Merge pull request #182814 from sbruder/update-flare-floss

pkgs/development/python-modules/python-flirt/default.nix

@@ -0,0 +1,46 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, rustPlatform
+}:
+
+buildPythonPackage rec {
+  pname = "python-flirt";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "williballenthin";
+    repo = "lancelot";
+    rev = "v${version}";
+    sha256 = "sha256-FsdnWWfyQte7FDz5ldo+S+3IEtbOIODOeh1fHDP2/4s=";
+  };
+
+  postPatch = ''
+    cp ${./Cargo.lock} Cargo.lock
+  '';
+
+  format = "pyproject";
+
+  nativeBuildInputs = with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+  ];
+
+  buildAndTestSubdir = "pyflirt";
+
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "zydis-3.1.1" = "sha256-/L28cBTCg/S7onDQXnqUoB5udoEO/depmxDUcnfIQEw=";
+    };
+  };
+
+  pythonImportsCheck = [ "flirt" ];
+
+  meta = with lib; {
+    description = "Python library for parsing, compiling, and matching Fast Library Identification and Recognition Technology (FLIRT) signatures";
+    homepage = "https://github.com/williballenthin/lancelot/tree/master/pyflirt";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ sbruder ];
+  };
+}

pkgs/development/python-modules/viv-utils/default.nix

@@ -1,45 +1,52 @@
 { lib
 , buildPythonPackage
-, isPy3k
 , fetchFromGitHub
 , funcy
-, pefile
-, vivisect
 , intervaltree
-, setuptools
+, pefile
+, typing-extensions
+, vivisect
+, pytest-sugar
+, pytestCheckHook
+, python-flirt
 }:
 buildPythonPackage rec {
   pname = "viv-utils";
-  version = "0.3.17";
-  disabled = isPy3k;
+  version = "0.7.5";
 
   src = fetchFromGitHub {
     owner = "williballenthin";
     repo = "viv-utils";
     rev = "v${version}";
-    sha256 = "wZWp6PMn1to/jP6lzlY/x0IhS/0w0Ys7AdklNQ+Vmyc=";
+    sha256 = "sha256-JDu+1n1wP2Vsp2V/bKdE+RFp6bE8RNmimi4wdsatwME=";
   };
 
-  # argparse is provided by Python itself
-  preBuild = ''
-    sed '/"argparse",/d' -i setup.py
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "==" ">="
   '';
 
   propagatedBuildInputs = [
     funcy
-    pefile
-    vivisect
     intervaltree
-    setuptools
+    pefile
+    typing-extensions
+    vivisect
   ];
 
-  # no tests
-  doCheck = false;
-
-  pythonImportsCheck = [
-    "viv_utils"
+  checkInputs = [
+    pytest-sugar
+    pytestCheckHook
   ];
 
+  passthru = {
+    optional-dependencies = {
+      flirt = [
+        python-flirt
+      ];
+    };
+  };
+
   meta = with lib; {
     description = "Utilities for working with vivisect";
     homepage = "https://github.com/williballenthin/viv-utils";

pkgs/tools/security/flare-floss/default.nix

@@ -2,44 +2,73 @@
 , python3
 , fetchFromGitHub
 }:
+let
+  py = python3.override {
+    packageOverrides = final: prev: {
+      # required for networkx 2.5.1
+      decorator = prev.decorator.overridePythonAttrs (o: o // rec {
+        version = "4.4.2";
+        src = o.src.override {
+          inherit version;
+          sha256 = "sha256-46YvBSAXJEDKDcyCN0kxk4Ljd/N/FAoLme9F/suEv+c=";
+        };
+      });
 
-python3.pkgs.buildPythonPackage rec {
+      # flare-floss requires this exact version (newer versions are incompatible)
+      networkx = prev.networkx.overridePythonAttrs (o: o // rec {
+        version = "2.5.1";
+        src = o.src.override {
+          inherit version;
+          sha256 = "sha256-EJzVhcrEEpf3EQPDxCrG73N58peI61TLdRvlpmO7I1o=";
+        };
+      });
+    };
+  };
+in
+py.pkgs.buildPythonPackage rec {
   pname = "flare-floss";
-  version = "1.7.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
-    owner = "fireeye";
+    owner = "mandiant";
     repo = "flare-floss";
     rev = "v${version}";
-    sha256 = "GMOA1+qM2A/Qw33kOTIINEvjsfqjWQWBXHNemh3IK8w=";
+    fetchSubmodules = true; # for tests
+    sha256 = "sha256-V4OWYcISyRdjf8x93B6h2hJwRgmRmk32hr8TrgRDu8Q=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
-    pyyaml
-    simplejson
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "==" ">="
+
+    substituteInPlace floss/main.py \
+      --replace 'sigs_path = os.path.join(get_default_root(), "sigs")' 'sigs_path = "'"$out"'/share/flare-floss/sigs"'
+  '';
+
+  propagatedBuildInputs = with py.pkgs; [
+    halo
+    networkx
+    pydantic
     tabulate
-    vivisect
-    plugnplay
+    tqdm
     viv-utils
-  ];
+    vivisect
+  ] ++ viv-utils.optional-dependencies.flirt;
 
-  checkInputs = with python3.pkgs; [
+  checkInputs = with py.pkgs; [
+    pytest-sugar
     pytestCheckHook
+    pyyaml
   ];
 
-  disabledTests = [
-    # test data is in a submodule
-    "test_main"
-  ];
-
-  pythonImportsCheck = [
-    "floss"
-    "floss.plugins"
-  ];
+  postInstall = ''
+    mkdir -p $out/share/flare-floss/
+    cp -r sigs $out/share/flare-floss/
+  '';
 
   meta = with lib; {
     description = "Automatically extract obfuscated strings from malware";
-    homepage = "https://github.com/fireeye/flare-floss";
+    homepage = "https://github.com/mandiant/flare-floss";
     license = licenses.asl20;
     maintainers = teams.determinatesystems.members;
   };

pkgs/top-level/python-packages.nix

@@ -6741,6 +6741,8 @@ in {
 
   python-ecobee-api = callPackage ../development/python-modules/python-ecobee-api { };
 
+  python-flirt = callPackage ../development/python-modules/python-flirt { };
+
   python-glanceclient = callPackage ../development/python-modules/python-glanceclient { };
 
   python-google-nest = callPackage ../development/python-modules/python-google-nest { };