Skip to content

merge queue: queuing main (7dc0404) and #174 together - #175

Closed
mergify[bot] wants to merge 22 commits into
mainfrom
mergify/merge-queue/42cc59f2ca
Closed

merge queue: queuing main (7dc0404) and #174 together#175
mergify[bot] wants to merge 22 commits into
mainfrom
mergify/merge-queue/42cc59f2ca

Conversation

@mergify

@mergify mergify Bot commented Jun 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🎉 This pull request has been checked successfully and will be merged soon. 🎉

Branch main (7dc0404) and #174 are queued together for merge.

This pull request has been created by Mergify to check the mergeability of #174.
You don't need to do anything. Mergify will close this pull request automatically when it is complete.

Required conditions of queue rule default for merge:

  • check-success = coverage
  • check-success = msrv (stable minus 1 releases)
  • check-success = msrv (stable minus 2 releases)
  • check-success = msrv (stable minus 3 releases)
  • check-success = msrv (stable minus 4 releases)
  • check-success = msrv (stable)
  • check-success = quality
  • check-success = test
  • check-success = test-cross-platform (macos-latest, macOS)
  • check-success = test-cross-platform (ubuntu-latest, Linux)
  • check-success = test-cross-platform (windows-latest, Windows)
  • all of [🛡 Merge Protections rule Do not merge outdated PRs]:
  • all of [🛡 Merge Protections rule Enforce conventional commit]:
  • all of [🛡 Merge Protections rule Full CI must pass]:
    • check-success = coverage
    • check-success = msrv (stable minus 1 releases)
    • check-success = msrv (stable minus 2 releases)
    • check-success = msrv (stable minus 3 releases)
    • check-success = msrv (stable minus 4 releases)
    • check-success = msrv (stable)
    • check-success = quality
    • check-success = test
    • check-success = test-cross-platform (macos-latest, macOS)
    • check-success = test-cross-platform (ubuntu-latest, Linux)
    • check-success = test-cross-platform (windows-latest, Windows)
  • any of [🛡 GitHub repository ruleset rule main]:
    • check-neutral = Mergify Merge Protections
    • check-skipped = Mergify Merge Protections
    • check-success = Mergify Merge Protections

Required conditions to stay in the queue:

---
checking_base_sha: 7dc04041dbce435a47e574e23fa2d15d3eb49fdb
previous_check_retries: []
previous_failed_batches: []
pull_requests:
  - number: 174
    scopes: []
scopes: []
...

unclesp1d3r and others added 22 commits June 19, 2026 11:13
@unclesp1d3r
chore: Enable various plugins in settings.json for enhanced functiona…
42726b2 
…lity

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
chore: Remove exclusion patterns from mdformat configuration
2e13409 
Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
feat: Implement ImportClassifier for tagged import/export symbol clas…
d3a415e 
…sification

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
fix: Correct formatting in AI Usage Policy for clarity
f5cf28b 
Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
chore: Update changelog for clarity and formatting improvements
de84fcd 
Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
feat: Implement ImportClassifier for tagged import/export symbol clas…
1a38973 
…sification pipeline

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
feat: Enhance ImportClassifier and normalize encoding for symbol clas…
1795d3b 
…sification pipeline

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
fix(lint): use sort_by_key for descending sorts
cd74359 
The floated toolchain's clippy (1.96) flags unnecessary_sort_by on these
pre-existing descending sorts. Convert to sort_by_key(Reverse(..)) -- same
stable comparator, behavior-preserving -- so clippy -D warnings passes.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
feat(types): add Crypto/Network/FileIO/EntryPoint tags and SectionNam…
b197305 
…e source

Add four semantic Tag variants (serde renames crypto/network/fileio/entry-point)
and a StringSource::SectionName variant for section-name rows. Thread the tags
through FromStr, the table and YARA display formatters, and both CLI --only-tags
/--no-tags long_help literals. Extend the variant-enumerating test lists and the
JSON source-serialization test; regenerate the YARA all-tags snapshot.

Implements U1 (R9). Foundational unit for the symbol classification pipeline.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
feat(ranking): add boosts for Crypto/Network/FileIO/EntryPoint tags
4559f64 
Crypto +50, Network +45, FileIO +35, EntryPoint +40 in RankingConfig::default().
Extend test_default_config_values and add a test that a Crypto-tagged string
outranks an otherwise identical untagged peer by at least the boost.

Implements U2 (R10).

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
feat(classification): add ImportClassifier and extract_symbol_strings
b85772f 
New ImportClassifier converts ContainerInfo imports, exports, and section names
into tagged FoundStrings: imports carry Tag::Import plus a semantic tag (Crypto/
Network/FileIO) from static LazyLock API sets, with section from library or a
format default (.idata/.dynsym/__LINKEDIT) and RVA when present; exports carry
Tag::Export with RVA, are demangled (Tag::DemangledSymbol), and gain
Tag::EntryPoint for known entry points; section names emit with
StringSource::SectionName. extract_symbol_strings composes all three.

Symbols are emitted as Encoding::Utf8 so byte-scanned occurrences share the
dedup key (KTD7). Provenance tests use hand-built ContainerInfo (KTD1).

Implements U3 (R1-R8, R13; AE1-AE3).

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
feat(extraction): label ASCII content as UTF-8 and make --enc ascii a…
827f601 
… content filter

ASCII extraction now emits Encoding::Utf8 (ASCII is a UTF-8 subset) so a
byte-scanned occurrence of a symbol name shares the (text, encoding) dedup key
with the classifier's occurrence and merges into one row (KTD7, enables AE4).
The Encoding::Ascii variant is retained but no longer produced as output (R15).

Since no row is labeled Encoding::Ascii anymore, --enc ascii is redefined as a
content filter (new EncodingFilter::AsciiContent): it matches rows whose text is
pure-ASCII and whose encoding is not UTF-16, preserving the flag's prior
narrow-strings-only meaning (R16). The enabled_encodings ASCII entry still gates
whether the ASCII byte-scan runs.

Implements U6 (R15, R16). Updates extracted-output encoding assertions and the
flow1 JSON snapshot (Ascii -> Utf8).

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
feat(extraction): route tagged symbols into the extraction path
872e680 
Replace the untagged import/export push in collect_all_strings with a single
extract_symbol_strings call inside the include_symbols gate, so symbols reach
live output already tagged and the Import/Export and semantic ranking boosts
fire. Section-name rows ride the same gate.

Scope section-name emission to recognized formats: the unknown/raw fallback's
synthetic 'raw-bytes' section is not a real section, so Unknown format skips
section-name rows (keeps empty-file output empty and unknown-binary rows all
attributed to 'raw-bytes').

Update symbol-property tests to the classifier contract (RVA/section/tags),
assert content via SectionData source where section names now also appear, and
add an Unknown-format regression test.

Implements U4 (R11, R12; AE4).

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
docs(classification): replace stale once_cell example with std::sync:…
641be6c 
…:LazyLock

The implementation uses std::sync::LazyLock; update the classification docs
prose and example to match. Implements U5 (R14).

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
perf(filter): short-circuit AsciiContent guards before is_ascii scan
99489d6 
Evaluate the O(1) UTF-16 encoding guards before the O(n) text.is_ascii()
content scan so UTF-16 rows skip the scan. Same boolean result; tightens the
config.rs comment to scope the no-longer-Ascii claim to the extraction path.

From ce-simplify-code review.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
fix(classification): defer export demangling to the pipeline; harden …
26e4f79 
…symbol rows

Code review found that demangling exports inside process_exports (during
extraction) ran outside the pipeline's catch_unwind guard -- a cpp_demangle
panic on a malicious export name would abort the process -- and also caused raw
mode to show demangled text. Demangling already happens once in the pipeline's
classify_strings (under catch_unwind, skipped in raw mode), so the classifier
emission was redundant. Remove it: ImportClassifier is now stateless and only
tags (Export + EntryPoint); the pipeline demangles downstream, preserving AE2
end-to-end. This also lets a mangled export share a dedup key with any
byte-scanned occurrence of the same raw name. (Deviates from plan KTD3, which
predated the knowledge that the pipeline already demangles.)

Also: skip empty section names (PE all-null name fields) so no zero-length row
reaches output; document the --enc ascii content-filter contract in the AGENTS.md
CLI table and GOTCHAS.md; strengthen the --enc ascii CLI test to assert
content-based filtering; re-point the export test to the new contract.

From ce-code-review (P1 panic-safety, P2 docs, P3 empty-name guard).

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
fix(ci): restore zig provisioning via .zig-version
f59eece 
Commit 2d7d25a removed zig from idiomatic_version_file_enable_tools without
adding it to [tools], so mise stopped reading .zig-version (0.15.2) and CI's
gen-fixtures step failed with 'zig couldn't exec process'. Re-add zig to the
idiomatic list so mise auto-installs the pinned version (exec_auto_install is
on); using the existing .zig-version pin keeps fixture layouts and insta
snapshots reproducible. Pre-existing break on main, unrelated to the feature.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
feat(tools): add zig tool with latest version and update idiomatic ve…
cd614a2 
…rsion file settings

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
fix(ci): pin zig to 0.15.2 to match fixture snapshots
a832026 
zig = latest pulled 0.16.0, which generates a materially different ELF fixture
(81 imports vs 30) than the committed insta snapshots, which were calibrated for
the .zig-version pin (0.15.2). Pin zig to 0.15.2 in [tools] so CI-generated
fixtures match the snapshots and the version is reproducible across zig releases.
Resolves the elf_symbol_extraction snapshot failure.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
fix(ci): lock zig 0.15.2 across all platforms in mise.lock
3d08bb0 
CI runs 'mise install --locked', which requires every pinned tool version in
mise.lock. The lockfile still held zig 0.16.0 (from the earlier zig=latest),
so pinning mise.toml to 0.15.2 failed to resolve under --locked. Relock zig to
0.15.2 for all 9 target platforms and prune the stale 0.16.0 entry so the pin
installs cleanly on every CI runner.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@unclesp1d3r
docs(review): address PR #174 review feedback
ed01698 
- Mark StringSource #[non_exhaustive] (matches Tag) so future variants are not
  semver-breaking for external exhaustive matches (Copilot)
- Clarify --enc help text: ascii is narrow-ASCII content filtering (CodeRabbit)
- Soften imports.rs module doc: demangle adds DemangledSymbol on success;
  names that fail to demangle are left unchanged (Copilot)
- Update origin requirements doc R3/R6/R8 to match the implementation: Mach-O
  __LINKEDIT default, demangle-in-pipeline note, StringSource::SectionName (Copilot)

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
@mergify
Merge of #174
bfa2f00
@mergify mergify Bot mentioned this pull request Jun 19, 2026
Merged
5 of 6 tasks
@codecov

codecov Bot commented Jun 19, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 99.53917% with 1 line in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
src/classification/imports.rs 99.31% 1 Missing ⚠️

📢 Thoughts on this report? Let us know!

@mergify mergify Bot closed this Jun 19, 2026
@mergify
mergify Bot deleted the mergify/merge-queue/42cc59f2ca branch June 19, 2026 22:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@unclesp1d3r