search

VirusTotal / yara-python

The Python interface for YARA
http://virustotal.github.io/yara/
Apache License 2.0
646 stars 179 forks source link

Fix build on macos. #173

Closed wxsBSD closed 3 years ago

wxsBSD commented 3 years ago

When building on macos I noticed that libcrypto was not found when using has_function(). This is because the compiler used to compile the check program is not being told about the library and include paths. Fix it by passing those into the has_function() check where appropriate.

I have no idea how long this has been going on but it seems like it may have been broken for a while now and we somehow didn't notice?

wxsBSD commented 3 years ago

Any easy way to test if this is happening on your system is to build yara-python and then do PYTHONPATH=build/lib<TAB COMPLETE THE DIR> python3 -c "import yara; yara.compile(source='''import \"hash\" rule a { condition: hash.sha256(0, 10) == \"pants\" }''')" - you should see something like this:

Traceback (most recent call last):
  File "<string>", line 1, in <module>
yara.SyntaxError: line 1: invalid field name "sha256"

I am not at all convinced this is a good fix as I don't really understand what changed in macos to cause this.