Need backwards compatible logic baked into YARA as a META tag about yara-project

[GoogleCodeExporter]

Even if this feature is implemented it won't apply to version 1.6 and lower. I 
mean, in version 1.7 you will be able to ignore new syntax included in version 
1.8, but version 1.6 and lower will fail anyway.

Could you explain a little more your real-life situation where this feature is 
needed? Why not keeping your YARA version up to date?

Original comment by [email protected] on 11 May 2012 at 12:25

[GoogleCodeExporter]

Sure, I'd be happy to provide more detail:

Assume you have 1,000's of "systems" all with YARA installed.  Do you really 
think its realistic that you should have to "upgrade" those instances of YARA, 
simultaneously?  If you have a directory containing your "master YARA rule 
list" that is being replicated out to each of these systems, before you upgrade 
_any_ of those rules to leverage new features, you have to make sure that all 
versions of YARA across all 1000 systems are updated, accordingly.  Currently, 
to get around this, you'd have to externally maintain different "versions" of 
the "master list" for each version of YARA, which makes overall rule management 
more painful than it needs to be.

Yes, if v1.7 started implementing this feature, you would still have to deal 
with this painful setup at least until all your systems are upgraded to v1.7.  
But, once that happens, when v1.8 and later is released, the process becomes 
much more manageable.

Lastly, if you're accepting YARA rules for a third-party, having an option to 
require min_version on each rule makes it easier to perform initial rule 
_validation_ back to that third-party.  For example, if you're running YARA 
v1.4 and the third-party uploads v1.6 YARA rules, we can have YARA output an 
explicit "unsupported version" error message, rather than vague syntax errors, 
which we then have to decipher and translate as "unsupported version", 
accordingly.

Does this make sense?

Original comment by [email protected] on 11 May 2012 at 2:09

[GoogleCodeExporter]

To clarify further, if YARA v1.7 implemented the "min_version" meta tag, you 
could then provide a command-line options like:

--enforce_version

If (--enforce_version) were present, YARA would explicitly generate errors if 
it encountered any rule with min_version _higher_ than its current version.

If (--enforce_version) were NOT present, then YARA would _silently_ ignore any 
rules where min_version is _higher_ than its current version.

Original comment by [email protected] on 11 May 2012 at 2:13

[GoogleCodeExporter]

Ok, I see your point. But I think, I would prefer some kind of preprocesor 
directives in the style of the C language. For example:

#if yara_version >= 1.7

some rules here using new features available in 1.7

#endif

That would be more flexible. What do you think?

Original comment by [email protected] on 11 May 2012 at 11:05

[GoogleCodeExporter]

Sure, that makes complete sense.  Thanks for your time!

Original comment by [email protected] on 12 May 2012 at 12:08

[GoogleCodeExporter]

This will be solved with a C-style preprocessor with conditionals. See issue 61.

Original comment by [email protected] on 15 Aug 2012 at 4:11

[GoogleCodeExporter]

Original comment by [email protected] on 15 Aug 2012 at 4:12

• Changed state: WontFix