feat: wire offsetscan yara subcommand (schema-parity with Invoke-OffsetYaraScan); refactor PE assembly; fix strict-path overlay

[warpedatom]

Summary by Sourcery

Add a feature-gated YARA scanning subcommand and unify PE assembly/overlay handling while fixing a strict-path overlay inconsistency.

New Features:

• Introduce an offsetscan yara CLI subcommand that scans files against one or more YARA rule files and emits OffsetInspect-compatible match records.
• Provide a YARA scan implementation that supports multiple rule files, per-file timeouts, optional recursion, and NDJSON or pretty JSON output, with a clear stub message when the feature is disabled.

Bug Fixes:

• Correct strict-path PE overlay computation to ignore zero-raw-size sections so both parse paths and OffsetInspect agree on overlay boundaries.

Enhancements:

• Refactor PE parsing to share a single assemble_pe_info builder between strict and lenient paths, removing duplicated struct assembly and overlay logic.
• Clarify YARA scan documentation and JSON schema, and lock the field names via a unit test to ensure parity with OffsetInspect.

Build:

• Bump the yara crate to 0.32 and enable its vendored feature so YARA support builds reliably without a system-wide libyara install.

Documentation:

• Update the changelog for version 0.2.0 to document the new YARA subcommand, PE refactor, dependency bump, and overlay fix.

Tests:

• Add a unit test that verifies the serialized YaraHit JSON field names match OffsetInspect’s expected schema, even when the YARA feature is disabled.

[sourcery-ai]

Reviewer's Guide

Wires up a feature-gated offsetscan yara subcommand that matches files against YARA rules with schema parity to OffsetInspect, refactors PE parsing to share a single assembler with consistent overlay computation, and updates YARA dependencies and version metadata.

Sequence diagram for the new offsetscan yara subcommand

sequenceDiagram
    actor User
    participant CLI as offsetscan_main
    participant FS as FileSystem
    participant Yara as yara_scan

    User->>CLI: Commands::Yara(path,rules,recurse,timeout,ndjson)
    CLI->>FS: expand_paths(path,recurse)
    FS-->>CLI: files

    loop per file
        CLI->>Yara: scan_with_rules(file,rules,timeout)
        Yara-->>CLI: Vec<YaraHit>
    end

    alt ndjson
        CLI->>CLI: serde_json::to_string(hit)
    else pretty JSON
        CLI->>CLI: serde_json::to_string_pretty(all_hits)
    end

    opt had_error && all_hits.is_empty()
        CLI->>CLI: std::process::exit(1)
    end

Loading

File-Level Changes

Change	Details	Files
Implement feature-gated YARA scanning with an offsetscan yara CLI subcommand that matches files against rule files and emits OffsetInspect-compatible hit records.	Extend YaraHit to match OffsetInspect’s Invoke-OffsetYaraScan schema, including field renames and additional fields for string id, hex offset, and matched data. Update scan_with_rules to accept multiple rule files and a configurable timeout, compiling all rules and emitting one hit per matched string with normalized identifiers and lossy UTF-8 rendering of match data. Provide a non-yara-scan feature stub implementation of scan_with_rules that returns a clear rebuild instruction while preserving the JSON schema type. Add a unit test that locks the serialized field names of YaraHit against the expected OffsetInspect schema. Introduce a new Yara CLI subcommand that expands paths, scans files with YARA rules, aggregates hits, supports --rules, --recurse, --timeout, and --ndjson, and handles error reporting and exit status.	src/yara_scan.rs src/main.rs
Refactor PE parsing to use a shared assemble_pe_info helper and fix overlay computation in the strict path to match the lenient path and OffsetInspect.	Extract common PE info assembly logic (including overlay computation and metadata fields) into a new assemble_pe_info function used by both strict (goblin-based) and lenient parse paths. Change overlay boundary computation to ignore sections with zero raw data size, aligning strict parsing with the lenient path and OffsetInspect’s Get-OIPEOverlayRange. Adjust parse_pe_strict and parse_pe_lenient to compute resource size/imports and then delegate to assemble_pe_info, reducing duplication and ensuring identical overlay behavior and output shape.	src/pe.rs
Update package metadata and YARA dependency to support vendored libyara and release the new functionality as version 0.2.0.	Bump crate version from 0.1.4 to 0.2.0 and document the new YARA subcommand, PE refactor, and overlay fix in the changelog. Upgrade the yara dependency from 0.28 to 0.32 and enable its vendored feature to bundle libyara at build time without requiring a system YARA installation. Note build-time requirements (C toolchain and libclang) and that CI still excludes the yara-scan feature, implying manual verification for feature builds.	Cargo.toml CHANGELOG.md Cargo.lock

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="src/main.rs" line_range="81-83" />
<code_context>
+        rules: Vec<String>,
+        #[arg(long)]
+        recurse: bool,
+        /// Per-file scan timeout in seconds.
+        #[arg(long, default_value_t = 60)]
+        timeout: i32,
+    },
 }
</code_context>
<issue_to_address>
**issue (bug_risk):** Validate or constrain `timeout` to avoid negative values being passed into YARA.

The CLI’s `i32` timeout is passed straight through to `Rules::scan_file`, so clap will accept negative values and forward them to YARA. Please either switch to an unsigned type or explicitly reject/normalize negative timeouts before calling the scan to avoid undefined behavior in the YARA API.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

issue (bug_risk): Validate or constrain timeout to avoid negative values being passed into YARA.

The CLI’s i32 timeout is passed straight through to Rules::scan_file, so clap will accept negative values and forward them to YARA. Please either switch to an unsigned type or explicitly reject/normalize negative timeouts before calling the scan to avoid undefined behavior in the YARA API.