Rule sources

Where the rules come from, how each commit is pinned and the role of every source.

Which sources count

Public source	Technical id	Actual role
Nextron Systems — signature-base	`Neo23x0/signature-base`	Effective rule source. The `yara` directory is downloaded.
Comunidad de reglas YARA (Yara-Rules)	`Yara-Rules/rules`	Effective rule source (community): `malware`, `packers`, `crypto`, `antidebug_antivm`, `capabilities`, `exploit_kits`, `webshells`.
VirusTotal — ecosistema YARA y YARA-X	`VirusTotal/yara-x`	Reference engine, no rules. Recorded in `config/sources.json` as kind `engine`; today it contributes no files to the channel.

CURRENT A forum or community repository is an effective source only if it is in the allow-list config/sources.json. Any other source is PROPOSED until it is added with its licence reviewed.

How it is collected

Diagram: Collection sequence

Drawing the diagram…

sequenceDiagram
  autonumber
  participant GA as GitHub Actions daily.yml
  participant PR as prepare.py
  participant API as GitHub API
  participant UP as Upstream repository
  participant INV as dist/candidate.json
  GA->>PR: run with the job token
  PR->>API: GET commits/HEAD
  API-->>PR: commit sha (pinned for this run)
  PR->>API: GET license
  API-->>PR: SPDX id and LICENSE text
  PR->>API: GET tarball at that sha
  API->>UP: snapshot of that commit
  UP-->>PR: tar.gz (max 90 MB)
  PR->>PR: safe extraction, keep .yar and .yara under allowed paths
  PR->>PR: reject over 1 MB or NUL bytes, SHA-256 of each file
  PR->>INV: sources with commit and licence check, files with path sha256 bytes

Diagram description

GitHub Actions runs prepare.py, which asks the GitHub API for the newest commit of each source, reads the licence, downloads the tarball of exactly that commit, extracts it safely, keeps only allowed .yar and .yara files, rejects oversized or binary files, hashes every file and writes the inventory candidate.json.

Mermaid code

sequenceDiagram
  autonumber
  participant GA as GitHub Actions daily.yml
  participant PR as prepare.py
  participant API as GitHub API
  participant UP as Upstream repository
  participant INV as dist/candidate.json
  GA->>PR: run with the job token
  PR->>API: GET commits/HEAD
  API-->>PR: commit sha (pinned for this run)
  PR->>API: GET license
  API-->>PR: SPDX id and LICENSE text
  PR->>API: GET tarball at that sha
  API->>UP: snapshot of that commit
  UP-->>PR: tar.gz (max 90 MB)
  PR->>PR: safe extraction, keep .yar and .yara under allowed paths
  PR->>PR: reject over 1 MB or NUL bytes, SHA-256 of each file
  PR->>INV: sources with commit and licence check, files with path sha256 bytes

The newest commit of each source is queried and the tarball of that exact commit is downloaded, so the candidate is reproducible.
Only .yar and .yara under the allowed paths are kept; files over 1 MB or with NUL bytes are skipped (event file.skipped).
The licence is checked against config/policy.json: the "Detection Rule License" marker for Nextron and GPL-2.0 for Yara-Rules. A licence change goes to quarantine.

What is recorded

Every release carries, in release.json and the manifest, the list of sources with repository, commit and licence-check result, so it is possible to reconstruct where each file came from.