverage:
186214
mkdir -p out
215+
CGO_LDFLAGS=$(LDFLAGS) \
216+
CGO_CPPFLAGS=$(CPPFLAGS) \
217+
PKG_CONFIG_PATH=$(PKGCONF_PATH) \
187218
go test -coverprofile $@ -race ./pkg/... -coverpkg ./pkg/...
188219

189220
# integration tests only
190221
.PHONY: integration
191222
integration: out/$(SAMPLES_REPO)/.decompressed-$(SAMPLES_COMMIT)
223+
CGO_LDFLAGS=$(LDFLAGS) \
224+
CGO_CPPFLAGS=$(CPPFLAGS) \
225+
PKG_CONFIG_PATH=$(PKGCONF_PATH) \
192226
go test -race -timeout 0 ./tests/...
193227

194228
.PHONY: bench
195229
bench: out/$(SAMPLES_REPO)/.decompressed-$(SAMPLES_COMMIT)
230+
CGO_LDFLAGS=$(LDFLAGS) \
231+
CGO_CPPFLAGS=$(CPPFLAGS) \
232+
PKG_CONFIG_PATH=$(PKGCONF_PATH) \
196233
go test -run=^\$$ -bench=. ./... -benchmem
197234

198-
BENCH_CMD := go test -benchmem -run=^\$$ -bench ^BenchmarkRun\$$ github.com/chainguard-dev/malcontent/tests -args
235+
BENCH_CMD := CGO_LDFLAGS=$(LDFLAGS) CGO_CPPFLAGS=$(CPPFLAGS) PKG_CONFIG_PATH=$(PKGCONF_PATH) \
236+
go test -benchmem -run=^\$$ -bench ^BenchmarkRun\$$ github.com/chainguard-dev/malcontent/tests -args
199237

200238
.PHONY: bench-malcontent
201239
bench-malcontent:
@@ -244,9 +282,9 @@ bench-windows:
244282
.PHONY: out/mal
245283
out/mal:
246284
mkdir -p out
247-
CGO_LDFLAGS="-L$(LINT_ROOT)/out/lib -Wl,-rpath,$(LINT_ROOT)/out/lib" \
248-
CGO_CPPFLAGS="-I$(LINT_ROOT)/out/include" \
249-
PKG_CONFIG_PATH="$(LINT_ROOT)/out/lib/pkgconfig" \
285+
CGO_LDFLAGS=$(LDFLAGS) \
286+
CGO_CPPFLAGS=$(CPPFLAGS) \
287+
PKG_CONFIG_PATH=$(PKGCONF_PATH) \
250288
go build -o out/mal ./cmd/mal
251289

252290
.PHONY: update-third-party
@@ -258,7 +296,7 @@ refresh-sample-testdata: out/$(SAMPLES_REPO)/.decompressed-$(SAMPLES_COMMIT) out
258296
MALCONTENT_UPX_PATH=$(shell which upx) ./out/mal refresh
259297

260298
ARCH ?= $(shell uname -m)
261-
CRANE_VERSION=v0.20.7
299+
CRANE_VERSION=v0.21.0
262300
out/crane-$(ARCH)-$(CRANE_VERSION):
263301
mkdir -p out
264302
GOBIN=$(CURDIR)/out go install github.com/google/go-containerregistry/cmd/crane@$(CRANE_VERSION)

go.mod

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
module github.com/chainguard-dev/malcontent
22

3-
go 1.25.7
3+
go 1.26.0
44

55
require (
6-
github.com/VirusTotal/yara-x/go v1.12.0
6+
github.com/VirusTotal/yara-x/go v1.13.0
77
github.com/cavaliergopher/cpio v1.0.1
88
github.com/cavaliergopher/rpm v1.3.0
99
github.com/chainguard-dev/clog v1.8.0

go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
github.com/VirusTotal/yara-x/go v1.12.0 h1:RfLiZX4mrro2jJtaI3NLViJBeUXzkuOjlRY5S2jiQrk=
2-
github.com/VirusTotal/yara-x/go v1.12.0/go.mod h1:lgXP/nkYX349MVowrtTtU5hzMdCOWQLv3+wKll9+0F8=
1+
github.com/VirusTotal/yara-x/go v1.13.0 h1:Maidzjq4Y27CczuBOWlKr+3En3E/3UVVNHNOKlzr4ww=
2+
github.com/VirusTotal/yara-x/go v1.13.0/go.mod h1:lgXP/nkYX349MVowrtTtU5hzMdCOWQLv3+wKll9+0F8=
33
github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
44
github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
55
github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=

0 commit comments

Comments
 (0)