From 8de6783ad20250d4faa533c05c3ec81f85debb95 Mon Sep 17 00:00:00 2001 From: nobody Date: Wed, 4 Jan 2023 10:23:48 +0100 Subject: [PATCH 01/45] bump to 4.3.0 rc1 --- .gitignore | 1 + sources | 3 +-- yara-androguard.patch | 24 ------------------------ yara.spec | 42 +++++++++++++----------------------------- 4 files changed, 15 insertions(+), 55 deletions(-) delete mode 100644 yara-androguard.patch diff --git a/.gitignore b/.gitignore index ce68c2d..32c4f50 100644 --- a/.gitignore +++ b/.gitignore @@ -29,3 +29,4 @@ /yara-4.2.1.tar.gz /yara-4.2.2.tar.gz /yara-4.2.3.tar.gz +/yara-4.3.0-rc1.tar.gz diff --git a/sources b/sources index 84a7020..256cc62 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (yara-4.2.3.tar.gz) = 1df23837d14d3f9f72db901190e7412241514a8914d72b753df32ad8a44c7a49ad8f14941a95de83754e4d1dd0f23d712d8e6a43916343341b92cb1bc66f3c09 -SHA512 (androguard-yara-2020-04-22-3eea86a.tar.gz) = 827962b3c6f46cb9106e40156c85ec5a99fd0d4fa3584434b5ba60adbd8265df9c85d03172df36cc15a2a0983bad0297317b27e25372aa09121411e01c1d29be +SHA512 (yara-4.3.0-rc1.tar.gz) = 7df91e67e55aef6a0b637640f353ca6c40dad636665ac86c960ab5e9f3bedaaeb8a3f2e16712da11594ac7a6dd772eb79df18cd6c088d2b951db84faf85c1374 diff --git a/yara-androguard.patch b/yara-androguard.patch deleted file mode 100644 index b7ad794..0000000 --- a/yara-androguard.patch +++ /dev/null @@ -1,24 +0,0 @@ -diff --git a/libyara/Makefile.am b/libyara/Makefile.am -index 4fa363a..a9242b2 100644 ---- a/libyara/Makefile.am -+++ b/libyara/Makefile.am -@@ -48,6 +48,7 @@ MODULES += modules/pe/pe_utils.c - - if CUCKOO_MODULE - MODULES += modules/cuckoo/cuckoo.c -+MODULES += modules/androguard/androguard.c - endif - - if MAGIC_MODULE -diff --git a/libyara/modules/module_list b/libyara/modules/module_list -index d81b8f3..ba43609 100644 ---- a/libyara/modules/module_list -+++ b/libyara/modules/module_list -@@ -10,6 +10,7 @@ MODULE(dotnet) - - #ifdef CUCKOO_MODULE - MODULE(cuckoo) -+MODULE(androguard) - #endif - - #ifdef MAGIC_MODULE diff --git a/yara.spec b/yara.spec index a7cffc3..adf0926 100644 --- a/yara.spec +++ b/yara.spec @@ -1,6 +1,8 @@ Name: yara -Version: 4.2.3 -Release: 1%{?dist} +Version: 4.3.0 +%global upversion %{version}-rc1 + +Release: 0.rc1.1%{?dist} Summary: Pattern matching Swiss knife for malware researchers # yara package itself is licensed with BSD 3 clause license @@ -14,28 +16,17 @@ URL: https://VirusTotal.github.io/yara/ %global gituser VirusTotal %global gitname yara -# Commit of version 4.2.3 -%global commit ba94b4f8ebb6d56786d14f6a0f7529b32d7c216f +# Commit of version 4.3.0rc1 +%global commit 8b8384d15fc5358cee449d88070cc9c8be9ec4ce %global shortcommit %(c=%{commit}; echo ${c:0:7}) -# additional module for yara -%global androguard_gituser Koodous -%global androguard_gitname androguard-yara -# Commit from 2020-04-22 -%global androguard_commit 3eea86ae2c4ee6ad3cc1cb3c2711b03db078831a -%global androguard_shortcommit %(c=%{androguard_commit}; echo ${c:0:7}) -%global androguard_gitdate 2020-04-22 # Build from git commit baseline #Source0: https://github.com/%%{gituser}/%%{gitname}/archive/%%{commit}/%%{name}-%%{version}-%%{shortcommit}.tar.gz # Build from git release version -Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz +# Source0: https://github.com/%%{gituser}/%%{gitname}/archive/v%%{version}.tar.gz#/%%{name}-%%{version}.tar.gz +Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{upversion}.tar.gz#/%{name}-%{upversion}.tar.gz -# https://github.com/Koodous/androguard-yara/ -Source1: https://github.com/%{androguard_gituser}/%{androguard_gitname}/archive/%{androguard_commit}/%{androguard_gitname}-%{androguard_gitdate}-%{androguard_shortcommit}.tar.gz - -# Patch based on the androguard-yara installation guide to enable the androguard module -Patch0: yara-androguard.patch # Use default sphix theme to generate documentation rather than sphinx_rtd_theme # to avoid static installation of font files on fedora >= 24 @@ -96,18 +87,7 @@ developing applications that use %{name}. %prep # autosetup -n %%{gitname}-%%{commit} -p 1 -S git -%autosetup -n %{gitname}-%{version} -p 1 -S git - -# Add the Androguard module -# %%setup -qn %%{gitname}-%%{commit} -a 1 -D -T -%setup -n %{gitname}-%{version} -q -a 1 -D -T -pushd %{androguard_gitname}-%{androguard_commit} - -mkdir -p ../libyara/modules/androguard -cp -p androguard.c ../libyara/modules/androguard/ -popd - - +%autosetup -n %{gitname}-%{upversion} -p 1 -S git autoreconf --force --install @@ -174,6 +154,10 @@ make check %changelog +* Tue Jan 03 2023 Michal Ambroz - 4.3.0-0.rc1.1 +- bump to 4.3.0 rc1 +- remove the androguard module which is no longer available from github + * Tue Aug 09 2022 Mikel Olasagasti Uranga - 4.2.3-1 - Update to 4.2.3 (#2116594) From e1bcf94fe4024cf42f90f10b4d700c222ff8f241 Mon Sep 17 00:00:00 2001 From: nobody Date: Wed, 18 Jan 2023 10:44:53 +0100 Subject: [PATCH 02/45] provide more info if build fails due to checks --- yara.spec | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/yara.spec b/yara.spec index adf0926..3f7d2fb 100644 --- a/yara.spec +++ b/yara.spec @@ -52,10 +52,15 @@ BuildRequires: flex BuildRequires: libtool BuildRequires: file-devel BuildRequires: jansson-devel >= 2.5 -BuildRequires: openssl-devel BuildRequires: protobuf-c-devel BuildRequires: protobuf-compiler +%if 0%{?rhel} && 0%{?rhel} == 7 +BuildRequires: openssl11-devel +%else +BuildRequires: openssl-devel +%endif + # html doc generation BuildRequires: /usr/bin/sphinx-build @@ -128,7 +133,19 @@ rm -f %{buildroot}%{_datadir}/doc/%{name}/html/.buildinfo %endif %check -make check +%ifarch s390x + # test-pe and test-dotnet fails for x390x at this point + make check || ( + echo "===== ./test-suite.log" + [ -f ./test-suite.log ] && cat ./test-suite.log + echo "===== test-pe.log" + [ -f ./test-pe.log ] && cat ./test-pe.log + echo "===== test-dotnet.log" + [ -f ./test-dotnet.log ] && cat ./test-dotnet.log + ) +%else + make check +%endif %files From 51a2c01e449e46568906dcf60356211a3139d1b1 Mon Sep 17 00:00:00 2001 From: nobody Date: Thu, 19 Jan 2023 10:43:04 +0100 Subject: [PATCH 03/45] fix build for RHEL7 --- yara.spec | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/yara.spec b/yara.spec index 3f7d2fb..e17e599 100644 --- a/yara.spec +++ b/yara.spec @@ -43,6 +43,7 @@ BuildRequires: binutils BuildRequires: coreutils BuildRequires: sharutils BuildRequires: file +BuildRequires: sed BuildRequires: gawk BuildRequires: gzip BuildRequires: xz @@ -96,14 +97,18 @@ developing applications that use %{name}. autoreconf --force --install + + + %build -# Add missing definition on RHEL7 +# Add missing protobuf definition on RHEL7, and also configure for the libcrypto11/openssl11 from EPEL %if 0%{?rhel} && 0%{?rhel} == 7 -export CFLAGS="$CFLAGS -D PROTOBUF_C_FIELD_FLAG_ONEOF=4" +export CFLAGS="%{optflags} -D PROTOBUF_C_FIELD_FLAG_ONEOF=4 $(pkg-config --cflags libcrypto11)" +export LDFLAGS="$LDFLAGS $(pkg-config --libs libcrypto11)" %endif -# macro %%configure already does use CFLAGS="\{optflags}" and yara build +# macro %%configure already does use CFLAGS="%%{optflags}" and yara build # scripts configure/make already honors that CFLAGS %configure --enable-magic --enable-cuckoo --enable-debug --enable-dotnet \ --enable-macho --enable-dex --enable-pb-tests \ @@ -133,20 +138,18 @@ rm -f %{buildroot}%{_datadir}/doc/%{name}/html/.buildinfo %endif %check +# test-pe fails for RHEL9 +make check || ( + echo "===== ./test-suite.log" + [ -f ./test-suite.log ] && cat ./test-suite.log %ifarch s390x # test-pe and test-dotnet fails for x390x at this point - make check || ( - echo "===== ./test-suite.log" - [ -f ./test-suite.log ] && cat ./test-suite.log - echo "===== test-pe.log" - [ -f ./test-pe.log ] && cat ./test-pe.log - echo "===== test-dotnet.log" - [ -f ./test-dotnet.log ] && cat ./test-dotnet.log - ) + true %else - make check + # test-pe fails for RHEL9 x86 at this point + false %endif - +) %files %license COPYING From 8e2b994c1236f3d19f54180aea093cf934bddc3d Mon Sep 17 00:00:00 2001 From: nobody Date: Fri, 20 Jan 2023 01:16:56 +0100 Subject: [PATCH 04/45] more verbose output on failed make check --- yara.spec | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/yara.spec b/yara.spec index e17e599..7b31ab3 100644 --- a/yara.spec +++ b/yara.spec @@ -138,15 +138,22 @@ rm -f %{buildroot}%{_datadir}/doc/%{name}/html/.buildinfo %endif %check -# test-pe fails for RHEL9 make check || ( + # print more verbose info in case the test(s) fail echo "===== ./test-suite.log" [ -f ./test-suite.log ] && cat ./test-suite.log + echo "===== /proc/cpu" + head -n 35 /proc/cpuinfo + echo "===== /etc/os-release" + cat /etc/os-release + echo "===== uname -a" + uname -a + %ifarch s390x - # test-pe and test-dotnet fails for x390x at this point + # test-pe and test-dotnet fails for x390x at this point - ignored for rc1 true %else - # test-pe fails for RHEL9 x86 at this point + # test-pe fails for RHEL9 x86 at this point in copr false %endif ) From 8407c9c4c52f2cfb89eeb1bb6c2f3a49d6056f9c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 21 Jan 2023 08:02:32 +0000 Subject: [PATCH 05/45] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- yara.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/yara.spec b/yara.spec index 3f7d2fb..212a1f1 100644 --- a/yara.spec +++ b/yara.spec @@ -2,7 +2,7 @@ Name: yara Version: 4.3.0 %global upversion %{version}-rc1 -Release: 0.rc1.1%{?dist} +Release: 0.rc1.1%{?dist}.1 Summary: Pattern matching Swiss knife for malware researchers # yara package itself is licensed with BSD 3 clause license @@ -171,6 +171,9 @@ rm -f %{buildroot}%{_datadir}/doc/%{name}/html/.buildinfo %changelog +* Sat Jan 21 2023 Fedora Release Engineering - 4.3.0-0.rc1.1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Tue Jan 03 2023 Michal Ambroz - 4.3.0-0.rc1.1 - bump to 4.3.0 rc1 - remove the androguard module which is no longer available from github From ae883bfd1f65210565f6be24fdcf6487107fba1d Mon Sep 17 00:00:00 2001 From: nobody Date: Sat, 21 Jan 2023 16:48:11 +0100 Subject: [PATCH 06/45] fix EPEL7 build, partially fix s390x bigendian issue --- yara.spec | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/yara.spec b/yara.spec index 7b31ab3..8dce7ea 100644 --- a/yara.spec +++ b/yara.spec @@ -2,7 +2,7 @@ Name: yara Version: 4.3.0 %global upversion %{version}-rc1 -Release: 0.rc1.1%{?dist} +Release: 0.rc1.2%{?dist} Summary: Pattern matching Swiss knife for malware researchers # yara package itself is licensed with BSD 3 clause license @@ -32,7 +32,10 @@ Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{upversion}.t # to avoid static installation of font files on fedora >= 24 Patch1: yara-docs-theme.patch - +# https://github.com/VirusTotal/yara/commit/90c43e24f0dedd130bea199e6c23094271c3f491 +# test-pe fails on s390x +Patch2: https://github.com/VirusTotal/yara/commit/90c43e24f0dedd130bea199e6c23094271c3f491.patch#/yara-4.3.0-test-pe-s390x.patch +Patch3: https://github.com/VirusTotal/yara/commit/d1a6ef20c049d86a136111dce53b4eb65c4df1bd.patch#/yara-4.3.0-test-pe2-s390x.patch BuildRequires: git BuildRequires: gcc @@ -142,6 +145,7 @@ make check || ( # print more verbose info in case the test(s) fail echo "===== ./test-suite.log" [ -f ./test-suite.log ] && cat ./test-suite.log + # Build in COPR lacking the hwinfo.log echo "===== /proc/cpu" head -n 35 /proc/cpuinfo echo "===== /etc/os-release" @@ -153,7 +157,7 @@ make check || ( # test-pe and test-dotnet fails for x390x at this point - ignored for rc1 true %else - # test-pe fails for RHEL9 x86 at this point in copr + # test-pe fails for RHEL9 x86-64 at this point in copr on "AMD EPYC" cpu, it doesn't affect Fedora build on Intel CPU false %endif ) @@ -181,6 +185,9 @@ make check || ( %changelog +* Tue Jan 03 2023 Michal Ambroz - 4.3.0-0.rc1.2 +- fix EPEL7 build + * Tue Jan 03 2023 Michal Ambroz - 4.3.0-0.rc1.1 - bump to 4.3.0 rc1 - remove the androguard module which is no longer available from github From 3e1ef1d276ce0fea55c365e26ac60439e45d92f9 Mon Sep 17 00:00:00 2001 From: nobody Date: Sat, 21 Jan 2023 16:49:07 +0100 Subject: [PATCH 07/45] add partial s390x fix --- yara-4.3.0-test-pe-s390x.patch | 393 ++++++++++++++++++++++++++++++++ yara-4.3.0-test-pe2-s390x.patch | 24 ++ 2 files changed, 417 insertions(+) create mode 100644 yara-4.3.0-test-pe-s390x.patch create mode 100644 yara-4.3.0-test-pe2-s390x.patch diff --git a/yara-4.3.0-test-pe-s390x.patch b/yara-4.3.0-test-pe-s390x.patch new file mode 100644 index 0000000..76630e0 --- /dev/null +++ b/yara-4.3.0-test-pe-s390x.patch @@ -0,0 +1,393 @@ +From 90c43e24f0dedd130bea199e6c23094271c3f491 Mon Sep 17 00:00:00 2001 +From: "Victor M. Alvarez" +Date: Fri, 20 Jan 2023 10:24:55 +0100 +Subject: [PATCH] Try fixing issue #1855. + +PR #1768 added RVA field to function details in PE module. The new code had the following line: + +``` +rva_address = yr_le64toh(import_descriptor->FirstThunk + (sizeof(uint64_t) * func_idx)); +``` + +The `yr_le64toh` should be used for converting the value of `import_descriptor->FirstThunk` from little-endian to the host's endianness *before* performing the add operation. However, the addition was performed before the conversion. + +This may be the cause of some test cases failing in big endian platforms. +--- + libyara/modules/pe/pe.c | 137 ++++++++++++++++++++++++++-------------- + 1 file changed, 89 insertions(+), 48 deletions(-) + +diff --git a/libyara/modules/pe/pe.c b/libyara/modules/pe/pe.c +index 61da53cc0..354c6a103 100644 +--- a/libyara/modules/pe/pe.c ++++ b/libyara/modules/pe/pe.c +@@ -837,7 +837,8 @@ static IMPORT_FUNCTION* pe_parse_import_descriptor( + has_ordinal = 1; + } + +- rva_address = yr_le64toh(import_descriptor->FirstThunk + (sizeof(uint64_t) * func_idx)); ++ rva_address = yr_le64toh(import_descriptor->FirstThunk) + ++ (sizeof(uint64_t) * func_idx); + + if (name != NULL || has_ordinal == 1) + { +@@ -911,7 +912,8 @@ static IMPORT_FUNCTION* pe_parse_import_descriptor( + has_ordinal = 1; + } + +- rva_address = yr_le32toh(import_descriptor->FirstThunk + (sizeof(uint32_t) * func_idx)); ++ rva_address = yr_le32toh( ++ import_descriptor->FirstThunk + (sizeof(uint32_t) * func_idx)); + + if (name != NULL || has_ordinal == 1) + { +@@ -1013,7 +1015,8 @@ void pe_set_imports( + { + yr_set_string(func->name, pe->object, fun_name, dll_cnt, fun_cnt); + if (func->has_ordinal) +- yr_set_integer(func->ordinal, pe->object, fun_ordinal, dll_cnt, fun_cnt); ++ yr_set_integer( ++ func->ordinal, pe->object, fun_ordinal, dll_cnt, fun_cnt); + else + yr_set_integer(YR_UNDEFINED, pe->object, fun_ordinal, dll_cnt, fun_cnt); + if (func->rva) +@@ -1114,7 +1117,8 @@ static IMPORTED_DLL* pe_parse_imports(PE* pe) + } + + yr_set_integer(num_imports, pe->object, "number_of_imports"); +- yr_set_integer(num_function_imports, pe->object, "number_of_imported_functions"); ++ yr_set_integer( ++ num_function_imports, pe->object, "number_of_imported_functions"); + pe_set_imports( + pe, + head, +@@ -1369,7 +1373,7 @@ static void* pe_parse_delayed_imports(PE* pe) + imported_func->has_ordinal = 1; + } + +- imported_func->rva = yr_le64toh(func_rva); ++ imported_func->rva = yr_le64toh(func_rva); + + num_function_imports++; + name_rva += pointer_size; +@@ -1628,19 +1632,22 @@ static void pe_parse_exports(PE* pe) + for (int j = 0; j < cert->sha1.len; ++j) \ + sprintf(thumbprint_ascii + (j * 2), "%02x", cert->sha1.data[j]); \ + \ +- yr_set_string( \ ++ yr_set_string( \ + (char*) thumbprint_ascii, pe->object, fmt ".thumbprint", __VA_ARGS__); \ + \ +- yr_set_string(cert->issuer, pe->object, fmt ".issuer", __VA_ARGS__); \ +- yr_set_string(cert->subject, pe->object, fmt ".subject", __VA_ARGS__); \ ++ yr_set_string(cert->issuer, pe->object, fmt ".issuer", __VA_ARGS__); \ ++ yr_set_string(cert->subject, pe->object, fmt ".subject", __VA_ARGS__); \ + /* Versions are zero based, so add one. */ \ +- yr_set_integer(cert->version + 1, pe->object, fmt ".version", __VA_ARGS__); \ +- yr_set_string(cert->sig_alg, pe->object, fmt ".algorithm", __VA_ARGS__); \ +- yr_set_string( \ ++ yr_set_integer( \ ++ cert->version + 1, pe->object, fmt ".version", __VA_ARGS__); \ ++ yr_set_string(cert->sig_alg, pe->object, fmt ".algorithm", __VA_ARGS__); \ ++ yr_set_string( \ + cert->sig_alg_oid, pe->object, fmt ".algorithm_oid", __VA_ARGS__); \ +- yr_set_string(cert->serial, pe->object, fmt ".serial", __VA_ARGS__); \ +- yr_set_integer(cert->not_before, pe->object, fmt ".not_before", __VA_ARGS__); \ +- yr_set_integer(cert->not_after, pe->object, fmt ".not_after", __VA_ARGS__); \ ++ yr_set_string(cert->serial, pe->object, fmt ".serial", __VA_ARGS__); \ ++ yr_set_integer( \ ++ cert->not_before, pe->object, fmt ".not_before", __VA_ARGS__); \ ++ yr_set_integer( \ ++ cert->not_after, pe->object, fmt ".not_after", __VA_ARGS__); \ + } while (0) + + void _process_authenticode( +@@ -1677,7 +1684,8 @@ void _process_authenticode( + for (int j = 0; j < authenticode->digest.len; ++j) + sprintf(digest_ascii + (j * 2), "%02x", authenticode->digest.data[j]); + +- yr_set_string(digest_ascii, pe->object, "signatures[%i].digest", *sig_count); ++ yr_set_string( ++ digest_ascii, pe->object, "signatures[%i].digest", *sig_count); + yr_free(digest_ascii); + } + +@@ -2101,7 +2109,8 @@ static void pe_parse_header(PE* pe, uint64_t base_address, int flags) + pe->object, + "size_of_headers"); + +- yr_set_integer(yr_le32toh(OptionalHeader(pe, CheckSum)), pe->object, "checksum"); ++ yr_set_integer( ++ yr_le32toh(OptionalHeader(pe, CheckSum)), pe->object, "checksum"); + + yr_set_integer( + yr_le16toh(OptionalHeader(pe, Subsystem)), pe->object, "subsystem"); +@@ -2291,7 +2300,8 @@ static void pe_parse_header(PE* pe, uint64_t base_address, int flags) + if (last_section_end && (pe->data_size > last_section_end)) + { + yr_set_integer(last_section_end, pe->object, "overlay.offset"); +- yr_set_integer(pe->data_size - last_section_end, pe->object, "overlay.size"); ++ yr_set_integer( ++ pe->data_size - last_section_end, pe->object, "overlay.size"); + } + else + { +@@ -3058,7 +3068,8 @@ define_function(delayed_import_rva) + + for (int i = 0; i < num_imports; i++) + { +- dll_name = yr_get_string(module, "delayed_import_details[%i].library_name", i); ++ dll_name = yr_get_string( ++ module, "delayed_import_details[%i].library_name", i); + if (dll_name == NULL || IS_UNDEFINED(dll_name) || + ss_compare(in_dll_name, dll_name) != 0) + continue; +@@ -3103,7 +3114,8 @@ define_function(delayed_import_rva_ordinal) + + for (int i = 0; i < num_imports; i++) + { +- dll_name = yr_get_string(module, "delayed_import_details[%i].library_name", i); ++ dll_name = yr_get_string( ++ module, "delayed_import_details[%i].library_name", i); + if (dll_name == NULL || IS_UNDEFINED(dll_name) || + ss_compare(in_dll_name, dll_name) != 0) + continue; +@@ -3148,7 +3160,8 @@ define_function(locale) + + for (int i = 0; i < n; i++) + { +- uint64_t rsrc_language = yr_get_integer(module, "resources[%i].language", i); ++ uint64_t rsrc_language = yr_get_integer( ++ module, "resources[%i].language", i); + + if ((rsrc_language & 0xFFFF) == locale) + return_integer(1); +@@ -3176,7 +3189,8 @@ define_function(language) + + for (int i = 0; i < n; i++) + { +- uint64_t rsrc_language = yr_get_integer(module, "resources[%i].language", i); ++ uint64_t rsrc_language = yr_get_integer( ++ module, "resources[%i].language", i); + + if ((rsrc_language & 0xFF) == language) + return_integer(1); +@@ -3754,7 +3768,8 @@ begin_declarations + declare_string("digest"); + declare_string("file_digest"); + declare_integer("number_of_certificates"); +- begin_struct_array("certificates"); ++ begin_struct_array("certificates") ++ ; + declare_string("thumbprint"); + declare_string("issuer"); + declare_string("subject"); +@@ -3766,12 +3781,14 @@ begin_declarations + declare_integer("not_after"); + end_struct_array("certificates"); + +- begin_struct("signer_info"); ++ begin_struct("signer_info") ++ ; + declare_string("program_name"); + declare_string("digest"); + declare_string("digest_alg"); + declare_integer("length_of_chain"); +- begin_struct_array("chain"); ++ begin_struct_array("chain") ++ ; + declare_string("thumbprint"); + declare_string("issuer"); + declare_string("subject"); +@@ -3785,13 +3802,15 @@ begin_declarations + end_struct("signer_info"); + + declare_integer("number_of_countersignatures"); +- begin_struct_array("countersignatures"); ++ begin_struct_array("countersignatures") ++ ; + declare_integer("verified"); + declare_integer("sign_time"); + declare_string("digest_alg"); + declare_string("digest"); + declare_integer("length_of_chain"); +- begin_struct_array("chain"); ++ begin_struct_array("chain") ++ ; + declare_string("thumbprint"); + declare_string("issuer"); + declare_string("subject"); +@@ -3860,16 +3879,19 @@ int module_load( + yr_set_integer(IMAGE_FILE_MACHINE_M32R, module_object, "MACHINE_M32R"); + yr_set_integer(IMAGE_FILE_MACHINE_MIPS16, module_object, "MACHINE_MIPS16"); + yr_set_integer(IMAGE_FILE_MACHINE_MIPSFPU, module_object, "MACHINE_MIPSFPU"); +- yr_set_integer(IMAGE_FILE_MACHINE_MIPSFPU16, module_object, "MACHINE_MIPSFPU16"); ++ yr_set_integer( ++ IMAGE_FILE_MACHINE_MIPSFPU16, module_object, "MACHINE_MIPSFPU16"); + yr_set_integer(IMAGE_FILE_MACHINE_POWERPC, module_object, "MACHINE_POWERPC"); +- yr_set_integer(IMAGE_FILE_MACHINE_POWERPCFP, module_object, "MACHINE_POWERPCFP"); ++ yr_set_integer( ++ IMAGE_FILE_MACHINE_POWERPCFP, module_object, "MACHINE_POWERPCFP"); + yr_set_integer(IMAGE_FILE_MACHINE_R4000, module_object, "MACHINE_R4000"); + yr_set_integer(IMAGE_FILE_MACHINE_SH3, module_object, "MACHINE_SH3"); + yr_set_integer(IMAGE_FILE_MACHINE_SH3DSP, module_object, "MACHINE_SH3DSP"); + yr_set_integer(IMAGE_FILE_MACHINE_SH4, module_object, "MACHINE_SH4"); + yr_set_integer(IMAGE_FILE_MACHINE_SH5, module_object, "MACHINE_SH5"); + yr_set_integer(IMAGE_FILE_MACHINE_THUMB, module_object, "MACHINE_THUMB"); +- yr_set_integer(IMAGE_FILE_MACHINE_WCEMIPSV2, module_object, "MACHINE_WCEMIPSV2"); ++ yr_set_integer( ++ IMAGE_FILE_MACHINE_WCEMIPSV2, module_object, "MACHINE_WCEMIPSV2"); + yr_set_integer( + IMAGE_FILE_MACHINE_TARGET_HOST, module_object, "MACHINE_TARGET_HOST"); + yr_set_integer(IMAGE_FILE_MACHINE_R3000, module_object, "MACHINE_R3000"); +@@ -3889,7 +3911,8 @@ int module_load( + yr_set_integer( + IMAGE_SUBSYSTEM_WINDOWS_CUI, module_object, "SUBSYSTEM_WINDOWS_CUI"); + yr_set_integer(IMAGE_SUBSYSTEM_OS2_CUI, module_object, "SUBSYSTEM_OS2_CUI"); +- yr_set_integer(IMAGE_SUBSYSTEM_POSIX_CUI, module_object, "SUBSYSTEM_POSIX_CUI"); ++ yr_set_integer( ++ IMAGE_SUBSYSTEM_POSIX_CUI, module_object, "SUBSYSTEM_POSIX_CUI"); + yr_set_integer( + IMAGE_SUBSYSTEM_NATIVE_WINDOWS, + module_object, +@@ -3928,14 +3951,16 @@ int module_load( + IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY, + module_object, + "FORCE_INTEGRITY"); +- yr_set_integer(IMAGE_DLLCHARACTERISTICS_NX_COMPAT, module_object, "NX_COMPAT"); ++ yr_set_integer( ++ IMAGE_DLLCHARACTERISTICS_NX_COMPAT, module_object, "NX_COMPAT"); + yr_set_integer( + IMAGE_DLLCHARACTERISTICS_NO_ISOLATION, module_object, "NO_ISOLATION"); + yr_set_integer(IMAGE_DLLCHARACTERISTICS_NO_SEH, module_object, "NO_SEH"); + yr_set_integer(IMAGE_DLLCHARACTERISTICS_NO_BIND, module_object, "NO_BIND"); + yr_set_integer( + IMAGE_DLLCHARACTERISTICS_APPCONTAINER, module_object, "APPCONTAINER"); +- yr_set_integer(IMAGE_DLLCHARACTERISTICS_WDM_DRIVER, module_object, "WDM_DRIVER"); ++ yr_set_integer( ++ IMAGE_DLLCHARACTERISTICS_WDM_DRIVER, module_object, "WDM_DRIVER"); + yr_set_integer(IMAGE_DLLCHARACTERISTICS_GUARD_CF, module_object, "GUARD_CF"); + yr_set_integer( + IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE, +@@ -3943,26 +3968,31 @@ int module_load( + "TERMINAL_SERVER_AWARE"); + + yr_set_integer(IMAGE_FILE_RELOCS_STRIPPED, module_object, "RELOCS_STRIPPED"); +- yr_set_integer(IMAGE_FILE_EXECUTABLE_IMAGE, module_object, "EXECUTABLE_IMAGE"); ++ yr_set_integer( ++ IMAGE_FILE_EXECUTABLE_IMAGE, module_object, "EXECUTABLE_IMAGE"); + yr_set_integer( + IMAGE_FILE_LINE_NUMS_STRIPPED, module_object, "LINE_NUMS_STRIPPED"); + yr_set_integer( + IMAGE_FILE_LOCAL_SYMS_STRIPPED, module_object, "LOCAL_SYMS_STRIPPED"); +- yr_set_integer(IMAGE_FILE_AGGRESIVE_WS_TRIM, module_object, "AGGRESIVE_WS_TRIM"); ++ yr_set_integer( ++ IMAGE_FILE_AGGRESIVE_WS_TRIM, module_object, "AGGRESIVE_WS_TRIM"); + yr_set_integer( + IMAGE_FILE_LARGE_ADDRESS_AWARE, module_object, "LARGE_ADDRESS_AWARE"); +- yr_set_integer(IMAGE_FILE_BYTES_REVERSED_LO, module_object, "BYTES_REVERSED_LO"); ++ yr_set_integer( ++ IMAGE_FILE_BYTES_REVERSED_LO, module_object, "BYTES_REVERSED_LO"); + yr_set_integer(IMAGE_FILE_32BIT_MACHINE, module_object, "MACHINE_32BIT"); + yr_set_integer(IMAGE_FILE_DEBUG_STRIPPED, module_object, "DEBUG_STRIPPED"); + yr_set_integer( + IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP, + module_object, + "REMOVABLE_RUN_FROM_SWAP"); +- yr_set_integer(IMAGE_FILE_NET_RUN_FROM_SWAP, module_object, "NET_RUN_FROM_SWAP"); ++ yr_set_integer( ++ IMAGE_FILE_NET_RUN_FROM_SWAP, module_object, "NET_RUN_FROM_SWAP"); + yr_set_integer(IMAGE_FILE_SYSTEM, module_object, "SYSTEM"); + yr_set_integer(IMAGE_FILE_DLL, module_object, "DLL"); + yr_set_integer(IMAGE_FILE_UP_SYSTEM_ONLY, module_object, "UP_SYSTEM_ONLY"); +- yr_set_integer(IMAGE_FILE_BYTES_REVERSED_HI, module_object, "BYTES_REVERSED_HI"); ++ yr_set_integer( ++ IMAGE_FILE_BYTES_REVERSED_HI, module_object, "BYTES_REVERSED_HI"); + + yr_set_integer( + IMAGE_DIRECTORY_ENTRY_EXPORT, +@@ -4056,7 +4086,8 @@ int module_load( + IMAGE_SCN_NO_DEFER_SPEC_EXC, module_object, "SECTION_NO_DEFER_SPEC_EXC"); + yr_set_integer(IMAGE_SCN_GPREL, module_object, "SECTION_GPREL"); + yr_set_integer(IMAGE_SCN_MEM_FARDATA, module_object, "SECTION_MEM_FARDATA"); +- yr_set_integer(IMAGE_SCN_MEM_PURGEABLE, module_object, "SECTION_MEM_PURGEABLE"); ++ yr_set_integer( ++ IMAGE_SCN_MEM_PURGEABLE, module_object, "SECTION_MEM_PURGEABLE"); + yr_set_integer(IMAGE_SCN_MEM_16BIT, module_object, "SECTION_MEM_16BIT"); + yr_set_integer(IMAGE_SCN_MEM_LOCKED, module_object, "SECTION_MEM_LOCKED"); + yr_set_integer(IMAGE_SCN_MEM_PRELOAD, module_object, "SECTION_MEM_PRELOAD"); +@@ -4064,9 +4095,12 @@ int module_load( + yr_set_integer(IMAGE_SCN_ALIGN_2BYTES, module_object, "SECTION_ALIGN_2BYTES"); + yr_set_integer(IMAGE_SCN_ALIGN_4BYTES, module_object, "SECTION_ALIGN_4BYTES"); + yr_set_integer(IMAGE_SCN_ALIGN_8BYTES, module_object, "SECTION_ALIGN_8BYTES"); +- yr_set_integer(IMAGE_SCN_ALIGN_16BYTES, module_object, "SECTION_ALIGN_16BYTES"); +- yr_set_integer(IMAGE_SCN_ALIGN_32BYTES, module_object, "SECTION_ALIGN_32BYTES"); +- yr_set_integer(IMAGE_SCN_ALIGN_64BYTES, module_object, "SECTION_ALIGN_64BYTES"); ++ yr_set_integer( ++ IMAGE_SCN_ALIGN_16BYTES, module_object, "SECTION_ALIGN_16BYTES"); ++ yr_set_integer( ++ IMAGE_SCN_ALIGN_32BYTES, module_object, "SECTION_ALIGN_32BYTES"); ++ yr_set_integer( ++ IMAGE_SCN_ALIGN_64BYTES, module_object, "SECTION_ALIGN_64BYTES"); + yr_set_integer( + IMAGE_SCN_ALIGN_128BYTES, module_object, "SECTION_ALIGN_128BYTES"); + yr_set_integer( +@@ -4088,7 +4122,8 @@ int module_load( + IMAGE_SCN_MEM_DISCARDABLE, module_object, "SECTION_MEM_DISCARDABLE"); + yr_set_integer( + IMAGE_SCN_MEM_NOT_CACHED, module_object, "SECTION_MEM_NOT_CACHED"); +- yr_set_integer(IMAGE_SCN_MEM_NOT_PAGED, module_object, "SECTION_MEM_NOT_PAGED"); ++ yr_set_integer( ++ IMAGE_SCN_MEM_NOT_PAGED, module_object, "SECTION_MEM_NOT_PAGED"); + yr_set_integer(IMAGE_SCN_MEM_SHARED, module_object, "SECTION_MEM_SHARED"); + yr_set_integer(IMAGE_SCN_MEM_EXECUTE, module_object, "SECTION_MEM_EXECUTE"); + yr_set_integer(IMAGE_SCN_MEM_READ, module_object, "SECTION_MEM_READ"); +@@ -4115,13 +4150,15 @@ int module_load( + yr_set_integer(RESOURCE_TYPE_VERSION, module_object, "RESOURCE_TYPE_VERSION"); + yr_set_integer( + RESOURCE_TYPE_DLGINCLUDE, module_object, "RESOURCE_TYPE_DLGINCLUDE"); +- yr_set_integer(RESOURCE_TYPE_PLUGPLAY, module_object, "RESOURCE_TYPE_PLUGPLAY"); ++ yr_set_integer( ++ RESOURCE_TYPE_PLUGPLAY, module_object, "RESOURCE_TYPE_PLUGPLAY"); + yr_set_integer(RESOURCE_TYPE_VXD, module_object, "RESOURCE_TYPE_VXD"); + yr_set_integer( + RESOURCE_TYPE_ANICURSOR, module_object, "RESOURCE_TYPE_ANICURSOR"); + yr_set_integer(RESOURCE_TYPE_ANIICON, module_object, "RESOURCE_TYPE_ANIICON"); + yr_set_integer(RESOURCE_TYPE_HTML, module_object, "RESOURCE_TYPE_HTML"); +- yr_set_integer(RESOURCE_TYPE_MANIFEST, module_object, "RESOURCE_TYPE_MANIFEST"); ++ yr_set_integer( ++ RESOURCE_TYPE_MANIFEST, module_object, "RESOURCE_TYPE_MANIFEST"); + + yr_set_integer( + IMAGE_DEBUG_TYPE_UNKNOWN, module_object, "IMAGE_DEBUG_TYPE_UNKNOWN"); +@@ -4132,7 +4169,8 @@ int module_load( + yr_set_integer(IMAGE_DEBUG_TYPE_MISC, module_object, "IMAGE_DEBUG_TYPE_MISC"); + yr_set_integer( + IMAGE_DEBUG_TYPE_EXCEPTION, module_object, "IMAGE_DEBUG_TYPE_EXCEPTION"); +- yr_set_integer(IMAGE_DEBUG_TYPE_FIXUP, module_object, "IMAGE_DEBUG_TYPE_FIXUP"); ++ yr_set_integer( ++ IMAGE_DEBUG_TYPE_FIXUP, module_object, "IMAGE_DEBUG_TYPE_FIXUP"); + yr_set_integer( + IMAGE_DEBUG_TYPE_OMAP_TO_SRC, + module_object, +@@ -4147,15 +4185,18 @@ int module_load( + IMAGE_DEBUG_TYPE_RESERVED10, + module_object, + "IMAGE_DEBUG_TYPE_RESERVED10"); +- yr_set_integer(IMAGE_DEBUG_TYPE_CLSID, module_object, "IMAGE_DEBUG_TYPE_CLSID"); ++ yr_set_integer( ++ IMAGE_DEBUG_TYPE_CLSID, module_object, "IMAGE_DEBUG_TYPE_CLSID"); + yr_set_integer( + IMAGE_DEBUG_TYPE_VC_FEATURE, + module_object, + "IMAGE_DEBUG_TYPE_VC_FEATURE"); + yr_set_integer(IMAGE_DEBUG_TYPE_POGO, module_object, "IMAGE_DEBUG_TYPE_POGO"); +- yr_set_integer(IMAGE_DEBUG_TYPE_ILTCG, module_object, "IMAGE_DEBUG_TYPE_ILTCG"); ++ yr_set_integer( ++ IMAGE_DEBUG_TYPE_ILTCG, module_object, "IMAGE_DEBUG_TYPE_ILTCG"); + yr_set_integer(IMAGE_DEBUG_TYPE_MPX, module_object, "IMAGE_DEBUG_TYPE_MPX"); +- yr_set_integer(IMAGE_DEBUG_TYPE_REPRO, module_object, "IMAGE_DEBUG_TYPE_REPRO"); ++ yr_set_integer( ++ IMAGE_DEBUG_TYPE_REPRO, module_object, "IMAGE_DEBUG_TYPE_REPRO"); + + yr_set_integer(0, module_object, "is_pe"); + diff --git a/yara-4.3.0-test-pe2-s390x.patch b/yara-4.3.0-test-pe2-s390x.patch new file mode 100644 index 0000000..d128b61 --- /dev/null +++ b/yara-4.3.0-test-pe2-s390x.patch @@ -0,0 +1,24 @@ +From d1a6ef20c049d86a136111dce53b4eb65c4df1bd Mon Sep 17 00:00:00 2001 +From: "Victor M. Alvarez" +Date: Fri, 20 Jan 2023 19:41:36 +0100 +Subject: [PATCH] Fix another issue with `yr_le32toh` used incorrectly. + +--- + libyara/modules/pe/pe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/libyara/modules/pe/pe.c b/libyara/modules/pe/pe.c +index 354c6a103..181a36879 100644 +--- a/libyara/modules/pe/pe.c ++++ b/libyara/modules/pe/pe.c +@@ -912,8 +912,8 @@ static IMPORT_FUNCTION* pe_parse_import_descriptor( + has_ordinal = 1; + } + +- rva_address = yr_le32toh( +- import_descriptor->FirstThunk + (sizeof(uint32_t) * func_idx)); ++ rva_address = yr_le32toh(import_descriptor->FirstThunk) + ++ (sizeof(uint32_t) * func_idx); + + if (name != NULL || has_ordinal == 1) + { From ea4109aa72d21fe59d7db4e1bf67ed4d80ebdfc5 Mon Sep 17 00:00:00 2001 From: nobody Date: Sat, 21 Jan 2023 17:54:26 +0100 Subject: [PATCH 08/45] fix wrong data in the changelog --- yara.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/yara.spec b/yara.spec index d8baf19..8f6c38d 100644 --- a/yara.spec +++ b/yara.spec @@ -185,7 +185,7 @@ make check || ( %changelog -* Tue Jan 03 2023 Michal Ambroz - 4.3.0-0.rc1.2 +* Tue Jan 21 2023 Michal Ambroz - 4.3.0-0.rc1.2 - fix EPEL7 build * Sat Jan 21 2023 Fedora Release Engineering - 4.3.0-0.rc1.1.1 From 89a3718502ec7aff67bdfb25df38554f9bcfd15d Mon Sep 17 00:00:00 2001 From: nobody Date: Sat, 21 Jan 2023 17:56:32 +0100 Subject: [PATCH 09/45] fix wrong date in the changelog --- yara.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/yara.spec b/yara.spec index 8f6c38d..6a2f7f1 100644 --- a/yara.spec +++ b/yara.spec @@ -185,7 +185,7 @@ make check || ( %changelog -* Tue Jan 21 2023 Michal Ambroz - 4.3.0-0.rc1.2 +* Sat Jan 21 2023 Michal Ambroz - 4.3.0-0.rc1.2 - fix EPEL7 build * Sat Jan 21 2023 Fedora Release Engineering - 4.3.0-0.rc1.1.1 From e8ce13d6c32e362f29b922b15ecdbf63921feb08 Mon Sep 17 00:00:00 2001 From: nobody Date: Tue, 24 Jan 2023 01:30:37 +0100 Subject: [PATCH 10/45] fix make check on EPEL9 (and possibly future Fedoras) --- yara.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/yara.spec b/yara.spec index 6a2f7f1..0a61e27 100644 --- a/yara.spec +++ b/yara.spec @@ -2,7 +2,7 @@ Name: yara Version: 4.3.0 %global upversion %{version}-rc1 -Release: 0.rc1.2%{?dist} +Release: 0.rc1.3%{?dist} Summary: Pattern matching Swiss knife for malware researchers # yara package itself is licensed with BSD 3 clause license @@ -141,6 +141,8 @@ rm -f %{buildroot}%{_datadir}/doc/%{name}/html/.buildinfo %endif %check +# reenable the validation of SHA1 certificates in OPENSSL (RHEL9 disabled that by default) +export OPENSSL_ENABLE_SHA1_SIGNATURES=yes make check || ( # print more verbose info in case the test(s) fail echo "===== ./test-suite.log" @@ -157,7 +159,6 @@ make check || ( # test-pe and test-dotnet fails for x390x at this point - ignored for rc1 true %else - # test-pe fails for RHEL9 x86-64 at this point in copr on "AMD EPYC" cpu, it doesn't affect Fedora build on Intel CPU false %endif ) @@ -185,6 +186,9 @@ make check || ( %changelog +* Mon Jan 24 2023 Michal Ambroz - 4.3.0-0.rc1.3 +- fix EPEL9 build = reenable the SHA1 certificate validation in OpenSSL for make check + * Sat Jan 21 2023 Michal Ambroz - 4.3.0-0.rc1.2 - fix EPEL7 build From 1848b165ac2dd28b5e911165ce7733c3e3b79bfc Mon Sep 17 00:00:00 2001 From: nobody Date: Tue, 24 Jan 2023 01:33:13 +0100 Subject: [PATCH 11/45] fix bogus date --- yara.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/yara.spec b/yara.spec index 0a61e27..445c6c9 100644 --- a/yara.spec +++ b/yara.spec @@ -186,7 +186,7 @@ make check || ( %changelog -* Mon Jan 24 2023 Michal Ambroz - 4.3.0-0.rc1.3 +* Tue Jan 24 2023 Michal Ambroz - 4.3.0-0.rc1.3 - fix EPEL9 build = reenable the SHA1 certificate validation in OpenSSL for make check * Sat Jan 21 2023 Michal Ambroz - 4.3.0-0.rc1.2 From 330d466bfdee9c357c29efc5df3ad36fc1edf119 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Fri, 31 Mar 2023 00:16:36 +0200 Subject: [PATCH 12/45] bump to 4.3.0 --- .gitignore | 34 ++------------------------- sources | 2 +- yara.spec | 69 ++++++++++++++++++++++++++++++------------------------ 3 files changed, 41 insertions(+), 64 deletions(-) diff --git a/.gitignore b/.gitignore index 32c4f50..ee07a5a 100644 --- a/.gitignore +++ b/.gitignore @@ -1,32 +1,2 @@ -/androguard-yara-3.5.0-fc14c0f.tar.gz -/androguard-yara-3.6.0-e4cf5fa.tar.gz -/androguard-yara-3.6.2-e4cf5fa.tar.gz -/androguard-yara-3.6.3-e4cf5fa.tar.gz -/androguard-yara-e4cf5fa.tar.gz -/androguard-yara-fa11a84.tar.gz -/androguard-yara-3eea86a.tar.gz -/androguard-yara-2020-04-22-3eea86a.tar.gz -/yara-3.5.0-7473441.tar.gz -/yara-3.6.0.tar.gz -/yara-3.6.2.tar.gz -/yara-3.6.3.tar.gz -/yara-3.7.0.tar.gz -/yara-3.7.1.tar.gz -/yara-3.8.1.tar.gz -/yara-3.9.0.tar.gz -/yara-3.10.0.tar.gz -/yara-3.11.0.tar.gz -/yara-4.0.0.tar.gz -/yara-4.0.1.tar.gz -/yara-4.0.2.tar.gz -/yara-4.0.4.tar.gz -/yara-4.0.5.tar.gz -/yara-4.1.0.tar.gz -/yara-4.1.1.tar.gz -/yara-4.1.3.tar.gz -/yara-4.2.0-rc1.tar.gz -/yara-4.2.0.tar.gz -/yara-4.2.1.tar.gz -/yara-4.2.2.tar.gz -/yara-4.2.3.tar.gz -/yara-4.3.0-rc1.tar.gz +/androguard-yara-*.tar.gz +/yara-*.tar.gz diff --git a/sources b/sources index 256cc62..31775b1 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.3.0-rc1.tar.gz) = 7df91e67e55aef6a0b637640f353ca6c40dad636665ac86c960ab5e9f3bedaaeb8a3f2e16712da11594ac7a6dd772eb79df18cd6c088d2b951db84faf85c1374 +SHA512 (yara-4.3.0.tar.gz) = fe239ae2f29fac7b4dbdc0ec84eba057dd4d93c6ae3a53d6bc2a333cc15ed45b1ff5cb896faf02813be667ce191ccbe1d64549552ea4f0834804ad0ec4b29092 diff --git a/yara.spec b/yara.spec index 445c6c9..5fb5ff7 100644 --- a/yara.spec +++ b/yara.spec @@ -1,41 +1,50 @@ Name: yara Version: 4.3.0 -%global upversion %{version}-rc1 - -Release: 0.rc1.3%{?dist} +%global baserelease 1 Summary: Pattern matching Swiss knife for malware researchers +URL: https://VirusTotal.github.io/yara/ +VCS: https://github.com/VirusTotal/yara/ +# https://github.com/VirusTotal/yara/releases # yara package itself is licensed with BSD 3 clause license # bison grammar parsers in libyara/* are licensed with GPLv3+ license with exception from FSF alloving usage in larger work # resulting binary package licensed as BSD -License: BSD -VCS: https://github.com/VirusTotal/yara/ -# https://github.com/VirusTotal/yara/releases -URL: https://VirusTotal.github.io/yara/ +License: BSD-3-Clause + +%global common_description %{expand: +YARA is a tool aimed at (but not limited to) helping malware researchers to +identify and classify malware samples. With YARA you can create descriptions +of malware families (or whatever you want to describe) based on textual or +binary patterns. Each description, a.k.a rule, consists of a set of strings +and a Boolean expression which determine its logic. +} %global gituser VirusTotal %global gitname yara -# Commit of version 4.3.0rc1 -%global commit 8b8384d15fc5358cee449d88070cc9c8be9ec4ce +%global gitdate 20230322 +# Commit of version 4.3.0rc1 + fixes +%global commit 96790e56fc0fc0ce8598d215f969d8b7d8ca1015 %global shortcommit %(c=%{commit}; echo ${c:0:7}) +%bcond_without release + -# Build from git commit baseline -#Source0: https://github.com/%%{gituser}/%%{gitname}/archive/%%{commit}/%%{name}-%%{version}-%%{shortcommit}.tar.gz # Build from git release version -# Source0: https://github.com/%%{gituser}/%%{gitname}/archive/v%%{version}.tar.gz#/%%{name}-%%{version}.tar.gz -Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{upversion}.tar.gz#/%{name}-%{upversion}.tar.gz - +%if %{with release} +Release: %{baserelease}%{?dist} +# Source0: https://github.com/%%{gituser}/%%{gitname}/archive/v%%{upversion}.tar.gz#/%%{name}-%%{upversion}.tar.gz +Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz +%else +# Build from git commit baseline +Release: %{baserelease}.%{gitdate}git%{shortcommit}%{?dist} +Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz +%endif # Use default sphix theme to generate documentation rather than sphinx_rtd_theme # to avoid static installation of font files on fedora >= 24 Patch1: yara-docs-theme.patch -# https://github.com/VirusTotal/yara/commit/90c43e24f0dedd130bea199e6c23094271c3f491 -# test-pe fails on s390x -Patch2: https://github.com/VirusTotal/yara/commit/90c43e24f0dedd130bea199e6c23094271c3f491.patch#/yara-4.3.0-test-pe-s390x.patch -Patch3: https://github.com/VirusTotal/yara/commit/d1a6ef20c049d86a136111dce53b4eb65c4df1bd.patch#/yara-4.3.0-test-pe2-s390x.patch BuildRequires: git BuildRequires: gcc @@ -69,12 +78,7 @@ BuildRequires: openssl-devel BuildRequires: /usr/bin/sphinx-build %description -YARA is a tool aimed at (but not limited to) helping malware researchers to -identify and classify malware samples. With YARA you can create descriptions -of malware families (or whatever you want to describe) based on textual or -binary patterns. Each description, a.k.a rule, consists of a set of strings -and a Boolean expression which determine its logic. - +%{common_description} %package doc Summary: Documentation for %{name} @@ -82,6 +86,7 @@ BuildArch: noarch %description doc This package contains documentation for %{name}. +%{common_description} %package devel @@ -92,17 +97,16 @@ Requires: %{name}%{?_isa} = %{version}-%{release} %description devel The %{name}-devel package contains libraries and header files for developing applications that use %{name}. - +%{common_description} %prep -# autosetup -n %%{gitname}-%%{commit} -p 1 -S git -%autosetup -n %{gitname}-%{upversion} -p 1 -S git +%if %{with release} + %autosetup -n %{gitname}-%{version} -p 1 -S git +%else + %autosetup -n %{gitname}-%{commit} -p 1 -S git +%endif autoreconf --force --install - - - - %build # Add missing protobuf definition on RHEL7, and also configure for the libcrypto11/openssl11 from EPEL @@ -186,6 +190,9 @@ make check || ( %changelog +* Thu Mar 30 2023 Michal Ambroz - 4.3.0-1 +- bump to 4.3.0 + * Tue Jan 24 2023 Michal Ambroz - 4.3.0-0.rc1.3 - fix EPEL9 build = reenable the SHA1 certificate validation in OpenSSL for make check From dbd2ea6f4dfed46814b28041d0d3d4cbe8a8e109 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Fri, 31 Mar 2023 01:22:29 +0200 Subject: [PATCH 13/45] cleanup --- yara-4.3.0-test-pe-s390x.patch | 393 -------------------------------- yara-4.3.0-test-pe2-s390x.patch | 24 -- yara.spec | 3 +- 3 files changed, 1 insertion(+), 419 deletions(-) delete mode 100644 yara-4.3.0-test-pe-s390x.patch delete mode 100644 yara-4.3.0-test-pe2-s390x.patch diff --git a/yara-4.3.0-test-pe-s390x.patch b/yara-4.3.0-test-pe-s390x.patch deleted file mode 100644 index 76630e0..0000000 --- a/yara-4.3.0-test-pe-s390x.patch +++ /dev/null @@ -1,393 +0,0 @@ -From 90c43e24f0dedd130bea199e6c23094271c3f491 Mon Sep 17 00:00:00 2001 -From: "Victor M. Alvarez" -Date: Fri, 20 Jan 2023 10:24:55 +0100 -Subject: [PATCH] Try fixing issue #1855. - -PR #1768 added RVA field to function details in PE module. The new code had the following line: - -``` -rva_address = yr_le64toh(import_descriptor->FirstThunk + (sizeof(uint64_t) * func_idx)); -``` - -The `yr_le64toh` should be used for converting the value of `import_descriptor->FirstThunk` from little-endian to the host's endianness *before* performing the add operation. However, the addition was performed before the conversion. - -This may be the cause of some test cases failing in big endian platforms. ---- - libyara/modules/pe/pe.c | 137 ++++++++++++++++++++++++++-------------- - 1 file changed, 89 insertions(+), 48 deletions(-) - -diff --git a/libyara/modules/pe/pe.c b/libyara/modules/pe/pe.c -index 61da53cc0..354c6a103 100644 ---- a/libyara/modules/pe/pe.c -+++ b/libyara/modules/pe/pe.c -@@ -837,7 +837,8 @@ static IMPORT_FUNCTION* pe_parse_import_descriptor( - has_ordinal = 1; - } - -- rva_address = yr_le64toh(import_descriptor->FirstThunk + (sizeof(uint64_t) * func_idx)); -+ rva_address = yr_le64toh(import_descriptor->FirstThunk) + -+ (sizeof(uint64_t) * func_idx); - - if (name != NULL || has_ordinal == 1) - { -@@ -911,7 +912,8 @@ static IMPORT_FUNCTION* pe_parse_import_descriptor( - has_ordinal = 1; - } - -- rva_address = yr_le32toh(import_descriptor->FirstThunk + (sizeof(uint32_t) * func_idx)); -+ rva_address = yr_le32toh( -+ import_descriptor->FirstThunk + (sizeof(uint32_t) * func_idx)); - - if (name != NULL || has_ordinal == 1) - { -@@ -1013,7 +1015,8 @@ void pe_set_imports( - { - yr_set_string(func->name, pe->object, fun_name, dll_cnt, fun_cnt); - if (func->has_ordinal) -- yr_set_integer(func->ordinal, pe->object, fun_ordinal, dll_cnt, fun_cnt); -+ yr_set_integer( -+ func->ordinal, pe->object, fun_ordinal, dll_cnt, fun_cnt); - else - yr_set_integer(YR_UNDEFINED, pe->object, fun_ordinal, dll_cnt, fun_cnt); - if (func->rva) -@@ -1114,7 +1117,8 @@ static IMPORTED_DLL* pe_parse_imports(PE* pe) - } - - yr_set_integer(num_imports, pe->object, "number_of_imports"); -- yr_set_integer(num_function_imports, pe->object, "number_of_imported_functions"); -+ yr_set_integer( -+ num_function_imports, pe->object, "number_of_imported_functions"); - pe_set_imports( - pe, - head, -@@ -1369,7 +1373,7 @@ static void* pe_parse_delayed_imports(PE* pe) - imported_func->has_ordinal = 1; - } - -- imported_func->rva = yr_le64toh(func_rva); -+ imported_func->rva = yr_le64toh(func_rva); - - num_function_imports++; - name_rva += pointer_size; -@@ -1628,19 +1632,22 @@ static void pe_parse_exports(PE* pe) - for (int j = 0; j < cert->sha1.len; ++j) \ - sprintf(thumbprint_ascii + (j * 2), "%02x", cert->sha1.data[j]); \ - \ -- yr_set_string( \ -+ yr_set_string( \ - (char*) thumbprint_ascii, pe->object, fmt ".thumbprint", __VA_ARGS__); \ - \ -- yr_set_string(cert->issuer, pe->object, fmt ".issuer", __VA_ARGS__); \ -- yr_set_string(cert->subject, pe->object, fmt ".subject", __VA_ARGS__); \ -+ yr_set_string(cert->issuer, pe->object, fmt ".issuer", __VA_ARGS__); \ -+ yr_set_string(cert->subject, pe->object, fmt ".subject", __VA_ARGS__); \ - /* Versions are zero based, so add one. */ \ -- yr_set_integer(cert->version + 1, pe->object, fmt ".version", __VA_ARGS__); \ -- yr_set_string(cert->sig_alg, pe->object, fmt ".algorithm", __VA_ARGS__); \ -- yr_set_string( \ -+ yr_set_integer( \ -+ cert->version + 1, pe->object, fmt ".version", __VA_ARGS__); \ -+ yr_set_string(cert->sig_alg, pe->object, fmt ".algorithm", __VA_ARGS__); \ -+ yr_set_string( \ - cert->sig_alg_oid, pe->object, fmt ".algorithm_oid", __VA_ARGS__); \ -- yr_set_string(cert->serial, pe->object, fmt ".serial", __VA_ARGS__); \ -- yr_set_integer(cert->not_before, pe->object, fmt ".not_before", __VA_ARGS__); \ -- yr_set_integer(cert->not_after, pe->object, fmt ".not_after", __VA_ARGS__); \ -+ yr_set_string(cert->serial, pe->object, fmt ".serial", __VA_ARGS__); \ -+ yr_set_integer( \ -+ cert->not_before, pe->object, fmt ".not_before", __VA_ARGS__); \ -+ yr_set_integer( \ -+ cert->not_after, pe->object, fmt ".not_after", __VA_ARGS__); \ - } while (0) - - void _process_authenticode( -@@ -1677,7 +1684,8 @@ void _process_authenticode( - for (int j = 0; j < authenticode->digest.len; ++j) - sprintf(digest_ascii + (j * 2), "%02x", authenticode->digest.data[j]); - -- yr_set_string(digest_ascii, pe->object, "signatures[%i].digest", *sig_count); -+ yr_set_string( -+ digest_ascii, pe->object, "signatures[%i].digest", *sig_count); - yr_free(digest_ascii); - } - -@@ -2101,7 +2109,8 @@ static void pe_parse_header(PE* pe, uint64_t base_address, int flags) - pe->object, - "size_of_headers"); - -- yr_set_integer(yr_le32toh(OptionalHeader(pe, CheckSum)), pe->object, "checksum"); -+ yr_set_integer( -+ yr_le32toh(OptionalHeader(pe, CheckSum)), pe->object, "checksum"); - - yr_set_integer( - yr_le16toh(OptionalHeader(pe, Subsystem)), pe->object, "subsystem"); -@@ -2291,7 +2300,8 @@ static void pe_parse_header(PE* pe, uint64_t base_address, int flags) - if (last_section_end && (pe->data_size > last_section_end)) - { - yr_set_integer(last_section_end, pe->object, "overlay.offset"); -- yr_set_integer(pe->data_size - last_section_end, pe->object, "overlay.size"); -+ yr_set_integer( -+ pe->data_size - last_section_end, pe->object, "overlay.size"); - } - else - { -@@ -3058,7 +3068,8 @@ define_function(delayed_import_rva) - - for (int i = 0; i < num_imports; i++) - { -- dll_name = yr_get_string(module, "delayed_import_details[%i].library_name", i); -+ dll_name = yr_get_string( -+ module, "delayed_import_details[%i].library_name", i); - if (dll_name == NULL || IS_UNDEFINED(dll_name) || - ss_compare(in_dll_name, dll_name) != 0) - continue; -@@ -3103,7 +3114,8 @@ define_function(delayed_import_rva_ordinal) - - for (int i = 0; i < num_imports; i++) - { -- dll_name = yr_get_string(module, "delayed_import_details[%i].library_name", i); -+ dll_name = yr_get_string( -+ module, "delayed_import_details[%i].library_name", i); - if (dll_name == NULL || IS_UNDEFINED(dll_name) || - ss_compare(in_dll_name, dll_name) != 0) - continue; -@@ -3148,7 +3160,8 @@ define_function(locale) - - for (int i = 0; i < n; i++) - { -- uint64_t rsrc_language = yr_get_integer(module, "resources[%i].language", i); -+ uint64_t rsrc_language = yr_get_integer( -+ module, "resources[%i].language", i); - - if ((rsrc_language & 0xFFFF) == locale) - return_integer(1); -@@ -3176,7 +3189,8 @@ define_function(language) - - for (int i = 0; i < n; i++) - { -- uint64_t rsrc_language = yr_get_integer(module, "resources[%i].language", i); -+ uint64_t rsrc_language = yr_get_integer( -+ module, "resources[%i].language", i); - - if ((rsrc_language & 0xFF) == language) - return_integer(1); -@@ -3754,7 +3768,8 @@ begin_declarations - declare_string("digest"); - declare_string("file_digest"); - declare_integer("number_of_certificates"); -- begin_struct_array("certificates"); -+ begin_struct_array("certificates") -+ ; - declare_string("thumbprint"); - declare_string("issuer"); - declare_string("subject"); -@@ -3766,12 +3781,14 @@ begin_declarations - declare_integer("not_after"); - end_struct_array("certificates"); - -- begin_struct("signer_info"); -+ begin_struct("signer_info") -+ ; - declare_string("program_name"); - declare_string("digest"); - declare_string("digest_alg"); - declare_integer("length_of_chain"); -- begin_struct_array("chain"); -+ begin_struct_array("chain") -+ ; - declare_string("thumbprint"); - declare_string("issuer"); - declare_string("subject"); -@@ -3785,13 +3802,15 @@ begin_declarations - end_struct("signer_info"); - - declare_integer("number_of_countersignatures"); -- begin_struct_array("countersignatures"); -+ begin_struct_array("countersignatures") -+ ; - declare_integer("verified"); - declare_integer("sign_time"); - declare_string("digest_alg"); - declare_string("digest"); - declare_integer("length_of_chain"); -- begin_struct_array("chain"); -+ begin_struct_array("chain") -+ ; - declare_string("thumbprint"); - declare_string("issuer"); - declare_string("subject"); -@@ -3860,16 +3879,19 @@ int module_load( - yr_set_integer(IMAGE_FILE_MACHINE_M32R, module_object, "MACHINE_M32R"); - yr_set_integer(IMAGE_FILE_MACHINE_MIPS16, module_object, "MACHINE_MIPS16"); - yr_set_integer(IMAGE_FILE_MACHINE_MIPSFPU, module_object, "MACHINE_MIPSFPU"); -- yr_set_integer(IMAGE_FILE_MACHINE_MIPSFPU16, module_object, "MACHINE_MIPSFPU16"); -+ yr_set_integer( -+ IMAGE_FILE_MACHINE_MIPSFPU16, module_object, "MACHINE_MIPSFPU16"); - yr_set_integer(IMAGE_FILE_MACHINE_POWERPC, module_object, "MACHINE_POWERPC"); -- yr_set_integer(IMAGE_FILE_MACHINE_POWERPCFP, module_object, "MACHINE_POWERPCFP"); -+ yr_set_integer( -+ IMAGE_FILE_MACHINE_POWERPCFP, module_object, "MACHINE_POWERPCFP"); - yr_set_integer(IMAGE_FILE_MACHINE_R4000, module_object, "MACHINE_R4000"); - yr_set_integer(IMAGE_FILE_MACHINE_SH3, module_object, "MACHINE_SH3"); - yr_set_integer(IMAGE_FILE_MACHINE_SH3DSP, module_object, "MACHINE_SH3DSP"); - yr_set_integer(IMAGE_FILE_MACHINE_SH4, module_object, "MACHINE_SH4"); - yr_set_integer(IMAGE_FILE_MACHINE_SH5, module_object, "MACHINE_SH5"); - yr_set_integer(IMAGE_FILE_MACHINE_THUMB, module_object, "MACHINE_THUMB"); -- yr_set_integer(IMAGE_FILE_MACHINE_WCEMIPSV2, module_object, "MACHINE_WCEMIPSV2"); -+ yr_set_integer( -+ IMAGE_FILE_MACHINE_WCEMIPSV2, module_object, "MACHINE_WCEMIPSV2"); - yr_set_integer( - IMAGE_FILE_MACHINE_TARGET_HOST, module_object, "MACHINE_TARGET_HOST"); - yr_set_integer(IMAGE_FILE_MACHINE_R3000, module_object, "MACHINE_R3000"); -@@ -3889,7 +3911,8 @@ int module_load( - yr_set_integer( - IMAGE_SUBSYSTEM_WINDOWS_CUI, module_object, "SUBSYSTEM_WINDOWS_CUI"); - yr_set_integer(IMAGE_SUBSYSTEM_OS2_CUI, module_object, "SUBSYSTEM_OS2_CUI"); -- yr_set_integer(IMAGE_SUBSYSTEM_POSIX_CUI, module_object, "SUBSYSTEM_POSIX_CUI"); -+ yr_set_integer( -+ IMAGE_SUBSYSTEM_POSIX_CUI, module_object, "SUBSYSTEM_POSIX_CUI"); - yr_set_integer( - IMAGE_SUBSYSTEM_NATIVE_WINDOWS, - module_object, -@@ -3928,14 +3951,16 @@ int module_load( - IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY, - module_object, - "FORCE_INTEGRITY"); -- yr_set_integer(IMAGE_DLLCHARACTERISTICS_NX_COMPAT, module_object, "NX_COMPAT"); -+ yr_set_integer( -+ IMAGE_DLLCHARACTERISTICS_NX_COMPAT, module_object, "NX_COMPAT"); - yr_set_integer( - IMAGE_DLLCHARACTERISTICS_NO_ISOLATION, module_object, "NO_ISOLATION"); - yr_set_integer(IMAGE_DLLCHARACTERISTICS_NO_SEH, module_object, "NO_SEH"); - yr_set_integer(IMAGE_DLLCHARACTERISTICS_NO_BIND, module_object, "NO_BIND"); - yr_set_integer( - IMAGE_DLLCHARACTERISTICS_APPCONTAINER, module_object, "APPCONTAINER"); -- yr_set_integer(IMAGE_DLLCHARACTERISTICS_WDM_DRIVER, module_object, "WDM_DRIVER"); -+ yr_set_integer( -+ IMAGE_DLLCHARACTERISTICS_WDM_DRIVER, module_object, "WDM_DRIVER"); - yr_set_integer(IMAGE_DLLCHARACTERISTICS_GUARD_CF, module_object, "GUARD_CF"); - yr_set_integer( - IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE, -@@ -3943,26 +3968,31 @@ int module_load( - "TERMINAL_SERVER_AWARE"); - - yr_set_integer(IMAGE_FILE_RELOCS_STRIPPED, module_object, "RELOCS_STRIPPED"); -- yr_set_integer(IMAGE_FILE_EXECUTABLE_IMAGE, module_object, "EXECUTABLE_IMAGE"); -+ yr_set_integer( -+ IMAGE_FILE_EXECUTABLE_IMAGE, module_object, "EXECUTABLE_IMAGE"); - yr_set_integer( - IMAGE_FILE_LINE_NUMS_STRIPPED, module_object, "LINE_NUMS_STRIPPED"); - yr_set_integer( - IMAGE_FILE_LOCAL_SYMS_STRIPPED, module_object, "LOCAL_SYMS_STRIPPED"); -- yr_set_integer(IMAGE_FILE_AGGRESIVE_WS_TRIM, module_object, "AGGRESIVE_WS_TRIM"); -+ yr_set_integer( -+ IMAGE_FILE_AGGRESIVE_WS_TRIM, module_object, "AGGRESIVE_WS_TRIM"); - yr_set_integer( - IMAGE_FILE_LARGE_ADDRESS_AWARE, module_object, "LARGE_ADDRESS_AWARE"); -- yr_set_integer(IMAGE_FILE_BYTES_REVERSED_LO, module_object, "BYTES_REVERSED_LO"); -+ yr_set_integer( -+ IMAGE_FILE_BYTES_REVERSED_LO, module_object, "BYTES_REVERSED_LO"); - yr_set_integer(IMAGE_FILE_32BIT_MACHINE, module_object, "MACHINE_32BIT"); - yr_set_integer(IMAGE_FILE_DEBUG_STRIPPED, module_object, "DEBUG_STRIPPED"); - yr_set_integer( - IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP, - module_object, - "REMOVABLE_RUN_FROM_SWAP"); -- yr_set_integer(IMAGE_FILE_NET_RUN_FROM_SWAP, module_object, "NET_RUN_FROM_SWAP"); -+ yr_set_integer( -+ IMAGE_FILE_NET_RUN_FROM_SWAP, module_object, "NET_RUN_FROM_SWAP"); - yr_set_integer(IMAGE_FILE_SYSTEM, module_object, "SYSTEM"); - yr_set_integer(IMAGE_FILE_DLL, module_object, "DLL"); - yr_set_integer(IMAGE_FILE_UP_SYSTEM_ONLY, module_object, "UP_SYSTEM_ONLY"); -- yr_set_integer(IMAGE_FILE_BYTES_REVERSED_HI, module_object, "BYTES_REVERSED_HI"); -+ yr_set_integer( -+ IMAGE_FILE_BYTES_REVERSED_HI, module_object, "BYTES_REVERSED_HI"); - - yr_set_integer( - IMAGE_DIRECTORY_ENTRY_EXPORT, -@@ -4056,7 +4086,8 @@ int module_load( - IMAGE_SCN_NO_DEFER_SPEC_EXC, module_object, "SECTION_NO_DEFER_SPEC_EXC"); - yr_set_integer(IMAGE_SCN_GPREL, module_object, "SECTION_GPREL"); - yr_set_integer(IMAGE_SCN_MEM_FARDATA, module_object, "SECTION_MEM_FARDATA"); -- yr_set_integer(IMAGE_SCN_MEM_PURGEABLE, module_object, "SECTION_MEM_PURGEABLE"); -+ yr_set_integer( -+ IMAGE_SCN_MEM_PURGEABLE, module_object, "SECTION_MEM_PURGEABLE"); - yr_set_integer(IMAGE_SCN_MEM_16BIT, module_object, "SECTION_MEM_16BIT"); - yr_set_integer(IMAGE_SCN_MEM_LOCKED, module_object, "SECTION_MEM_LOCKED"); - yr_set_integer(IMAGE_SCN_MEM_PRELOAD, module_object, "SECTION_MEM_PRELOAD"); -@@ -4064,9 +4095,12 @@ int module_load( - yr_set_integer(IMAGE_SCN_ALIGN_2BYTES, module_object, "SECTION_ALIGN_2BYTES"); - yr_set_integer(IMAGE_SCN_ALIGN_4BYTES, module_object, "SECTION_ALIGN_4BYTES"); - yr_set_integer(IMAGE_SCN_ALIGN_8BYTES, module_object, "SECTION_ALIGN_8BYTES"); -- yr_set_integer(IMAGE_SCN_ALIGN_16BYTES, module_object, "SECTION_ALIGN_16BYTES"); -- yr_set_integer(IMAGE_SCN_ALIGN_32BYTES, module_object, "SECTION_ALIGN_32BYTES"); -- yr_set_integer(IMAGE_SCN_ALIGN_64BYTES, module_object, "SECTION_ALIGN_64BYTES"); -+ yr_set_integer( -+ IMAGE_SCN_ALIGN_16BYTES, module_object, "SECTION_ALIGN_16BYTES"); -+ yr_set_integer( -+ IMAGE_SCN_ALIGN_32BYTES, module_object, "SECTION_ALIGN_32BYTES"); -+ yr_set_integer( -+ IMAGE_SCN_ALIGN_64BYTES, module_object, "SECTION_ALIGN_64BYTES"); - yr_set_integer( - IMAGE_SCN_ALIGN_128BYTES, module_object, "SECTION_ALIGN_128BYTES"); - yr_set_integer( -@@ -4088,7 +4122,8 @@ int module_load( - IMAGE_SCN_MEM_DISCARDABLE, module_object, "SECTION_MEM_DISCARDABLE"); - yr_set_integer( - IMAGE_SCN_MEM_NOT_CACHED, module_object, "SECTION_MEM_NOT_CACHED"); -- yr_set_integer(IMAGE_SCN_MEM_NOT_PAGED, module_object, "SECTION_MEM_NOT_PAGED"); -+ yr_set_integer( -+ IMAGE_SCN_MEM_NOT_PAGED, module_object, "SECTION_MEM_NOT_PAGED"); - yr_set_integer(IMAGE_SCN_MEM_SHARED, module_object, "SECTION_MEM_SHARED"); - yr_set_integer(IMAGE_SCN_MEM_EXECUTE, module_object, "SECTION_MEM_EXECUTE"); - yr_set_integer(IMAGE_SCN_MEM_READ, module_object, "SECTION_MEM_READ"); -@@ -4115,13 +4150,15 @@ int module_load( - yr_set_integer(RESOURCE_TYPE_VERSION, module_object, "RESOURCE_TYPE_VERSION"); - yr_set_integer( - RESOURCE_TYPE_DLGINCLUDE, module_object, "RESOURCE_TYPE_DLGINCLUDE"); -- yr_set_integer(RESOURCE_TYPE_PLUGPLAY, module_object, "RESOURCE_TYPE_PLUGPLAY"); -+ yr_set_integer( -+ RESOURCE_TYPE_PLUGPLAY, module_object, "RESOURCE_TYPE_PLUGPLAY"); - yr_set_integer(RESOURCE_TYPE_VXD, module_object, "RESOURCE_TYPE_VXD"); - yr_set_integer( - RESOURCE_TYPE_ANICURSOR, module_object, "RESOURCE_TYPE_ANICURSOR"); - yr_set_integer(RESOURCE_TYPE_ANIICON, module_object, "RESOURCE_TYPE_ANIICON"); - yr_set_integer(RESOURCE_TYPE_HTML, module_object, "RESOURCE_TYPE_HTML"); -- yr_set_integer(RESOURCE_TYPE_MANIFEST, module_object, "RESOURCE_TYPE_MANIFEST"); -+ yr_set_integer( -+ RESOURCE_TYPE_MANIFEST, module_object, "RESOURCE_TYPE_MANIFEST"); - - yr_set_integer( - IMAGE_DEBUG_TYPE_UNKNOWN, module_object, "IMAGE_DEBUG_TYPE_UNKNOWN"); -@@ -4132,7 +4169,8 @@ int module_load( - yr_set_integer(IMAGE_DEBUG_TYPE_MISC, module_object, "IMAGE_DEBUG_TYPE_MISC"); - yr_set_integer( - IMAGE_DEBUG_TYPE_EXCEPTION, module_object, "IMAGE_DEBUG_TYPE_EXCEPTION"); -- yr_set_integer(IMAGE_DEBUG_TYPE_FIXUP, module_object, "IMAGE_DEBUG_TYPE_FIXUP"); -+ yr_set_integer( -+ IMAGE_DEBUG_TYPE_FIXUP, module_object, "IMAGE_DEBUG_TYPE_FIXUP"); - yr_set_integer( - IMAGE_DEBUG_TYPE_OMAP_TO_SRC, - module_object, -@@ -4147,15 +4185,18 @@ int module_load( - IMAGE_DEBUG_TYPE_RESERVED10, - module_object, - "IMAGE_DEBUG_TYPE_RESERVED10"); -- yr_set_integer(IMAGE_DEBUG_TYPE_CLSID, module_object, "IMAGE_DEBUG_TYPE_CLSID"); -+ yr_set_integer( -+ IMAGE_DEBUG_TYPE_CLSID, module_object, "IMAGE_DEBUG_TYPE_CLSID"); - yr_set_integer( - IMAGE_DEBUG_TYPE_VC_FEATURE, - module_object, - "IMAGE_DEBUG_TYPE_VC_FEATURE"); - yr_set_integer(IMAGE_DEBUG_TYPE_POGO, module_object, "IMAGE_DEBUG_TYPE_POGO"); -- yr_set_integer(IMAGE_DEBUG_TYPE_ILTCG, module_object, "IMAGE_DEBUG_TYPE_ILTCG"); -+ yr_set_integer( -+ IMAGE_DEBUG_TYPE_ILTCG, module_object, "IMAGE_DEBUG_TYPE_ILTCG"); - yr_set_integer(IMAGE_DEBUG_TYPE_MPX, module_object, "IMAGE_DEBUG_TYPE_MPX"); -- yr_set_integer(IMAGE_DEBUG_TYPE_REPRO, module_object, "IMAGE_DEBUG_TYPE_REPRO"); -+ yr_set_integer( -+ IMAGE_DEBUG_TYPE_REPRO, module_object, "IMAGE_DEBUG_TYPE_REPRO"); - - yr_set_integer(0, module_object, "is_pe"); - diff --git a/yara-4.3.0-test-pe2-s390x.patch b/yara-4.3.0-test-pe2-s390x.patch deleted file mode 100644 index d128b61..0000000 --- a/yara-4.3.0-test-pe2-s390x.patch +++ /dev/null @@ -1,24 +0,0 @@ -From d1a6ef20c049d86a136111dce53b4eb65c4df1bd Mon Sep 17 00:00:00 2001 -From: "Victor M. Alvarez" -Date: Fri, 20 Jan 2023 19:41:36 +0100 -Subject: [PATCH] Fix another issue with `yr_le32toh` used incorrectly. - ---- - libyara/modules/pe/pe.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/libyara/modules/pe/pe.c b/libyara/modules/pe/pe.c -index 354c6a103..181a36879 100644 ---- a/libyara/modules/pe/pe.c -+++ b/libyara/modules/pe/pe.c -@@ -912,8 +912,8 @@ static IMPORT_FUNCTION* pe_parse_import_descriptor( - has_ordinal = 1; - } - -- rva_address = yr_le32toh( -- import_descriptor->FirstThunk + (sizeof(uint32_t) * func_idx)); -+ rva_address = yr_le32toh(import_descriptor->FirstThunk) + -+ (sizeof(uint32_t) * func_idx); - - if (name != NULL || has_ordinal == 1) - { diff --git a/yara.spec b/yara.spec index 5fb5ff7..d5915a0 100644 --- a/yara.spec +++ b/yara.spec @@ -16,8 +16,7 @@ YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strings -and a Boolean expression which determine its logic. -} +and a Boolean expression which determine its logic.} %global gituser VirusTotal From 2f65236464d70b7221002e3dfa7cde52ba8437b8 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 26 Apr 2023 02:20:10 +0200 Subject: [PATCH 14/45] bump to 4.3.1 --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 31775b1..d5f9921 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.3.0.tar.gz) = fe239ae2f29fac7b4dbdc0ec84eba057dd4d93c6ae3a53d6bc2a333cc15ed45b1ff5cb896faf02813be667ce191ccbe1d64549552ea4f0834804ad0ec4b29092 +SHA512 (yara-4.3.1.tar.gz) = 93a2243d54397e76175fa0106451965b7f3a1f1918307c2bae6193f3725b69f60f70c3901a12c1690368f5b37e973a65c63a299624a521d204b12b48d5efe496 From ffc670dd42fb4819ae6aa94fa6ba434e0074495a Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 26 Apr 2023 02:24:57 +0200 Subject: [PATCH 15/45] bump 4.3.1 --- yara.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/yara.spec b/yara.spec index d5915a0..fbec20d 100644 --- a/yara.spec +++ b/yara.spec @@ -1,5 +1,5 @@ Name: yara -Version: 4.3.0 +Version: 4.3.1 %global baserelease 1 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ @@ -21,9 +21,9 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara -%global gitdate 20230322 -# Commit of version 4.3.0rc1 + fixes -%global commit 96790e56fc0fc0ce8598d215f969d8b7d8ca1015 +%global gitdate 20230420 +# Commit of version 4.3.1 +%global commit a6f6ce1d6d74a03c396660db25765f2a794d9e30 %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release @@ -189,6 +189,9 @@ make check || ( %changelog +* Wed Apr 26 2023 Michal Ambroz - 4.3.1-1 +- bump to 4.3.1 + * Thu Mar 30 2023 Michal Ambroz - 4.3.0-1 - bump to 4.3.0 From e01185c6911c8b732082944727dc3fd0192a8adb Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 14 Jun 2023 01:29:48 +0200 Subject: [PATCH 16/45] bump to 4.3.2 --- sources | 2 +- yara.spec | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/sources b/sources index d5f9921..903a84c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.3.1.tar.gz) = 93a2243d54397e76175fa0106451965b7f3a1f1918307c2bae6193f3725b69f60f70c3901a12c1690368f5b37e973a65c63a299624a521d204b12b48d5efe496 +SHA512 (yara-4.3.2.tar.gz) = dc77ec46a30ca2fff33b639166fc554c9c6d9e955642774e23da3ea7dbb25fe154cfd4ef83c9808920193028b9099258a63b3f1b9a66864a1f3905f0a8e8053f diff --git a/yara.spec b/yara.spec index fbec20d..7c123ad 100644 --- a/yara.spec +++ b/yara.spec @@ -1,5 +1,5 @@ Name: yara -Version: 4.3.1 +Version: 4.3.2 %global baserelease 1 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ @@ -189,6 +189,9 @@ make check || ( %changelog +* Wed Jun 14 2023 Michal Ambroz - 4.3.2-1 +- bump to 4.3.2 + * Wed Apr 26 2023 Michal Ambroz - 4.3.1-1 - bump to 4.3.1 From 8f09637df69681be7c1307c0ba86931b3677f604 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jul 2023 19:28:14 +0000 Subject: [PATCH 17/45] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- yara.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/yara.spec b/yara.spec index 7c123ad..f0a19bf 100644 --- a/yara.spec +++ b/yara.spec @@ -1,6 +1,6 @@ Name: yara Version: 4.3.2 -%global baserelease 1 +%global baserelease 2 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: https://github.com/VirusTotal/yara/ @@ -189,6 +189,9 @@ make check || ( %changelog +* Sat Jul 22 2023 Fedora Release Engineering - 4.3.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Wed Jun 14 2023 Michal Ambroz - 4.3.2-1 - bump to 4.3.2 From ac1ea090f88dd8500a32c777909498b19ffc878c Mon Sep 17 00:00:00 2001 From: Mikel Olasagasti Uranga Date: Sun, 17 Sep 2023 11:14:46 +0200 Subject: [PATCH 18/45] Update to 4.4.0 - Closes rhbz#2239308 --- sources | 2 +- yara.spec | 13 ++++++++----- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/sources b/sources index 903a84c..ca75bd5 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.3.2.tar.gz) = dc77ec46a30ca2fff33b639166fc554c9c6d9e955642774e23da3ea7dbb25fe154cfd4ef83c9808920193028b9099258a63b3f1b9a66864a1f3905f0a8e8053f +SHA512 (yara-4.4.0.tar.gz) = 705db57b73e5165a26e0aaea728521f372b9f7f613665860dd22066c30e75a614815fb17ee8654780fcfc157f0137cbeda015ec088a698f31adcf071e233205f diff --git a/yara.spec b/yara.spec index f0a19bf..8fa3353 100644 --- a/yara.spec +++ b/yara.spec @@ -1,6 +1,6 @@ Name: yara -Version: 4.3.2 -%global baserelease 2 +Version: 4.4.0 +%global baserelease 1 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: https://github.com/VirusTotal/yara/ @@ -21,9 +21,9 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara -%global gitdate 20230420 -# Commit of version 4.3.1 -%global commit a6f6ce1d6d74a03c396660db25765f2a794d9e30 +%global gitdate 20230915 +# Commit of version 4.4.0 +%global commit 1a85738e9af3c77acf035d0be4fe432e476bf82e %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release @@ -189,6 +189,9 @@ make check || ( %changelog +* Sun Sep 17 2023 Mikel Olasagasti Uranga - 4.4.0-1 +- bump to 4.4.0 + * Sat Jul 22 2023 Fedora Release Engineering - 4.3.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From d06cde77edab403690991083757a7df9720cad66 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jan 2024 10:40:33 +0000 Subject: [PATCH 19/45] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- yara.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/yara.spec b/yara.spec index 8fa3353..2e08551 100644 --- a/yara.spec +++ b/yara.spec @@ -1,6 +1,6 @@ Name: yara Version: 4.4.0 -%global baserelease 1 +%global baserelease 2 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: https://github.com/VirusTotal/yara/ @@ -189,6 +189,9 @@ make check || ( %changelog +* Sat Jan 27 2024 Fedora Release Engineering - 4.4.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sun Sep 17 2023 Mikel Olasagasti Uranga - 4.4.0-1 - bump to 4.4.0 From 4e4f91d7dce67a9b5d58fba821bfef603c0e74e1 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 14 Feb 2024 11:53:20 +0100 Subject: [PATCH 20/45] bump to 4.5.0 --- sources | 2 +- yara.spec | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/sources b/sources index ca75bd5..c54568f 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.4.0.tar.gz) = 705db57b73e5165a26e0aaea728521f372b9f7f613665860dd22066c30e75a614815fb17ee8654780fcfc157f0137cbeda015ec088a698f31adcf071e233205f +SHA512 (yara-4.5.0.tar.gz) = c9fe8a89879d1a742236101f1754e6b25e70356cdf5c020b2583e3ac509600c3b462756c412b01f2ebcb17df351c83afcf04d1cfaa87e6753eb25bab0f797aa3 diff --git a/yara.spec b/yara.spec index 2e08551..498a69d 100644 --- a/yara.spec +++ b/yara.spec @@ -1,6 +1,6 @@ Name: yara -Version: 4.4.0 -%global baserelease 2 +Version: 4.5.0 +%global baserelease 1 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: https://github.com/VirusTotal/yara/ @@ -189,6 +189,9 @@ make check || ( %changelog +* Wed Feb 14 2024 Michal Ambroz - 4.5.0-1 +- bump to 4.5.0 + * Sat Jan 27 2024 Fedora Release Engineering - 4.4.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From fd3d7a43377759745692012fee0d465df953a50b Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 14 Feb 2024 14:40:44 +0100 Subject: [PATCH 21/45] change also the git snapshot for 4.5.0 --- yara.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/yara.spec b/yara.spec index 498a69d..97343b9 100644 --- a/yara.spec +++ b/yara.spec @@ -21,9 +21,9 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara -%global gitdate 20230915 -# Commit of version 4.4.0 -%global commit 1a85738e9af3c77acf035d0be4fe432e476bf82e +# Commit of version 4.5.0 +%global gitdate 20240213 +%global commit 8fa55cde4c0cde8a1ba4ced1c131827eb4005f0d %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release @@ -192,7 +192,10 @@ make check || ( * Wed Feb 14 2024 Michal Ambroz - 4.5.0-1 - bump to 4.5.0 -* Sat Jan 27 2024 Fedora Release Engineering - 4.4.0-2 +* Fri Jan 26 2024 Fedora Release Engineering - 4.4.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Mon Jan 22 2024 Fedora Release Engineering - 4.4.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild * Sun Sep 17 2023 Mikel Olasagasti Uranga - 4.4.0-1 From ed8ade685c667ad035cfa8404f386c286d9ca300 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 27 May 2024 11:58:24 +0200 Subject: [PATCH 22/45] bump to 4.5.1 --- yara.spec | 89 ++++++++++++++++++++++++++++--------------------------- 1 file changed, 46 insertions(+), 43 deletions(-) diff --git a/yara.spec b/yara.spec index 97343b9..704d8c6 100644 --- a/yara.spec +++ b/yara.spec @@ -1,5 +1,5 @@ Name: yara -Version: 4.5.0 +Version: 4.5.1 %global baserelease 1 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ @@ -22,8 +22,8 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara # Commit of version 4.5.0 -%global gitdate 20240213 -%global commit 8fa55cde4c0cde8a1ba4ced1c131827eb4005f0d +%global gitdate 20240525 +%global commit 0e5b6bb9660cba500eb58dbccb027757c82cc4cf %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release @@ -189,7 +189,10 @@ make check || ( %changelog -* Wed Feb 14 2024 Michal Ambroz - 4.5.0-1 +* Mon May 27 2024 Michal Ambroz - 4.5.1-1 +- bump to 4.5.1 + +* Wed Feb 14 2024 Michal Ambroz - 4.5.0-1 - bump to 4.5.0 * Fri Jan 26 2024 Fedora Release Engineering - 4.4.0-3 @@ -204,25 +207,25 @@ make check || ( * Sat Jul 22 2023 Fedora Release Engineering - 4.3.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild -* Wed Jun 14 2023 Michal Ambroz - 4.3.2-1 +* Wed Jun 14 2023 Michal Ambroz - 4.3.2-1 - bump to 4.3.2 -* Wed Apr 26 2023 Michal Ambroz - 4.3.1-1 +* Wed Apr 26 2023 Michal Ambroz - 4.3.1-1 - bump to 4.3.1 -* Thu Mar 30 2023 Michal Ambroz - 4.3.0-1 +* Thu Mar 30 2023 Michal Ambroz - 4.3.0-1 - bump to 4.3.0 -* Tue Jan 24 2023 Michal Ambroz - 4.3.0-0.rc1.3 +* Tue Jan 24 2023 Michal Ambroz - 4.3.0-0.rc1.3 - fix EPEL9 build = reenable the SHA1 certificate validation in OpenSSL for make check -* Sat Jan 21 2023 Michal Ambroz - 4.3.0-0.rc1.2 +* Sat Jan 21 2023 Michal Ambroz - 4.3.0-0.rc1.2 - fix EPEL7 build * Sat Jan 21 2023 Fedora Release Engineering - 4.3.0-0.rc1.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild -* Tue Jan 03 2023 Michal Ambroz - 4.3.0-0.rc1.1 +* Tue Jan 03 2023 Michal Ambroz - 4.3.0-0.rc1.1 - bump to 4.3.0 rc1 - remove the androguard module which is no longer available from github @@ -239,7 +242,7 @@ make check || ( - BUGFIX: YARA doesn't compile if --with-debug-verbose flag is enabled (#1719). - BUGFIX: Null-pointer dereferences while loading corrupted compiled rules (#1727). -* Mon May 23 2022 Michal Ambroz - 4.2.1-1 +* Mon May 23 2022 Michal Ambroz - 4.2.1-1 - bump to 4.2.1 - adding changes based on proposal of Mikel Olasagasti Uranga: - change to BSD license as yara was relicensed in 2016 @@ -247,16 +250,16 @@ make check || ( - remove old patches - enable checks -* Sat Mar 12 2022 Michal Ambroz - 4.2.0-1 +* Sat Mar 12 2022 Michal Ambroz - 4.2.0-1 - bump to 4.2.0 -* Thu Feb 17 2022 Michal Ambroz - 4.2.0-0.rc1.1 +* Thu Feb 17 2022 Michal Ambroz - 4.2.0-0.rc1.1 - bump to 4.2.0-rc1 * Sat Jan 22 2022 Fedora Release Engineering - 4.1.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild -* Wed Nov 10 2021 Michal Ambroz - 4.1.3-1 +* Wed Nov 10 2021 Michal Ambroz - 4.1.3-1 - bump to 4.1.3 * Sat Nov 06 2021 Adrian Reber - 4.1.1-5 @@ -271,58 +274,58 @@ make check || ( * Fri Jul 23 2021 Fedora Release Engineering - 4.1.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild -* Mon May 24 2021 Michal Ambroz - 4.1.1-1 +* Mon May 24 2021 Michal Ambroz - 4.1.1-1 - bump to 4.1.1 -* Mon Apr 26 2021 Michal Ambroz - 4.1.0-1 +* Mon Apr 26 2021 Michal Ambroz - 4.1.0-1 - bump to 4.1.0 -* Sun Apr 25 2021 Michal Ambroz - 4.0.5-2 +* Sun Apr 25 2021 Michal Ambroz - 4.0.5-2 - rebuild for epel -* Fri Feb 5 2021 Michal Ambroz - 4.0.5-1 +* Fri Feb 5 2021 Michal Ambroz - 4.0.5-1 - bump to yara bugfix 4.0.5 release -* Wed Feb 3 2021 Michal Ambroz - 4.0.4-1 +* Wed Feb 3 2021 Michal Ambroz - 4.0.4-1 - bump to yara bugfix 4.0.4 release -* Thu Jul 16 2020 Michal Ambroz - 4.0.2-1 +* Thu Jul 16 2020 Michal Ambroz - 4.0.2-1 - bump to yara bugfix 4.0.2 release - fix build on epel7 * Sun Jun 14 2020 Adrian Reber - 4.0.1-2 - Rebuilt for protobuf 3.12 -* Tue Jun 2 2020 Michal Ambroz - 4.0.1-1 +* Tue Jun 2 2020 Michal Ambroz - 4.0.1-1 - bump to yara bugfix 4.0.1 release -* Tue Apr 28 2020 Michal Ambroz - 4.0.0-1 +* Tue Apr 28 2020 Michal Ambroz - 4.0.0-1 - bump to yara 4.0.0 release * Fri Jan 31 2020 Fedora Release Engineering - 3.11.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild -* Fri Oct 11 2019 Michal Ambroz - 3.11.0-1 +* Fri Oct 11 2019 Michal Ambroz - 3.11.0-1 - bump to 3.11.0 release (#1760678) - BUGFIX: Some regexp character classes not matching correctly when used with “nocase” modifier (upstream #1117) - BUGFIX: Reduce the number of ERROR_TOO_MANY_RE_FIBERS errors for certain hex pattern containing large jumps (upstream #1107) - BUGFIX: Buffer overrun in “dotnet” module (upstream #1108) - BUGFIX: Memory leak while attaching to a process fails (upstream #1070) -* Sat Sep 28 2019 Michal Ambroz - 3.10.0-3 +* Sat Sep 28 2019 Michal Ambroz - 3.10.0-3 - change the sphinx build dependency * Sat Jul 27 2019 Fedora Release Engineering - 3.10.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild -* Fri May 03 2019 Michal Ambroz - 3.10.0-1 +* Fri May 03 2019 Michal Ambroz - 3.10.0-1 - bump to 3.10.0 release (#1680204) - Harden virtual machine against malicious code. - BUGFIX: Regression bug in hex strings containing wildcards (upstream #1025). - BUGFIX: Buffer overrun in “elf” module. - BUGFIX: Buffer overrun in “dotnet” module. -* Sat Mar 16 2019 Michal Ambroz - 3.9.0-1 +* Sat Mar 16 2019 Michal Ambroz - 3.9.0-1 - bump to 3.9.0 release (#1680203) - switch from python-sphinx to python3-sphinx for generating the documentation for fc31+ - should fix also #1660398 (CVE-2018-19974 CVE-2018-19975 CVE-2018-19976), @@ -335,7 +338,7 @@ make check || ( * Sun Feb 03 2019 Fedora Release Engineering - 3.8.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild -* Mon Aug 27 2018 Michal Ambroz - 3.8.1-1 +* Mon Aug 27 2018 Michal Ambroz - 3.8.1-1 - bump to 3.8.1 release (#1613093) * Sat Jul 14 2018 Fedora Release Engineering - 3.7.1-3 @@ -344,10 +347,10 @@ make check || ( * Fri Feb 09 2018 Fedora Release Engineering - 3.7.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild -* Mon Feb 05 2018 Michal Ambroz - 3.7.1-1 +* Mon Feb 05 2018 Michal Ambroz - 3.7.1-1 - bump to 3.7.1 release (#1534993) -* Wed Nov 15 2017 Michal Ambroz - 3.7.0-1 +* Wed Nov 15 2017 Michal Ambroz - 3.7.0-1 - bump to 3.7.0 release (#1511921) * Thu Aug 03 2017 Fedora Release Engineering - 3.6.3-3 @@ -356,17 +359,17 @@ make check || ( * Thu Jul 27 2017 Fedora Release Engineering - 3.6.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild -* Sun Jul 16 2017 Michal Ambroz - 3.6.3-1 +* Sun Jul 16 2017 Michal Ambroz - 3.6.3-1 - bump to 3.6.3 release - bugfix CVE-2017-11328 -* Mon Jul 03 2017 Michal Ambroz - 3.6.2-1 +* Mon Jul 03 2017 Michal Ambroz - 3.6.2-1 - bump to 3.6.2 release - bugfix CVE-2017-9304, CVE-2017-9465 -* Wed May 24 2017 Michal Ambroz - 3.6.0-1 +* Wed May 24 2017 Michal Ambroz - 3.6.0-1 - bump to 3.6.0 release - update the androguard-yara with bugfixes -* Thu Apr 13 2017 Michal Ambroz - 3.5.0-7 +* Thu Apr 13 2017 Michal Ambroz - 3.5.0-7 - Adding patch from pull request 627 until 3.5.1 is released - https://patch-diff.githubusercontent.com/raw/VirusTotal/yara/pull/627.patch - Fixes CVE-2016-10210 CVE-2016-10211 CVE-2017-5923 CVE-2017-5924 @@ -374,40 +377,40 @@ make check || ( * Sat Feb 11 2017 Fedora Release Engineering - 3.5.0-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild -* Tue Aug 09 2016 Michal Ambroz - 3.5.0-5 +* Tue Aug 09 2016 Michal Ambroz - 3.5.0-5 - import package to Fedora - remove unnecessary .buildinfo tag from doc package -* Fri Aug 05 2016 Michal Ambroz - 3.5.0-4 +* Fri Aug 05 2016 Michal Ambroz - 3.5.0-4 - package review - bugzilla #1362265 - cosmetics of the changelog - using default spinx theme to remove the static fonts -* Fri Aug 05 2016 Michal Ambroz - 3.5.0-3 +* Fri Aug 05 2016 Michal Ambroz - 3.5.0-3 - package review - bugzilla #1362265 - dropped Buildroot, pkgconfig, zlib-devel, defattr - added buildrequires gcc - change license back to ASL 2.0 only -* Thu Aug 04 2016 Michal Ambroz - 3.5.0-2 +* Thu Aug 04 2016 Michal Ambroz - 3.5.0-2 - package review - bugzilla #1362265 - changed packaging of doc sub-package -* Thu Aug 04 2016 Michal Ambroz - 3.5.0-1 +* Thu Aug 04 2016 Michal Ambroz - 3.5.0-1 - bump to new 3.5.0 -* Wed Aug 03 2016 Michal Ambroz - 3.4.0-6 +* Wed Aug 03 2016 Michal Ambroz - 3.4.0-6 - package review - bugzilla #1362265 - dropped dependency of python-tools -* Mon Aug 01 2016 Michal Ambroz - 3.4.0-4 +* Mon Aug 01 2016 Michal Ambroz - 3.4.0-4 - compile with the androguard module -* Wed Jun 08 2016 Michal Ambroz - 3.4.0-2 +* Wed Jun 08 2016 Michal Ambroz - 3.4.0-2 - jansson dependency >= 2.5 -* Wed Jun 08 2016 Michal Ambroz - 3.4.0-1 +* Wed Jun 08 2016 Michal Ambroz - 3.4.0-1 - python3 stuff -* Mon Jun 22 2015 Michal Ambroz - 3.4.0-0.git20150618 +* Mon Jun 22 2015 Michal Ambroz - 3.4.0-0.git20150618 - initial build for Fedora Project From e9b10828c2fd0f0b373a29427994394e47644dd0 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Thu, 30 May 2024 02:30:58 +0200 Subject: [PATCH 23/45] bump to 4.5.1 --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index c54568f..f19de49 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.5.0.tar.gz) = c9fe8a89879d1a742236101f1754e6b25e70356cdf5c020b2583e3ac509600c3b462756c412b01f2ebcb17df351c83afcf04d1cfaa87e6753eb25bab0f797aa3 +SHA512 (yara-4.5.1.tar.gz) = 8bf1df7089f9bc5a448dbae0999e04f4ecdec06b4478e2cb5f42a2a3201b99fce68379e3f8f7c67a9db201205366250d7befe5c38451cced807ed692d436422c From 2dac5d6a776e118ef052db2ffc0e4d95f290bc78 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jul 2024 10:39:07 +0000 Subject: [PATCH 24/45] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- yara.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/yara.spec b/yara.spec index 704d8c6..5a1fc37 100644 --- a/yara.spec +++ b/yara.spec @@ -1,6 +1,6 @@ Name: yara Version: 4.5.1 -%global baserelease 1 +%global baserelease 2 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: https://github.com/VirusTotal/yara/ @@ -189,6 +189,9 @@ make check || ( %changelog +* Sat Jul 20 2024 Fedora Release Engineering - 4.5.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Mon May 27 2024 Michal Ambroz - 4.5.1-1 - bump to 4.5.1 From ed9c1e010566c18fc3a2bf30b0b121f0c3c458d8 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 16 Sep 2024 02:56:06 +0200 Subject: [PATCH 25/45] bump to 4.5.2 --- sources | 2 +- yara.spec | 15 +++++++++------ 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/sources b/sources index f19de49..32ad6b8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.5.1.tar.gz) = 8bf1df7089f9bc5a448dbae0999e04f4ecdec06b4478e2cb5f42a2a3201b99fce68379e3f8f7c67a9db201205366250d7befe5c38451cced807ed692d436422c +SHA512 (yara-4.5.2.tar.gz) = 761f3930117c35d87b0e3be1a5d61a6887006470fdf578164feb1bd56a96b2d85770ab7c3a21258a2781ff3327cb705942f4f0eb959cff4b210f0c7fbec1fc30 diff --git a/yara.spec b/yara.spec index 5a1fc37..60c8563 100644 --- a/yara.spec +++ b/yara.spec @@ -1,9 +1,9 @@ Name: yara -Version: 4.5.1 -%global baserelease 2 +Version: 4.5.2 +%global baserelease 1 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ -VCS: https://github.com/VirusTotal/yara/ +VCS: git:https://github.com/VirusTotal/yara/ # https://github.com/VirusTotal/yara/releases # yara package itself is licensed with BSD 3 clause license @@ -21,9 +21,9 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara -# Commit of version 4.5.0 -%global gitdate 20240525 -%global commit 0e5b6bb9660cba500eb58dbccb027757c82cc4cf +# Commit of version 4.5.2 +%global gitdate 20240910 +%global commit 688268d83983a0d61bb68ef3d8dfd28102b7d1b4 %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release @@ -189,6 +189,9 @@ make check || ( %changelog +* Mon Sep 16 2024 Michal Ambroz - 4.5.2-1 +- bump to 4.5.2 + * Sat Jul 20 2024 Fedora Release Engineering - 4.5.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 55af515d5cca96b1171443d76e99fe1ef539a31d Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 28 Sep 2024 20:03:03 +0200 Subject: [PATCH 26/45] switch to autochangelog --- changelog | 231 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 231 insertions(+) create mode 100644 changelog diff --git a/changelog b/changelog new file mode 100644 index 0000000..298d7f6 --- /dev/null +++ b/changelog @@ -0,0 +1,231 @@ +* Mon Sep 16 2024 Michal Ambroz - 4.5.2-1 +- bump to 4.5.2 + +* Sat Jul 20 2024 Fedora Release Engineering - 4.5.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Mon May 27 2024 Michal Ambroz - 4.5.1-1 +- bump to 4.5.1 + +* Wed Feb 14 2024 Michal Ambroz - 4.5.0-1 +- bump to 4.5.0 + +* Fri Jan 26 2024 Fedora Release Engineering - 4.4.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Mon Jan 22 2024 Fedora Release Engineering - 4.4.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sun Sep 17 2023 Mikel Olasagasti Uranga - 4.4.0-1 +- bump to 4.4.0 + +* Sat Jul 22 2023 Fedora Release Engineering - 4.3.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Wed Jun 14 2023 Michal Ambroz - 4.3.2-1 +- bump to 4.3.2 + +* Wed Apr 26 2023 Michal Ambroz - 4.3.1-1 +- bump to 4.3.1 + +* Thu Mar 30 2023 Michal Ambroz - 4.3.0-1 +- bump to 4.3.0 + +* Tue Jan 24 2023 Michal Ambroz - 4.3.0-0.rc1.3 +- fix EPEL9 build = reenable the SHA1 certificate validation in OpenSSL for make check + +* Sat Jan 21 2023 Michal Ambroz - 4.3.0-0.rc1.2 +- fix EPEL7 build + +* Sat Jan 21 2023 Fedora Release Engineering - 4.3.0-0.rc1.1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Tue Jan 03 2023 Michal Ambroz - 4.3.0-0.rc1.1 +- bump to 4.3.0 rc1 +- remove the androguard module which is no longer available from github + +* Tue Aug 09 2022 Mikel Olasagasti Uranga - 4.2.3-1 +- Update to 4.2.3 (#2116594) + +* Sat Jul 23 2022 Fedora Release Engineering - 4.2.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Mon Jul 18 2022 Mikel Olasagasti Uranga - 4.2.2-1 +- Update to 4.2.2 (#2103444) +- BUGFIX: Fix buffer overrun in "dex" module (#1728). +- BUGFIX: Wrong offset used when checking Version string of .net metadata (#1708). +- BUGFIX: YARA doesn't compile if --with-debug-verbose flag is enabled (#1719). +- BUGFIX: Null-pointer dereferences while loading corrupted compiled rules (#1727). + +* Mon May 23 2022 Michal Ambroz - 4.2.1-1 +- bump to 4.2.1 +- adding changes based on proposal of Mikel Olasagasti Uranga: +- change to BSD license as yara was relicensed in 2016 +- minor changes to spec, like using https for URL +- remove old patches +- enable checks + +* Sat Mar 12 2022 Michal Ambroz - 4.2.0-1 +- bump to 4.2.0 + +* Thu Feb 17 2022 Michal Ambroz - 4.2.0-0.rc1.1 +- bump to 4.2.0-rc1 + +* Sat Jan 22 2022 Fedora Release Engineering - 4.1.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Wed Nov 10 2021 Michal Ambroz - 4.1.3-1 +- bump to 4.1.3 + +* Sat Nov 06 2021 Adrian Reber - 4.1.1-5 +- Rebuilt for protobuf 3.19.0 + +* Mon Oct 25 2021 Adrian Reber - 4.1.1-4 +- Rebuilt for protobuf 3.18.1 + +* Tue Sep 14 2021 Sahana Prasad - 4.1.1-3 +- Rebuilt with OpenSSL 3.0.0 + +* Fri Jul 23 2021 Fedora Release Engineering - 4.1.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Mon May 24 2021 Michal Ambroz - 4.1.1-1 +- bump to 4.1.1 + +* Mon Apr 26 2021 Michal Ambroz - 4.1.0-1 +- bump to 4.1.0 + +* Sun Apr 25 2021 Michal Ambroz - 4.0.5-2 +- rebuild for epel + +* Fri Feb 5 2021 Michal Ambroz - 4.0.5-1 +- bump to yara bugfix 4.0.5 release + +* Wed Feb 3 2021 Michal Ambroz - 4.0.4-1 +- bump to yara bugfix 4.0.4 release + +* Thu Jul 16 2020 Michal Ambroz - 4.0.2-1 +- bump to yara bugfix 4.0.2 release +- fix build on epel7 + +* Sun Jun 14 2020 Adrian Reber - 4.0.1-2 +- Rebuilt for protobuf 3.12 + +* Tue Jun 2 2020 Michal Ambroz - 4.0.1-1 +- bump to yara bugfix 4.0.1 release + +* Tue Apr 28 2020 Michal Ambroz - 4.0.0-1 +- bump to yara 4.0.0 release + +* Fri Jan 31 2020 Fedora Release Engineering - 3.11.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Fri Oct 11 2019 Michal Ambroz - 3.11.0-1 +- bump to 3.11.0 release (#1760678) +- BUGFIX: Some regexp character classes not matching correctly when used with “nocase” modifier (upstream #1117) +- BUGFIX: Reduce the number of ERROR_TOO_MANY_RE_FIBERS errors for certain hex pattern containing large jumps (upstream #1107) +- BUGFIX: Buffer overrun in “dotnet” module (upstream #1108) +- BUGFIX: Memory leak while attaching to a process fails (upstream #1070) + +* Sat Sep 28 2019 Michal Ambroz - 3.10.0-3 +- change the sphinx build dependency + +* Sat Jul 27 2019 Fedora Release Engineering - 3.10.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Fri May 03 2019 Michal Ambroz - 3.10.0-1 +- bump to 3.10.0 release (#1680204) +- Harden virtual machine against malicious code. +- BUGFIX: Regression bug in hex strings containing wildcards (upstream #1025). +- BUGFIX: Buffer overrun in “elf” module. +- BUGFIX: Buffer overrun in “dotnet” module. + +* Sat Mar 16 2019 Michal Ambroz - 3.9.0-1 +- bump to 3.9.0 release (#1680203) +- switch from python-sphinx to python3-sphinx for generating the documentation for fc31+ +- should fix also #1660398 (CVE-2018-19974 CVE-2018-19975 CVE-2018-19976), + but by design it might be always dangerous to run yara signatures compiled by 3rd party, + so it is advised to re-compile yara rules instead +- BUGFIX: Denial of service when using "dex" module. Found by the Cisco Talos team. (upstream #1023, CVE-2019-5020) +- BUGFIX: Buffer overflow in "dotnet" module. +- BUGFIX: Regexp regression when using nested quantifiers {x,y} for certain values of x and y. (#1018) + +* Sun Feb 03 2019 Fedora Release Engineering - 3.8.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Mon Aug 27 2018 Michal Ambroz - 3.8.1-1 +- bump to 3.8.1 release (#1613093) + +* Sat Jul 14 2018 Fedora Release Engineering - 3.7.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Fri Feb 09 2018 Fedora Release Engineering - 3.7.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Mon Feb 05 2018 Michal Ambroz - 3.7.1-1 +- bump to 3.7.1 release (#1534993) + +* Wed Nov 15 2017 Michal Ambroz - 3.7.0-1 +- bump to 3.7.0 release (#1511921) + +* Thu Aug 03 2017 Fedora Release Engineering - 3.6.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Thu Jul 27 2017 Fedora Release Engineering - 3.6.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Sun Jul 16 2017 Michal Ambroz - 3.6.3-1 +- bump to 3.6.3 release - bugfix CVE-2017-11328 + +* Mon Jul 03 2017 Michal Ambroz - 3.6.2-1 +- bump to 3.6.2 release - bugfix CVE-2017-9304, CVE-2017-9465 + +* Wed May 24 2017 Michal Ambroz - 3.6.0-1 +- bump to 3.6.0 release +- update the androguard-yara with bugfixes + +* Thu Apr 13 2017 Michal Ambroz - 3.5.0-7 +- Adding patch from pull request 627 until 3.5.1 is released +- https://patch-diff.githubusercontent.com/raw/VirusTotal/yara/pull/627.patch +- Fixes CVE-2016-10210 CVE-2016-10211 CVE-2017-5923 CVE-2017-5924 + +* Sat Feb 11 2017 Fedora Release Engineering - 3.5.0-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Tue Aug 09 2016 Michal Ambroz - 3.5.0-5 +- import package to Fedora +- remove unnecessary .buildinfo tag from doc package + +* Fri Aug 05 2016 Michal Ambroz - 3.5.0-4 +- package review - bugzilla #1362265 +- cosmetics of the changelog +- using default spinx theme to remove the static fonts + +* Fri Aug 05 2016 Michal Ambroz - 3.5.0-3 +- package review - bugzilla #1362265 +- dropped Buildroot, pkgconfig, zlib-devel, defattr +- added buildrequires gcc +- change license back to ASL 2.0 only + +* Thu Aug 04 2016 Michal Ambroz - 3.5.0-2 +- package review - bugzilla #1362265 +- changed packaging of doc sub-package + +* Thu Aug 04 2016 Michal Ambroz - 3.5.0-1 +- bump to new 3.5.0 + +* Wed Aug 03 2016 Michal Ambroz - 3.4.0-6 +- package review - bugzilla #1362265 +- dropped dependency of python-tools + +* Mon Aug 01 2016 Michal Ambroz - 3.4.0-4 +- compile with the androguard module + +* Wed Jun 08 2016 Michal Ambroz - 3.4.0-2 +- jansson dependency >= 2.5 + +* Wed Jun 08 2016 Michal Ambroz - 3.4.0-1 +- python3 stuff + +* Mon Jun 22 2015 Michal Ambroz - 3.4.0-0.git20150618 +- initial build for Fedora Project From 649da3935031188047be2f351cad08538e47b828 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sat, 28 Sep 2024 20:03:32 +0200 Subject: [PATCH 27/45] switch to autochangelog --- yara.spec | 236 +----------------------------------------------------- 1 file changed, 3 insertions(+), 233 deletions(-) diff --git a/yara.spec b/yara.spec index 60c8563..cdfc9f8 100644 --- a/yara.spec +++ b/yara.spec @@ -31,12 +31,12 @@ and a Boolean expression which determine its logic.} # Build from git release version %if %{with release} -Release: %{baserelease}%{?dist} +Release: %autorelease -b %{baserelease} # Source0: https://github.com/%%{gituser}/%%{gitname}/archive/v%%{upversion}.tar.gz#/%%{name}-%%{upversion}.tar.gz Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz %else # Build from git commit baseline -Release: %{baserelease}.%{gitdate}git%{shortcommit}%{?dist} +Release: %autorelease -b %{baserelease} -s %{gitdate}git%{shortcommit} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz %endif @@ -189,234 +189,4 @@ make check || ( %changelog -* Mon Sep 16 2024 Michal Ambroz - 4.5.2-1 -- bump to 4.5.2 - -* Sat Jul 20 2024 Fedora Release Engineering - 4.5.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Mon May 27 2024 Michal Ambroz - 4.5.1-1 -- bump to 4.5.1 - -* Wed Feb 14 2024 Michal Ambroz - 4.5.0-1 -- bump to 4.5.0 - -* Fri Jan 26 2024 Fedora Release Engineering - 4.4.0-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Mon Jan 22 2024 Fedora Release Engineering - 4.4.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Sun Sep 17 2023 Mikel Olasagasti Uranga - 4.4.0-1 -- bump to 4.4.0 - -* Sat Jul 22 2023 Fedora Release Engineering - 4.3.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Wed Jun 14 2023 Michal Ambroz - 4.3.2-1 -- bump to 4.3.2 - -* Wed Apr 26 2023 Michal Ambroz - 4.3.1-1 -- bump to 4.3.1 - -* Thu Mar 30 2023 Michal Ambroz - 4.3.0-1 -- bump to 4.3.0 - -* Tue Jan 24 2023 Michal Ambroz - 4.3.0-0.rc1.3 -- fix EPEL9 build = reenable the SHA1 certificate validation in OpenSSL for make check - -* Sat Jan 21 2023 Michal Ambroz - 4.3.0-0.rc1.2 -- fix EPEL7 build - -* Sat Jan 21 2023 Fedora Release Engineering - 4.3.0-0.rc1.1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Tue Jan 03 2023 Michal Ambroz - 4.3.0-0.rc1.1 -- bump to 4.3.0 rc1 -- remove the androguard module which is no longer available from github - -* Tue Aug 09 2022 Mikel Olasagasti Uranga - 4.2.3-1 -- Update to 4.2.3 (#2116594) - -* Sat Jul 23 2022 Fedora Release Engineering - 4.2.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Mon Jul 18 2022 Mikel Olasagasti Uranga - 4.2.2-1 -- Update to 4.2.2 (#2103444) -- BUGFIX: Fix buffer overrun in "dex" module (#1728). -- BUGFIX: Wrong offset used when checking Version string of .net metadata (#1708). -- BUGFIX: YARA doesn't compile if --with-debug-verbose flag is enabled (#1719). -- BUGFIX: Null-pointer dereferences while loading corrupted compiled rules (#1727). - -* Mon May 23 2022 Michal Ambroz - 4.2.1-1 -- bump to 4.2.1 -- adding changes based on proposal of Mikel Olasagasti Uranga: -- change to BSD license as yara was relicensed in 2016 -- minor changes to spec, like using https for URL -- remove old patches -- enable checks - -* Sat Mar 12 2022 Michal Ambroz - 4.2.0-1 -- bump to 4.2.0 - -* Thu Feb 17 2022 Michal Ambroz - 4.2.0-0.rc1.1 -- bump to 4.2.0-rc1 - -* Sat Jan 22 2022 Fedora Release Engineering - 4.1.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Wed Nov 10 2021 Michal Ambroz - 4.1.3-1 -- bump to 4.1.3 - -* Sat Nov 06 2021 Adrian Reber - 4.1.1-5 -- Rebuilt for protobuf 3.19.0 - -* Mon Oct 25 2021 Adrian Reber - 4.1.1-4 -- Rebuilt for protobuf 3.18.1 - -* Tue Sep 14 2021 Sahana Prasad - 4.1.1-3 -- Rebuilt with OpenSSL 3.0.0 - -* Fri Jul 23 2021 Fedora Release Engineering - 4.1.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Mon May 24 2021 Michal Ambroz - 4.1.1-1 -- bump to 4.1.1 - -* Mon Apr 26 2021 Michal Ambroz - 4.1.0-1 -- bump to 4.1.0 - -* Sun Apr 25 2021 Michal Ambroz - 4.0.5-2 -- rebuild for epel - -* Fri Feb 5 2021 Michal Ambroz - 4.0.5-1 -- bump to yara bugfix 4.0.5 release - -* Wed Feb 3 2021 Michal Ambroz - 4.0.4-1 -- bump to yara bugfix 4.0.4 release - -* Thu Jul 16 2020 Michal Ambroz - 4.0.2-1 -- bump to yara bugfix 4.0.2 release -- fix build on epel7 - -* Sun Jun 14 2020 Adrian Reber - 4.0.1-2 -- Rebuilt for protobuf 3.12 - -* Tue Jun 2 2020 Michal Ambroz - 4.0.1-1 -- bump to yara bugfix 4.0.1 release - -* Tue Apr 28 2020 Michal Ambroz - 4.0.0-1 -- bump to yara 4.0.0 release - -* Fri Jan 31 2020 Fedora Release Engineering - 3.11.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Fri Oct 11 2019 Michal Ambroz - 3.11.0-1 -- bump to 3.11.0 release (#1760678) -- BUGFIX: Some regexp character classes not matching correctly when used with “nocase” modifier (upstream #1117) -- BUGFIX: Reduce the number of ERROR_TOO_MANY_RE_FIBERS errors for certain hex pattern containing large jumps (upstream #1107) -- BUGFIX: Buffer overrun in “dotnet” module (upstream #1108) -- BUGFIX: Memory leak while attaching to a process fails (upstream #1070) - -* Sat Sep 28 2019 Michal Ambroz - 3.10.0-3 -- change the sphinx build dependency - -* Sat Jul 27 2019 Fedora Release Engineering - 3.10.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Fri May 03 2019 Michal Ambroz - 3.10.0-1 -- bump to 3.10.0 release (#1680204) -- Harden virtual machine against malicious code. -- BUGFIX: Regression bug in hex strings containing wildcards (upstream #1025). -- BUGFIX: Buffer overrun in “elf” module. -- BUGFIX: Buffer overrun in “dotnet” module. - -* Sat Mar 16 2019 Michal Ambroz - 3.9.0-1 -- bump to 3.9.0 release (#1680203) -- switch from python-sphinx to python3-sphinx for generating the documentation for fc31+ -- should fix also #1660398 (CVE-2018-19974 CVE-2018-19975 CVE-2018-19976), - but by design it might be always dangerous to run yara signatures compiled by 3rd party, - so it is advised to re-compile yara rules instead -- BUGFIX: Denial of service when using "dex" module. Found by the Cisco Talos team. (upstream #1023, CVE-2019-5020) -- BUGFIX: Buffer overflow in "dotnet" module. -- BUGFIX: Regexp regression when using nested quantifiers {x,y} for certain values of x and y. (#1018) - -* Sun Feb 03 2019 Fedora Release Engineering - 3.8.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Mon Aug 27 2018 Michal Ambroz - 3.8.1-1 -- bump to 3.8.1 release (#1613093) - -* Sat Jul 14 2018 Fedora Release Engineering - 3.7.1-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Fri Feb 09 2018 Fedora Release Engineering - 3.7.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Mon Feb 05 2018 Michal Ambroz - 3.7.1-1 -- bump to 3.7.1 release (#1534993) - -* Wed Nov 15 2017 Michal Ambroz - 3.7.0-1 -- bump to 3.7.0 release (#1511921) - -* Thu Aug 03 2017 Fedora Release Engineering - 3.6.3-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild - -* Thu Jul 27 2017 Fedora Release Engineering - 3.6.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Sun Jul 16 2017 Michal Ambroz - 3.6.3-1 -- bump to 3.6.3 release - bugfix CVE-2017-11328 - -* Mon Jul 03 2017 Michal Ambroz - 3.6.2-1 -- bump to 3.6.2 release - bugfix CVE-2017-9304, CVE-2017-9465 - -* Wed May 24 2017 Michal Ambroz - 3.6.0-1 -- bump to 3.6.0 release -- update the androguard-yara with bugfixes - -* Thu Apr 13 2017 Michal Ambroz - 3.5.0-7 -- Adding patch from pull request 627 until 3.5.1 is released -- https://patch-diff.githubusercontent.com/raw/VirusTotal/yara/pull/627.patch -- Fixes CVE-2016-10210 CVE-2016-10211 CVE-2017-5923 CVE-2017-5924 - -* Sat Feb 11 2017 Fedora Release Engineering - 3.5.0-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Tue Aug 09 2016 Michal Ambroz - 3.5.0-5 -- import package to Fedora -- remove unnecessary .buildinfo tag from doc package - -* Fri Aug 05 2016 Michal Ambroz - 3.5.0-4 -- package review - bugzilla #1362265 -- cosmetics of the changelog -- using default spinx theme to remove the static fonts - -* Fri Aug 05 2016 Michal Ambroz - 3.5.0-3 -- package review - bugzilla #1362265 -- dropped Buildroot, pkgconfig, zlib-devel, defattr -- added buildrequires gcc -- change license back to ASL 2.0 only - -* Thu Aug 04 2016 Michal Ambroz - 3.5.0-2 -- package review - bugzilla #1362265 -- changed packaging of doc sub-package - -* Thu Aug 04 2016 Michal Ambroz - 3.5.0-1 -- bump to new 3.5.0 - -* Wed Aug 03 2016 Michal Ambroz - 3.4.0-6 -- package review - bugzilla #1362265 -- dropped dependency of python-tools - -* Mon Aug 01 2016 Michal Ambroz - 3.4.0-4 -- compile with the androguard module - -* Wed Jun 08 2016 Michal Ambroz - 3.4.0-2 -- jansson dependency >= 2.5 - -* Wed Jun 08 2016 Michal Ambroz - 3.4.0-1 -- python3 stuff - -* Mon Jun 22 2015 Michal Ambroz - 3.4.0-0.git20150618 -- initial build for Fedora Project +%autochangelog From d60650f58691cc1f2fe73451e7f0b29b7a0cf4a4 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Tue, 8 Oct 2024 13:36:29 -0400 Subject: [PATCH 28/45] Remove unused pcre dependency pcre (8.x) is deprecated, but is not used during the build. --- yara.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/yara.spec b/yara.spec index cdfc9f8..fd8aad7 100644 --- a/yara.spec +++ b/yara.spec @@ -58,7 +58,6 @@ BuildRequires: sed BuildRequires: gawk BuildRequires: gzip BuildRequires: xz -BuildRequires: pcre BuildRequires: bison BuildRequires: flex BuildRequires: libtool From 416511b0fbeab19afe8282164f90ecaca9359613 Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Tue, 22 Oct 2024 13:42:06 +0100 Subject: [PATCH 29/45] Rebuild for Jansson 2.14 (https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/3PYINSQGKQ4BB25NQUI2A2UCGGLAG5ND/) From 1f6342e7280f2c39a44b715caff18af61322b5d3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 16:30:40 +0000 Subject: [PATCH 30/45] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 226db1427f0910982af64d301a0d071243db3111 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Fri, 23 May 2025 19:04:31 +0200 Subject: [PATCH 31/45] bump to 4.5.3 --- sources | 2 +- yara.spec | 13 ++++++------- 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/sources b/sources index 32ad6b8..7d8f897 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.5.2.tar.gz) = 761f3930117c35d87b0e3be1a5d61a6887006470fdf578164feb1bd56a96b2d85770ab7c3a21258a2781ff3327cb705942f4f0eb959cff4b210f0c7fbec1fc30 +SHA512 (yara-4.5.3.tar.gz) = 185c2e29655f1c874ba48b8b5a764e7fad6496b8f041b9dd1157deed28fdfde611343b7c331bb43876e4724bdc680d035a08dca101d3a48951cd2c5ae5071cbb diff --git a/yara.spec b/yara.spec index fd8aad7..459469e 100644 --- a/yara.spec +++ b/yara.spec @@ -1,6 +1,5 @@ Name: yara -Version: 4.5.2 -%global baserelease 1 +Version: 4.5.3 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: git:https://github.com/VirusTotal/yara/ @@ -21,9 +20,9 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara -# Commit of version 4.5.2 -%global gitdate 20240910 -%global commit 688268d83983a0d61bb68ef3d8dfd28102b7d1b4 +# Commit of version 4.5.3 +%global gitdate 20250522 +%global commit 2e64b4c12d3ecc9accedb066bd9b77f97e20be38 %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release @@ -31,12 +30,12 @@ and a Boolean expression which determine its logic.} # Build from git release version %if %{with release} -Release: %autorelease -b %{baserelease} +Release: %autorelease # Source0: https://github.com/%%{gituser}/%%{gitname}/archive/v%%{upversion}.tar.gz#/%%{name}-%%{upversion}.tar.gz Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz %else # Build from git commit baseline -Release: %autorelease -b %{baserelease} -s %{gitdate}git%{shortcommit} +Release: %autorelease -s %{gitdate}git%{shortcommit} Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz %endif From d45d9cc3d92d341f346e3c3e7f30a9b2bfb2dcdd Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Tue, 3 Jun 2025 17:12:55 +0200 Subject: [PATCH 32/45] bump to yara 4.5.4 --- yara.spec | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/yara.spec b/yara.spec index 459469e..1146855 100644 --- a/yara.spec +++ b/yara.spec @@ -1,5 +1,5 @@ Name: yara -Version: 4.5.3 +Version: 4.5.4 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: git:https://github.com/VirusTotal/yara/ @@ -20,9 +20,9 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara -# Commit of version 4.5.3 -%global gitdate 20250522 -%global commit 2e64b4c12d3ecc9accedb066bd9b77f97e20be38 +# Commit of version 4.5.4 +%global gitdate 20250527 +%global commit 7ff39042be5c63682a037e13a75221d59393cf8b %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release From d8014c41828b2beed5be83f375d09f4095edfd4e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 21:10:43 +0000 Subject: [PATCH 33/45] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From ec3a8c26f3312d5d8c24c3e66d53cd8c75e416b3 Mon Sep 17 00:00:00 2001 From: Zephyr Lykos Date: Fri, 5 Sep 2025 18:07:09 +0800 Subject: [PATCH 34/45] Update sources file --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 7d8f897..97951e0 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.5.3.tar.gz) = 185c2e29655f1c874ba48b8b5a764e7fad6496b8f041b9dd1157deed28fdfde611343b7c331bb43876e4724bdc680d035a08dca101d3a48951cd2c5ae5071cbb +SHA512 (yara-4.5.4.tar.gz) = b1da40636f9e55bb07cc911479e6dfa8dc7a4fa3f6b9f10b9f669d741d7af51a1d31e044f9842ec3ab9c6ac9788fbdb89a1686c9e3f22f68d1f9e5fb3db22167 From 91d3b2ea4c45d8205c788dd3c0b8fb92d03f125a Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Sun, 16 Nov 2025 02:51:21 +0100 Subject: [PATCH 35/45] bump to 4.5.5 --- sources | 2 +- yara.spec | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/sources b/sources index 97951e0..914c229 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.5.4.tar.gz) = b1da40636f9e55bb07cc911479e6dfa8dc7a4fa3f6b9f10b9f669d741d7af51a1d31e044f9842ec3ab9c6ac9788fbdb89a1686c9e3f22f68d1f9e5fb3db22167 +SHA512 (yara-4.5.5.tar.gz) = e71d6e435cb2ad7b5875ccabcfe3abe42e2f37187a22e778867c5c5762134961369c2cbd4bea8da9193d5381af4569e39a50156d4077dc3a23b9a2240b741b60 diff --git a/yara.spec b/yara.spec index 1146855..e5a1b8b 100644 --- a/yara.spec +++ b/yara.spec @@ -1,5 +1,5 @@ Name: yara -Version: 4.5.4 +Version: 4.5.5 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: git:https://github.com/VirusTotal/yara/ @@ -20,9 +20,9 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara -# Commit of version 4.5.4 -%global gitdate 20250527 -%global commit 7ff39042be5c63682a037e13a75221d59393cf8b +# Commit of version 4.5.5 +%global gitdate 20251030 +%global commit f44a8958e88daa75d765a52a68876f2286d57a51 %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release From 877ff5a104e654a1d9340e424436a76e905cc384 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 17 Jan 2026 21:00:32 +0000 Subject: [PATCH 36/45] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From fdef2be6a36a77c46f9a5dcc223fe661eb36f223 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Thu, 7 May 2026 12:12:44 +0200 Subject: [PATCH 37/45] yara bump to 4.5.6 --- sources | 2 +- yara.spec | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/sources b/sources index 914c229..2648e40 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.5.5.tar.gz) = e71d6e435cb2ad7b5875ccabcfe3abe42e2f37187a22e778867c5c5762134961369c2cbd4bea8da9193d5381af4569e39a50156d4077dc3a23b9a2240b741b60 +SHA512 (yara-4.5.6.tar.gz) = 38554e4b2d67bd70673ae5aa8db3984c9b1e06a1e354012ea24bf81ddc2060ef0e873d56209c3f9a7823dfc1638aa9c5d16e6d03b04f0882a197c86554e5888a diff --git a/yara.spec b/yara.spec index e5a1b8b..8eb7778 100644 --- a/yara.spec +++ b/yara.spec @@ -1,5 +1,5 @@ Name: yara -Version: 4.5.5 +Version: 4.5.6 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: git:https://github.com/VirusTotal/yara/ @@ -20,9 +20,9 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara -# Commit of version 4.5.5 -%global gitdate 20251030 -%global commit f44a8958e88daa75d765a52a68876f2286d57a51 +# Commit of version 4.5.6 +%global gitdate 20260505 +%global commit db49ed032e9cc931c919baba2b057df563d28e40 %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release From 3618af25ab53671ddd5092e93f2e27522388422e Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Wed, 3 Jun 2026 11:19:06 +0200 Subject: [PATCH 38/45] bump yara to 4.5.7 --- sources | 2 +- yara.spec | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/sources b/sources index 2648e40..735eb3b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.5.6.tar.gz) = 38554e4b2d67bd70673ae5aa8db3984c9b1e06a1e354012ea24bf81ddc2060ef0e873d56209c3f9a7823dfc1638aa9c5d16e6d03b04f0882a197c86554e5888a +SHA512 (yara-4.5.7.tar.gz) = ff53b0606fa947a9ab882c1e4c610586c28b8383873c4ee589e380e7478229e5ef11572650884dbcd8e487061f744e2e0ce70807bc9d8685e2cb4f781301a05b diff --git a/yara.spec b/yara.spec index 8eb7778..cee413c 100644 --- a/yara.spec +++ b/yara.spec @@ -1,5 +1,5 @@ Name: yara -Version: 4.5.6 +Version: 4.5.7 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: git:https://github.com/VirusTotal/yara/ @@ -21,8 +21,8 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara # Commit of version 4.5.6 -%global gitdate 20260505 -%global commit db49ed032e9cc931c919baba2b057df563d28e40 +%global gitdate 20260601 +%global commit d72b85f09fcd86583836eb8c4f349cb269ec875d %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release From 8a0c6ab5ccca9aa870f6aa89dea67e0a9b93acb8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Fri, 15 May 2026 17:27:35 +0200 Subject: [PATCH 39/45] Use protobuf in version 3.x only This is part of https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x This package does not sucessfully build with new protobuf per https://copr.fedorainfracloud.org/coprs/mochaa/protobuf/monitor/ so limiting to protobuf version 3. Once the protobuf is rebase this will automatically pick up compat package protobuf3 I am not bumping release as this does not need a rebuild now. --- yara.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/yara.spec b/yara.spec index cee413c..3cbcf42 100644 --- a/yara.spec +++ b/yara.spec @@ -62,8 +62,8 @@ BuildRequires: flex BuildRequires: libtool BuildRequires: file-devel BuildRequires: jansson-devel >= 2.5 -BuildRequires: protobuf-c-devel -BuildRequires: protobuf-compiler +BuildRequires: protobuf3-c-devel +BuildRequires: protobuf-compiler < 4 %if 0%{?rhel} && 0%{?rhel} == 7 BuildRequires: openssl11-devel From 4c6bddf3a655f4ae6aca2b1fa839d52b966189e1 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Thu, 23 Apr 2026 18:05:28 -0400 Subject: [PATCH 40/45] OpenSSL 4 build fixes Signed-off-by: Simo Sorce --- ...L-accessor-functions-for-ASN1_STRING.patch | 235 ++++++++++++++++++ yara.spec | 3 +- 2 files changed, 237 insertions(+), 1 deletion(-) create mode 100644 0001-Use-OpenSSL-accessor-functions-for-ASN1_STRING.patch diff --git a/0001-Use-OpenSSL-accessor-functions-for-ASN1_STRING.patch b/0001-Use-OpenSSL-accessor-functions-for-ASN1_STRING.patch new file mode 100644 index 0000000..4cffbf9 --- /dev/null +++ b/0001-Use-OpenSSL-accessor-functions-for-ASN1_STRING.patch @@ -0,0 +1,235 @@ +From 05a1e87e77226c8dd7e2228d26e3aa462e968dc7 Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Thu, 23 Apr 2026 17:55:01 -0400 +Subject: [PATCH] Use OpenSSL accessor functions for ASN1_STRING + +Directly accessing the `data` and `length` fields of `ASN1_STRING` structures +is incompatible with newer versions of OpenSSL, where these structures are +opaque. This change replaces direct field access with the standard +`ASN1_STRING_get0_data` and `ASN1_STRING_length` accessor functions to ensure +compatibility. Additionally, an `X509_NAME_ENTRY` pointer is made `const` to +align with modern OpenSSL API signatures. + +Co-authored-by: Gemini +Signed-off-by: rpm-build +--- + .../pe/authenticode-parser/authenticode.c | 32 +++++++++---------- + .../pe/authenticode-parser/certificate.c | 4 +-- + .../pe/authenticode-parser/countersignature.c | 28 ++++++++-------- + 3 files changed, 32 insertions(+), 32 deletions(-) + +diff --git a/libyara/modules/pe/authenticode-parser/authenticode.c b/libyara/modules/pe/authenticode-parser/authenticode.c +index f385860..a2f7f74 100644 +--- a/libyara/modules/pe/authenticode-parser/authenticode.c ++++ b/libyara/modules/pe/authenticode-parser/authenticode.c +@@ -78,8 +78,8 @@ static SpcIndirectDataContent* get_content(PKCS7* content) + if (!spcContent) + return NULL; + +- int len = content->d.other->value.sequence->length; +- const uint8_t* data = content->d.other->value.sequence->data; ++ int len = ASN1_STRING_length(content->d.other->value.sequence); ++ const uint8_t* data = ASN1_STRING_get0_data(content->d.other->value.sequence); + + d2i_SpcIndirectDataContent(&spcContent, &data, len); + +@@ -88,8 +88,8 @@ static SpcIndirectDataContent* get_content(PKCS7* content) + + static char* parse_program_name(ASN1_TYPE* spcAttr) + { +- const uint8_t* spcData = spcAttr->value.sequence->data; +- int spcLen = spcAttr->value.sequence->length; ++ const uint8_t* spcData = ASN1_STRING_get0_data(spcAttr->value.sequence); ++ int spcLen = ASN1_STRING_length(spcAttr->value.sequence); + SpcSpOpusInfo* spcInfo = d2i_SpcSpOpusInfo(NULL, &spcData, spcLen); + if (!spcInfo) + return NULL; +@@ -131,8 +131,8 @@ static void parse_nested_authenticode(PKCS7_SIGNER_INFO* si, AuthenticodeArray* + ASN1_TYPE* nested = X509_ATTRIBUTE_get0_type(attr, i); + if (nested == NULL) + break; +- int len = nested->value.sequence->length; +- const uint8_t* data = nested->value.sequence->data; ++ int len = ASN1_STRING_length(nested->value.sequence); ++ const uint8_t* data = ASN1_STRING_get0_data(nested->value.sequence); + AuthenticodeArray* auth = authenticode_new(data, len); + if (!auth) + continue; +@@ -162,8 +162,8 @@ static void parse_pkcs9_countersig(PKCS7* p7, Authenticode* auth) + ASN1_TYPE* nested = X509_ATTRIBUTE_get0_type(attr, i); + if (nested == NULL) + break; +- int len = nested->value.sequence->length; +- const uint8_t* data = nested->value.sequence->data; ++ int len = ASN1_STRING_length(nested->value.sequence); ++ const uint8_t* data = ASN1_STRING_get0_data(nested->value.sequence); + + Countersignature* sig = pkcs9_countersig_new(data, len, p7->d.sign->cert, si->enc_digest); + if (!sig) +@@ -193,8 +193,8 @@ static void parse_ms_countersig(PKCS7* p7, Authenticode* auth) + ASN1_TYPE* nested = X509_ATTRIBUTE_get0_type(attr, i); + if (nested == NULL) + break; +- int len = nested->value.sequence->length; +- const uint8_t* data = nested->value.sequence->data; ++ int len = ASN1_STRING_length(nested->value.sequence); ++ const uint8_t* data = ASN1_STRING_get0_data(nested->value.sequence); + + Countersignature* csig = ms_countersig_new(data, len, si->enc_digest); + if (!csig) +@@ -209,8 +209,8 @@ static void parse_ms_countersig(PKCS7* p7, Authenticode* auth) + + static bool authenticode_verify(PKCS7* p7, PKCS7_SIGNER_INFO* si, X509* signCert) + { +- const uint8_t* contentData = p7->d.sign->contents->d.other->value.sequence->data; +- long contentLen = p7->d.sign->contents->d.other->value.sequence->length; ++ const uint8_t* contentData = ASN1_STRING_get0_data(p7->d.sign->contents->d.other->value.sequence); ++ long contentLen = ASN1_STRING_length(p7->d.sign->contents->d.other->value.sequence); + + uint64_t version = 0; + ASN1_INTEGER_get_uint64(&version, p7->d.sign->version); +@@ -315,8 +315,8 @@ AuthenticodeArray* authenticode_new(const uint8_t* data, int32_t len) + int digestnid = OBJ_obj2nid(messageDigest->digestAlgorithm->algorithm); + auth->digest_alg = strdup(OBJ_nid2ln(digestnid)); + +- int digestLen = messageDigest->digest->length; +- const uint8_t* digestData = messageDigest->digest->data; ++ int digestLen = ASN1_STRING_length(messageDigest->digest); ++ const uint8_t* digestData = ASN1_STRING_get0_data(messageDigest->digest); + byte_array_init(&auth->digest, digestData, digestLen); + + SpcIndirectDataContent_free(dataContent); +@@ -372,8 +372,8 @@ AuthenticodeArray* authenticode_new(const uint8_t* data, int32_t len) + digestnid = OBJ_obj2nid(si->digest_alg->algorithm); + signer->digest_alg = strdup(OBJ_nid2ln(digestnid)); + +- digestLen = digest->value.asn1_string->length; +- digestData = digest->value.asn1_string->data; ++ digestLen = ASN1_STRING_length(digest->value.asn1_string); ++ digestData = ASN1_STRING_get0_data(digest->value.asn1_string); + byte_array_init(&signer->digest, digestData, digestLen); + + /* Authenticode stores optional programName in non-optional SpcSpOpusInfo attribute */ +diff --git a/libyara/modules/pe/authenticode-parser/certificate.c b/libyara/modules/pe/authenticode-parser/certificate.c +index fc754e4..97c7e3e 100644 +--- a/libyara/modules/pe/authenticode-parser/certificate.c ++++ b/libyara/modules/pe/authenticode-parser/certificate.c +@@ -59,13 +59,13 @@ static void parse_name_attributes(X509_NAME* raw, Attributes* attr) + + int entryCount = X509_NAME_entry_count(raw); + for (int i = entryCount - 1; i >= 0; --i) { +- X509_NAME_ENTRY* entryName = X509_NAME_get_entry(raw, i); ++ const X509_NAME_ENTRY* entryName = X509_NAME_get_entry(raw, i); + ASN1_STRING* asn1String = X509_NAME_ENTRY_get_data(entryName); + + const char* key = OBJ_nid2sn(OBJ_obj2nid(X509_NAME_ENTRY_get_object(entryName))); + + ByteArray array = {0}; +- if (byte_array_init(&array, asn1String->data, asn1String->length) == -1) ++ if (byte_array_init(&array, ASN1_STRING_get0_data(asn1String), ASN1_STRING_length(asn1String)) == -1) + break; + + if (strcmp(key, "C") == 0 && !attr->country.data) +diff --git a/libyara/modules/pe/authenticode-parser/countersignature.c b/libyara/modules/pe/authenticode-parser/countersignature.c +index 0fb4576..6cb5eed 100644 +--- a/libyara/modules/pe/authenticode-parser/countersignature.c ++++ b/libyara/modules/pe/authenticode-parser/countersignature.c +@@ -141,13 +141,13 @@ Countersignature* pkcs9_countersig_new( + result->chain = parse_signer_chain(signCert, certs); + + /* Get digest that corresponds to decrypted encrypted digest in signature */ +- ASN1_TYPE* messageDigest = PKCS7_get_signed_attribute(si, NID_pkcs9_messageDigest); ++ const ASN1_TYPE* messageDigest = PKCS7_get_signed_attribute(si, NID_pkcs9_messageDigest); + if (!messageDigest) { + result->verify_flags = COUNTERSIGNATURE_VFY_DIGEST_MISSING; + goto end; + } + +- size_t digestLen = messageDigest->value.octet_string->length; ++ size_t digestLen = ASN1_STRING_length(messageDigest->value.octet_string); + + if (!digestLen) { + result->verify_flags = COUNTERSIGNATURE_VFY_DIGEST_MISSING; +@@ -160,7 +160,7 @@ Countersignature* pkcs9_countersig_new( + goto end; + } + +- const uint8_t* digestData = messageDigest->value.octet_string->data; ++ const uint8_t* digestData = ASN1_STRING_get0_data(messageDigest->value.octet_string); + byte_array_init(&result->digest, digestData, digestLen); + + /* By this point we all necessary things for verification +@@ -187,8 +187,8 @@ Countersignature* pkcs9_countersig_new( + goto end; + } + +- uint8_t* encData = si->enc_digest->data; +- size_t encLen = si->enc_digest->length; ++ const uint8_t* encData = ASN1_STRING_get0_data(si->enc_digest); ++ size_t encLen = ASN1_STRING_length(si->enc_digest); + + /* Decrypt the encrypted digest */ + EVP_PKEY_verify_recover_init(ctx); +@@ -220,7 +220,7 @@ Countersignature* pkcs9_countersig_new( + const uint8_t* data_ptr = decData; + DigestInfo* digest_info = d2i_DigestInfo(NULL, &data_ptr, decLen); + if (digest_info) { +- isValid = !memcmp(digest_info->digest->data, calc_digest, mdLen); ++ isValid = !memcmp(ASN1_STRING_get0_data(digest_info->digest), calc_digest, mdLen); + DigestInfo_free(digest_info); + } else { + isValid = false; +@@ -235,7 +235,7 @@ Countersignature* pkcs9_countersig_new( + + /* Now check the countersignature message-digest that should correspond + * to Signatures encrypted digest it countersigns */ +- calculate_digest(md, enc_digest->data, enc_digest->length, calc_digest); ++ calculate_digest(md, ASN1_STRING_get0_data(enc_digest), ASN1_STRING_length(enc_digest), calc_digest); + + /* Check if calculated one matches the stored one */ + if (digestLen != mdLen || memcmp(calc_digest, digestData, mdLen) != 0) { +@@ -269,8 +269,8 @@ TS_TST_INFO* IMPL_FUNC_NAME(get_ts_tst_info, cms)(CountersignatureImpl* impl) + return NULL; + } + +- const uint8_t* data = (*content)->data; +- TS_TST_INFO* ts_tst_info = d2i_TS_TST_INFO(NULL, &data, (*content)->length); ++ const uint8_t* data = ASN1_STRING_get0_data(*content); ++ TS_TST_INFO* ts_tst_info = d2i_TS_TST_INFO(NULL, &data, ASN1_STRING_length(*content)); + if (!ts_tst_info) { + return NULL; + } +@@ -400,8 +400,8 @@ int IMPL_FUNC_NAME(verify_digest, cms)( + return 0; + } + +- if (ts_imprint_digest->length != (int)digest_size || +- memcmp(ts_imprint_digest->data, digest, digest_size) != 0) { ++ if (ASN1_STRING_length(ts_imprint_digest) != (int)digest_size || ++ memcmp(ASN1_STRING_get0_data(ts_imprint_digest), digest, digest_size) != 0) { + TS_TST_INFO_free(ts_tst_info); + return 0; + } +@@ -554,8 +554,8 @@ Countersignature* ms_countersig_new(const uint8_t* data, long size, ASN1_STRING* + + ASN1_STRING* rawDigest = TS_MSG_IMPRINT_get_msg(imprint); + +- int digestLen = rawDigest->length; +- uint8_t* digestData = rawDigest->data; ++ int digestLen = ASN1_STRING_length(rawDigest); ++ const uint8_t* digestData = ASN1_STRING_get0_data(rawDigest); + + byte_array_init(&result->digest, digestData, digestLen); + +@@ -571,7 +571,7 @@ Countersignature* ms_countersig_new(const uint8_t* data, long size, ASN1_STRING* + } + + uint8_t calc_digest[EVP_MAX_MD_SIZE]; +- calculate_digest(md, enc_digest->data, enc_digest->length, calc_digest); ++ calculate_digest(md, ASN1_STRING_get0_data(enc_digest), ASN1_STRING_length(enc_digest), calc_digest); + + #if OPENSSL_VERSION_NUMBER >= 0x3000000fL + int mdLen = EVP_MD_get_size(md); +-- +2.53.0 + diff --git a/yara.spec b/yara.spec index 3cbcf42..9469cec 100644 --- a/yara.spec +++ b/yara.spec @@ -42,7 +42,8 @@ Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name # Use default sphix theme to generate documentation rather than sphinx_rtd_theme # to avoid static installation of font files on fedora >= 24 Patch1: yara-docs-theme.patch - +# OpenSSL 4 build fixes +Patch2: 0001-Use-OpenSSL-accessor-functions-for-ASN1_STRING.patch BuildRequires: git BuildRequires: gcc From d0019a2f8ded2be5b7bbd12c32167f4a19ea9240 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Fri, 12 Jun 2026 16:41:38 -0400 Subject: [PATCH 41/45] Rebuilt for openssl 4.0 From 52aec2fd900da6e76ed6f1e4d626f5d10f1b76e6 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 1 Jul 2026 18:33:33 -0400 Subject: [PATCH 42/45] Rebuild with latest protobuf --- yara.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/yara.spec b/yara.spec index 9469cec..27b1ef1 100644 --- a/yara.spec +++ b/yara.spec @@ -63,8 +63,8 @@ BuildRequires: flex BuildRequires: libtool BuildRequires: file-devel BuildRequires: jansson-devel >= 2.5 -BuildRequires: protobuf3-c-devel -BuildRequires: protobuf-compiler < 4 +BuildRequires: protobuf-c-devel +BuildRequires: protobuf-compiler %if 0%{?rhel} && 0%{?rhel} == 7 BuildRequires: openssl11-devel From 1e1e2ca243ef6312cb31a553c6923ca6a30cac67 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jul 2026 09:33:00 +0000 Subject: [PATCH 43/45] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild From 540af1acd5761aeca826f97deca109c2182bbed4 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 24 Aug 2026 18:03:20 +0200 Subject: [PATCH 44/45] bump to 4.5.8 --- yara.spec | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/yara.spec b/yara.spec index 27b1ef1..2da48b6 100644 --- a/yara.spec +++ b/yara.spec @@ -1,5 +1,5 @@ Name: yara -Version: 4.5.7 +Version: 4.5.8 Summary: Pattern matching Swiss knife for malware researchers URL: https://VirusTotal.github.io/yara/ VCS: git:https://github.com/VirusTotal/yara/ @@ -20,9 +20,9 @@ and a Boolean expression which determine its logic.} %global gituser VirusTotal %global gitname yara -# Commit of version 4.5.6 -%global gitdate 20260601 -%global commit d72b85f09fcd86583836eb8c4f349cb269ec875d +# Commit of version 4.5.8 +%global gitdate 20260728 +%global commit 84b0e3cc0e42f8f8e6b84d19c97ec3ac6ff8aee8 %global shortcommit %(c=%{commit}; echo ${c:0:7}) %bcond_without release From 60a93fd33bff98078e0254e8caab125d6c43b0f3 Mon Sep 17 00:00:00 2001 From: Michal Ambroz Date: Mon, 24 Aug 2026 18:04:01 +0200 Subject: [PATCH 45/45] bump to 4.5.8 --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 735eb3b..967aa60 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (yara-4.5.7.tar.gz) = ff53b0606fa947a9ab882c1e4c610586c28b8383873c4ee589e380e7478229e5ef11572650884dbcd8e487061f744e2e0ce70807bc9d8685e2cb4f781301a05b +SHA512 (yara-4.5.8.tar.gz) = 12bbe1bebb6d51f7ae90ad6a725bdb096f3e884b757913e9ba37bfa1557bced32ef56895eb358af5f3165890336be57dc51e9fe2ad672c1e523cb30e00483c86