Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Scan file descriptors rather than files per go-yara docs #406

Merged
merged 1 commit into from
Aug 16, 2024

Conversation

egibs
Copy link
Member

@egibs egibs commented Aug 15, 2024

This is a quick PR to swap over from scanning files to scanning file descriptors.

go-yara's documentation mentions that this is the better route in a comment above ScanFile:

// ScanFile scans a file using the ruleset. For every
// event emitted by libyara, the corresponding method on the
// ScanCallback object is called.
//
// Note that the filename is passed as-is to the YARA library and may
// not be processed in a sensible way. It is recommended to avoid this
// function and to obtain an os.File handle f using os.Open() and use
// ScanFileDescriptor(f.Fd(), …) instead.

In my testing, this shaved off several seconds of overhead.

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
@egibs egibs requested review from tstromberg and hectorj2f August 15, 2024 22:21
@egibs egibs merged commit cb97c60 into chainguard-dev:main Aug 16, 2024
10 checks passed
@egibs egibs deleted the use-file-descriptor branch August 16, 2024 14:23
egibs added a commit to egibs/malcontent that referenced this pull request Sep 25, 2024
…dev#406)

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants