Subject: Re: [bug#66608] [PATCH v2] gnu: Add yara.

From: Divya Ranjan <[email-masked]>
Date: Wed, 05 Mar 2025 22:12:44 +0000

The last patch was failing because I forgot to change bash to bash-minimal in the gexp, here’s a revised patch that builds and the linter doesn’t complain:
>From 42d544e60f50052e5a263f63dda62fe0297fad35 Mon Sep 17 00:00:00 2001
Message-ID: <[email-masked]>
From: Divya Ranjan <[email-masked]>
Date: Wed, 5 Mar 2025 21:50:45 +0000
Subject: [PATCH] gnu: Add yara.

* gnu/packages/antivirus.scm (yara): New variable.

Change-Id: I6ecad2cc6cc797102269ccde80071f7290db44e4
---
 gnu/packages/antivirus.scm | 41 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/gnu/packages/antivirus.scm b/gnu/packages/antivirus.scm
index 23af26f411..52bbe6b818 100644
--- a/gnu/packages/antivirus.scm
+++ b/gnu/packages/antivirus.scm
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2016, 2017, 2018, 2019, 2020 Eric Bavier <[email-masked]>
 ;;; Copyright © 2018 Christopher Baines <[email-masked]>
+;;; Copyright © 2023 Jakob Kirsch <[email-masked]>
 ;;; Copyright © 2019–2021 Tobias Geerinckx-Rice <[email-masked]>
 ;;; Copyright © 2024 Nicolas Graves <[email-masked]>
 ;;;
@@ -27,8 +28,11 @@ (define-module (gnu packages antivirus)
   #:use-module (guix gexp)
   #:use-module (guix packages)
   #:use-module (guix download)
+  #:use-module (guix git-download)
   #:use-module (guix utils)
   #:use-module (gnu packages)
+  #:use-module (gnu packages autotools)
+  #:use-module (gnu packages bash)
   #:use-module (gnu packages check)
   #:use-module (gnu packages compression)
   #:use-module (gnu packages cmake)
@@ -40,6 +44,7 @@ (define-module (gnu packages antivirus)
   #:use-module (gnu packages ncurses)
   #:use-module (gnu packages pcre)
   #:use-module (gnu packages pkg-config)
+  #:use-module (gnu packages protobuf)
   #:use-module (gnu packages python)
   #:use-module (gnu packages python-check)
   #:use-module (gnu packages rust-apps)
@@ -185,3 +190,39 @@ (define-public clamav
                    (license:non-copyleft "libclamav/strlcat.c") ;"OpenBSD" license
                    license:asl2.0       ;libclamav/yara*
                    license:expat))))    ;shared/getopt.[ch]
+
+(define-public yara
+  (package
+    (name "yara")
+    (version "v4.5.2")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/VirusTotal/yara")
+             (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1qaw1zv618jkqa5g39p1sdv8s6a7q23ayqfrqv0bj2z1g4nmn95g"))))
+    (build-system gnu-build-system)
+    (native-inputs (list autoconf automake libtool protobuf pkg-config))
+    (inputs (list openssl bash-minimal))
+    (arguments
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'check 'remove-bin-sh-in-test
+            (lambda _
+              (substitute* "tests/test-rules.c"
+                (("/bin/sh")
+                 (string-append #$(this-package-input "bash-minimal") "/bin/sh"))))))))
+
+    (synopsis "The pattern matching swiss knife")
+    (description
+     "YARA is a tool aimed at (but not limited to) helping malware researchers to
+identify and classify malware samples.  With YARA you can create descriptions of
+malware families (or whatever you want to describe) based on textual or binary patterns.
+Each description, a.k.a. rule, consists of a set of strings and a boolean expression
+which determine its logic.")
+    (home-page "https://github.com/VirusTotal/yara")
+    (license license:bsd-3)))

base-commit: 310adf4ce70cbb864859274fcc7842bd519bbddc
-- 
2.48.1

- 
Divya Ranjan,
Philosophy, Mathematics, Libre Software.

PGP Fingerprint: F0B3 1A69 8006 8FB8 096A  2F12 B245 10C6 108C 8D4A